linux 防火墙firewall详解

一、常用命令

#查看防火墙状态    
systemctl status firewalld
#关闭防火墙  
systemctl stop firewalld
#3、开启防火墙  
systemctl start firewalld
#4、禁止防火墙开机自启动  
systemctl disable firewalld
#5、设置防火墙开机自启动  
systemctl enable firewalld

使用firewall-cmd命令管理防火墙

#  查看防火墙状态：
firewall-cmd --state
#查看防火墙，添加的端口也可以看到：
firewall-cmd --list-all
#列出所有区域的设置:
firewall-cmd --list-all-zones
#查看防火墙已开放的端口列表(默认不开放任何端口)   
firewall-cmd --list-ports
# 查看获取的区域
[root@localhost ~] firewall-cmd --get-active-zones
dockerinterfaces: docker0注意：所有操作之前都需附带 --zone=public --permanent（指定区域和永久生效）。操作之后需要执行firewall-cmd --reload刷新配置。
# 添加规则 开启80端口（允许80端口通过防火墙）
firewall-cmd --permanent --zone=public --add-port=80/tcp    # --permanent (永久生效)
#更新防火墙规则  
firewall-cmd --reload
# 删除开放的端口  
firewall-cmd --permanent --zone=public  --remove-port=80/tcp  
# 查看80端口状态：
firewall-cmd --zone=public --query-port=80/tcp-------------- ip白名单设置 ----------------
#关闭某个端口
#开启某个端口（指定IP可访问） 只允许服务器192.168.1.1/24网段的3306端口能访问
firewall-cmd --permanent --zone=public --add-rich-rule="rule family="ipv4" source address="192.168.1.1/24" port protocol="tcp" port="3306" accept"
#禁止ping数据包：
firewall-cmd --permanent --add-rich-rule='rule protocol value=icmp drop'
# 关闭某个端口（删除策略） 
firewall-cmd --permanent --zone=public --remove-rich-rule="rule family="ipv4" source address="10.1.1.14/32" port protocol="tcp" port="80" accept"# 拒绝所有包：
firewall-cmd --panic-on
# 取消拒绝状态： 
firewall-cmd --panic-off
# 查看是否拒绝： 
firewall-cmd --query-panic#显示服务列表：
firewall-cmd --get-services
#允许SSH服务通过：
firewall-cmd --add-service=ssh
#禁止SSH服务通过：
firewall-cmd --remove-service=ssh
#显示当前服务：
firewall-cmd --list-services#临时允许Samba服务通过600秒：
firewall-cmd --enable service=samba --timeout=600#查看指定接口所属区域：
firewall-cmd --get-zone-of-interface=eth0
#完全重新载入规则（会中断已连接的连接，类似于重启）：
firewall-cmd --complete-reload注意：打开防火墙后一定要先添加ssh端口到规则中，并重新载入
firewall-cmd --permanent --zone=public --add-port=22/tcp 
firewall-cmd --reload

引用：https://www.cnblogs.com/excelib/p/5155951.html

二、配置docker0服务到受信任连接

#配置docker0服务到受信任连接
nmcli connection modify docker0 connection.zone trusted#停止NetworkManager（检测网络、自动连接网络的程序）服务
systemctl stop NetworkManager.service#修改docker网络接口为内部区域（永久）
firewall-cmd --permanent --zone=trusted --change-interface=docker0#启动NetworkManager（检测网络、自动连接网络的程序）服务
systemctl start NetworkManager.service#配置docker0服务到受信任连接
nmcli connection modify docker0 connection.zone trusted#重启docker服务
systemctl restart docker.service

三、help 帮助详解

[root@localhost ~]# firewall-cmd --helpUsage: firewall-cmd [OPTIONS...]General Options-h, --help           Prints a short help text and exists-V, --version        Print the version string of firewalld-q, --quiet          Do not print status messagesStatus Options 	状态选择--state              Return and print firewalld state					返回并打印防火墙状态--reload             Reload firewall and keep state information		重新加载防火墙并保留状态信息--complete-reload    Reload firewall and lose state information		重新加载防火墙并丢失状态信息--runtime-to-permanentCreate permanent from runtime configuration--check-config       Check permanent configuration for errorsLog Denied Options 	日志拒绝选项--get-log-denied     Print the log denied value			打印日志拒绝值--set-log-denied=<value>Set log denied valueAutomatic Helpers Options--get-automatic-helpersPrint the automatic helpers value--set-automatic-helpers=<value>Set automatic helpers valuePermanent Options--permanent          Set an option permanentlyUsable for options marked with [P]

