firewalld常用用法

Posted 2022-01-07 longren

1.内部所有主机都需要通过管理机上网,关闭掉内部主机的eth0网卡

管理机开启防火墙的IP地址伪装功能

[[email protected] ~]#  firewall-cmd --add-masquerade --permanent
success
[[email protected] ~]#  firewall-cmd --reload
success
[[email protected] ~]# ssh [email protected]
[email protected]'s password: 
Last login: Wed Jun 12 16:31:06 2019 from 10.0.0.2
[[email protected] ~]# ping baidu.com
ping: baidu.com: Name or service not known

内网机修改网卡信息，网关指向管理机

[[email protected] ~]# vim /etc/sysconfig/network-scripts/ifcfg-eth1
TYPE=Ethernet
BOOTPROTO=none
NAME=eth1
DEVICE=eth1
ONBOOT=yes
IPADDR=172.16.1.7
GATEWAY=172.16.1.61
PREFIX=24 

添加DNS

[[email protected] ~]# cat /etc/resolv.conf

Generated by NetworkManager

nameserver 223.6.6.6
[[email protected] ~]# systemctl restart network
[[email protected] ~]# ifdown eth1 && ifup eth1
Device 'eth1' successfully disconnected.
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/11)
[[email protected] ~]# ping baidu.com
PING baidu.com (220.181.38.148) 56(84) bytes of data.
64 bytes from 220.181.38.148 (220.181.38.148): icmp_seq=1 ttl=128 time=26.2 ms

2.管理主机(10.0.0.3)仅允许公司的10.0.0.1的IP地址连接,其他统统拒绝.

[[email protected] ~]# firewall-cmd --add-rich-rule='rule family=ipv4 source address=10.0.0.1/32 service name=ssh accept'
success

[[email protected] ~]# firewall-cmd --list-all 


#测试
[[email protected] ~]# ssh [email protected]
ssh: connect to host 10.0.0.3 port 22: No route to host

      ssh [email protected]
[email protected]'s password: 
Last login: Wed Jun 12 20:28:28 2019 from 172.16.1.5

3.将9000端口做成一个服务名称,比如php-fpm,则代表放行9000

[[email protected] ~]# cd /usr/lib/firewalld/services/
[[email protected] services]# cp http.xml php-fpm.xml
[[email protected] services]#  vim php-fpm.xml

<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>php-fpm</short>
  <description>php-fpm Server</description>
  <port protocol="tcp" port="9000"/>
</service>
[[email protected] services]# systemctl restart firewalld.service 
[[email protected] services]# firewall-cmd --add-service=php-fpm
success
[[email protected] services]# firewall-cmd --list-all

4.在负载均衡服务上,仅放行80和443,22端口只有10.0.0.2能正常连接,其他统统拒绝.

[[email protected] ~]# firewall-cmd --add-service=https,http
[[email protected] ~]# firewall-cmd --add-rich-rule='rule family=ipv4 source address=10.0.0.2/32 service name=ssh accept'
[[email protected] ~]# firewall-cmd --list-all