Zone Options 区域选项

Zone Options--get-default-zone   Print default zone for connections and interfaces		打印连接和接口的默认区域--set-default-zone=<zone>Set default zone						设置默认区域--get-active-zones   Print currently active zones 		打印当前活动区域--get-zones          Print predefined zones [P]			打印预定义区域--get-services       Print predefined services [P]		打印预定义服务--get-icmptypes      Print predefined icmptypes [P]--get-zone-of-interface=<interface>Print name of the zone the interface is bound to [P]--get-zone-of-source=<source>[/<mask>]|<MAC>|ipset:<ipset>Print name of the zone the source is bound to [P]--list-all-zones     List everything added for or enabled in all zones [P]--new-zone=<zone>    Add a new zone [P only]--new-zone-from-file=<filename> [--name=<zone>]Add a new zone from file with optional name [P only]--delete-zone=<zone> Delete an existing zone [P only]--load-zone-defaults=<zone>Load zone default settings [P only] [Z]--zone=<zone>        Use this zone to set or query options, else default zoneUsable for options marked with [Z]--get-target         Get the zone target [P only] [Z]--set-target=<target>Set the zone target [P only] [Z]--info-zone=<zone>   Print information about a zone--path-zone=<zone>   Print file path of a zone [P only]

IPSet Options

IPSet Options--get-ipset-types    Print the supported ipset types 							打印支持的ipset类型--new-ipset=<ipset> --type=<ipset type> [--option=<key>[=<value>]]..Add a new ipset [P only]--new-ipset-from-file=<filename> [--name=<ipset>]Add a new ipset from file with optional name [P only]--delete-ipset=<ipset>Delete an existing ipset [P only]--load-ipset-defaults=<ipset>Load ipset default settings [P only]--info-ipset=<ipset> Print information about an ipset--path-ipset=<ipset> Print file path of an ipset [P only]--get-ipsets         Print predefined ipsets--ipset=<ipset> --set-description=<description>Set new description to ipset [P only]--ipset=<ipset> --get-descriptionPrint description for ipset [P only]--ipset=<ipset> --set-short=<description>Set new short description to ipset [P only]--ipset=<ipset> --get-shortPrint short description for ipset [P only]--ipset=<ipset> --add-entry=<entry>Add a new entry to an ipset [P]--ipset=<ipset> --remove-entry=<entry>Remove an entry from an ipset [P]--ipset=<ipset> --query-entry=<entry>Return whether ipset has an entry [P]--ipset=<ipset> --get-entriesList entries of an ipset [P]--ipset=<ipset> --add-entries-from-file=<entry>Add a new entries to an ipset [P]--ipset=<ipset> --remove-entries-from-file=<entry>Remove entries from an ipset [P]

IcmpType Options

IcmpType Options--new-icmptype=<icmptype>Add a new icmptype [P only]--new-icmptype-from-file=<filename> [--name=<icmptype>]Add a new icmptype from file with optional name [P only]--delete-icmptype=<icmptype>Delete an existing icmptype [P only]--load-icmptype-defaults=<icmptype>Load icmptype default settings [P only]--info-icmptype=<icmptype>Print information about an icmptype--path-icmptype=<icmptype>Print file path of an icmptype [P only]--icmptype=<icmptype> --set-description=<description>Set new description to icmptype [P only]--icmptype=<icmptype> --get-descriptionPrint description for icmptype [P only]--icmptype=<icmptype> --set-short=<description>Set new short description to icmptype [P only]--icmptype=<icmptype> --get-shortPrint short description for icmptype [P only]--icmptype=<icmptype> --add-destination=<ipv>Enable destination for ipv in icmptype [P only]--icmptype=<icmptype> --remove-destination=<ipv>Disable destination for ipv in icmptype [P only]--icmptype=<icmptype> --query-destination=<ipv>Return whether destination ipv is enabled in icmptype [P only]--icmptype=<icmptype> --get-destinationsList destinations in icmptype [P only]

Service Options

Service Options--new-service=<service>Add a new service [P only]--new-service-from-file=<filename> [--name=<service>]Add a new service from file with optional name [P only]--delete-service=<service>Delete an existing service [P only]--load-service-defaults=<service>Load icmptype default settings [P only]--info-service=<service>Print information about a service--path-service=<service>Print file path of a service [P only]--service=<service> --set-description=<description>Set new description to service [P only]--service=<service> --get-descriptionPrint description for service [P only]--service=<service> --set-short=<description>Set new short description to service [P only]--service=<service> --get-shortPrint short description for service [P only]--service=<service> --add-port=<portid>[-<portid>]/<protocol>Add a new port to service [P only]--service=<service> --remove-port=<portid>[-<portid>]/<protocol>Remove a port from service [P only]--service=<service> --query-port=<portid>[-<portid>]/<protocol>Return whether the port has been added for service [P only]--service=<service> --get-portsList ports of service [P only]--service=<service> --add-protocol=<protocol>Add a new protocol to service [P only]--service=<service> --remove-protocol=<protocol>Remove a protocol from service [P only]--service=<service> --query-protocol=<protocol>Return whether the protocol has been added for service [P only]--service=<service> --get-protocolsList protocols of service [P only]--service=<service> --add-source-port=<portid>[-<portid>]/<protocol>Add a new source port to service [P only]--service=<service> --remove-source-port=<portid>[-<portid>]/<protocol>Remove a source port from service [P only]--service=<service> --query-source-port=<portid>[-<portid>]/<protocol>Return whether the source port has been added for service [P only]--service=<service> --get-source-portsList source ports of service [P only]--service=<service> --add-module=<module>Add a new module to service [P only]--service=<service> --remove-module=<module>Remove a module from service [P only]--service=<service> --query-module=<module>Return whether the module has been added for service [P only]--service=<service> --get-modulesList modules of service [P only]--service=<service> --set-destination=<ipv>:<address>[/<mask>]Set destination for ipv to address in service [P only]--service=<service> --remove-destination=<ipv>Disable destination for ipv i service [P only]--service=<service> --query-destination=<ipv>:<address>[/<mask>]Return whether destination ipv is set for service [P only]--service=<service> --get-destinationsList destinations in service [P only]

Options to Adapt and Query Zones 适应和查询区域的选项

Options to Adapt and Query Zones--list-all           List everything added for or enabled in a zone [P] [Z]--list-services      List services added for a zone [P] [Z]--timeout=<timeval>  Enable an option for timeval time, where timeval isa number followed by one of letters 's' or 'm' or 'h'Usable for options marked with [T]--set-description=<description>Set new description to zone [P only] [Z]--get-description    Print description for zone [P only] [Z]--set-short=<description>Set new short description to zone [P only] [Z]--get-short          Print short description for zone [P only] [Z]--add-service=<service>Add a service for a zone [P] [Z] [T]--remove-service=<service>Remove a service from a zone [P] [Z]--query-service=<service>Return whether service has been added for a zone [P] [Z]--list-ports         List ports added for a zone [P] [Z]--add-port=<portid>[-<portid>]/<protocol>Add the port for a zone [P] [Z] [T]--remove-port=<portid>[-<portid>]/<protocol>Remove the port from a zone [P] [Z]--query-port=<portid>[-<portid>]/<protocol>Return whether the port has been added for zone [P] [Z]--list-protocols     List protocols added for a zone [P] [Z]--add-protocol=<protocol>Add the protocol for a zone [P] [Z] [T]--remove-protocol=<protocol>Remove the protocol from a zone [P] [Z]--query-protocol=<protocol>Return whether the protocol has been added for zone [P] [Z]--list-source-ports  List source ports added for a zone [P] [Z]--add-source-port=<portid>[-<portid>]/<protocol>Add the source port for a zone [P] [Z] [T]--remove-source-port=<portid>[-<portid>]/<protocol>Remove the source port from a zone [P] [Z]--query-source-port=<portid>[-<portid>]/<protocol>Return whether the source port has been added for zone [P] [Z]--list-icmp-blocks   List Internet ICMP type blocks added for a zone [P] [Z]--add-icmp-block=<icmptype>Add an ICMP block for a zone [P] [Z] [T]--remove-icmp-block=<icmptype>Remove the ICMP block from a zone [P] [Z]--query-icmp-block=<icmptype>Return whether an ICMP block has been added for a zone[P] [Z]--add-icmp-block-inversionEnable inversion of icmp blocks for a zone [P] [Z]--remove-icmp-block-inversionDisable inversion of icmp blocks for a zone [P] [Z]--query-icmp-block-inversionReturn whether inversion of icmp blocks has been enabledfor a zone [P] [Z]--list-forward-ports List IPv4 forward ports added for a zone [P] [Z]--add-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]]Add the IPv4 forward port for a zone [P] [Z] [T]--remove-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]]Remove the IPv4 forward port from a zone [P] [Z]--query-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]]Return whether the IPv4 forward port has been added fora zone [P] [Z]--add-masquerade     Enable IPv4 masquerade for a zone [P] [Z] [T]--remove-masquerade  Disable IPv4 masquerade for a zone [P] [Z]--query-masquerade   Return whether IPv4 masquerading has been enabled for azone [P] [Z]--list-rich-rules    List rich language rules added for a zone [P] [Z]--add-rich-rule=<rule>Add rich language rule 'rule' for a zone [P] [Z] [T]--remove-rich-rule=<rule>Remove rich language rule 'rule' from a zone [P] [Z]--query-rich-rule=<rule>Return whether a rich language rule 'rule' has beenadded for a zone [P] [Z]

Options to Handle Bindings of Interfaces 处理接口绑定的选项

Options to Handle Bindings of Interfaces--list-interfaces    List interfaces that are bound to a zone [P] [Z]--add-interface=<interface>Bind the <interface> to a zone [P] [Z]--change-interface=<interface>Change zone the <interface> is bound to [P] [Z]--query-interface=<interface>Query whether <interface> is bound to a zone [P] [Z]--remove-interface=<interface>Remove binding of <interface> from a zone [P] [Z]Options to Handle Bindings of Sources--list-sources       List sources that are bound to a zone [P] [Z]--add-source=<source>[/<mask>]|<MAC>|ipset:<ipset>Bind the source to a zone [P] [Z]--change-source=<source>[/<mask>]|<MAC>|ipset:<ipset>Change zone the source is bound to [Z]--query-source=<source>[/<mask>]|<MAC>|ipset:<ipset>Query whether the source is bound to a zone [P] [Z]--remove-source=<source>[/<mask>]|<MAC>|ipset:<ipset>Remove binding of the source from a zone [P] [Z]

Helper Options 助手选项

Helper Options--new-helper=<helper> --module=<module> [--family=<family>]Add a new helper [P only]--new-helper-from-file=<filename> [--name=<helper>]Add a new helper from file with optional name [P only]--delete-helper=<helper>Delete an existing helper [P only]--load-helper-defaults=<helper>Load helper default settings [P only]--info-helper=<helper> Print information about an helper--path-helper=<helper> Print file path of an helper [P only]--get-helpers         Print predefined helpers--helper=<helper> --set-description=<description>Set new description to helper [P only]--helper=<helper> --get-descriptionPrint description for helper [P only]--helper=<helper> --set-short=<description>Set new short description to helper [P only]--helper=<helper> --get-shortPrint short description for helper [P only]--helper=<helper> --add-port=<portid>[-<portid>]/<protocol>Add a new port to helper [P only]--helper=<helper> --remove-port=<portid>[-<portid>]/<protocol>Remove a port from helper [P only]--helper=<helper> --query-port=<portid>[-<portid>]/<protocol>Return whether the port has been added for helper [P only]--helper=<helper> --get-portsList ports of helper [P only]--helper=<helper> --set-module=<module>Set module to helper [P only]--helper=<helper> --get-moduleGet module from helper [P only]--helper=<helper> --set-family={ipv4|ipv6|}Set family for helper [P only]--helper=<helper> --get-familyGet module from helper [P only]

Direct Options 直接选项

Direct Options--direct             First option for all direct options			所有直接选项的第一个选项--get-all-chainsGet all chains [P]							获得所有链条--get-chains {ipv4|ipv6|eb} <table>Get all chains added to the table [P]--add-chain {ipv4|ipv6|eb} <table> <chain>Add a new chain to the table [P]--remove-chain {ipv4|ipv6|eb} <table> <chain>Remove the chain from the table [P]--query-chain {ipv4|ipv6|eb} <table> <chain>Return whether the chain has been added to the table [P]--get-all-rulesGet all rules [P]--get-rules {ipv4|ipv6|eb} <table> <chain>Get all rules added to chain in table [P]--add-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>...Add rule to chain in table [P]--remove-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>...Remove rule with priority from chain in table [P]--remove-rules {ipv4|ipv6|eb} <table> <chain>Remove rules from chain in table [P]--query-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>...Return whether a rule with priority has been added tochain in table [P]--passthrough {ipv4|ipv6|eb} <arg>...Pass a command through (untracked by firewalld)--get-all-passthroughsGet all tracked passthrough rules [P]--get-passthroughs {ipv4|ipv6|eb} <arg>...Get tracked passthrough rules [P]--add-passthrough {ipv4|ipv6|eb} <arg>...Add a new tracked passthrough rule [P]--remove-passthrough {ipv4|ipv6|eb} <arg>...Remove a tracked passthrough rule [P]--query-passthrough {ipv4|ipv6|eb} <arg>...Return whether the tracked passthrough rule has beenadded [P]

Lockdown Options

Lockdown Options--lockdown-on        Enable lockdown.--lockdown-off       Disable lockdown.--query-lockdown     Query whether lockdown is enabled

Lockdown Whitelist Options

Lockdown Whitelist Options--list-lockdown-whitelist-commandsList all command lines that are on the whitelist [P]--add-lockdown-whitelist-command=<command>Add the command to the whitelist [P]--remove-lockdown-whitelist-command=<command>Remove the command from the whitelist [P]--query-lockdown-whitelist-command=<command>Query whether the command is on the whitelist [P]--list-lockdown-whitelist-contextsList all contexts that are on the whitelist [P]--add-lockdown-whitelist-context=<context>Add the context context to the whitelist [P]--remove-lockdown-whitelist-context=<context>Remove the context from the whitelist [P]--query-lockdown-whitelist-context=<context>Query whether the context is on the whitelist [P]--list-lockdown-whitelist-uidsList all user ids that are on the whitelist [P]--add-lockdown-whitelist-uid=<uid>Add the user id uid to the whitelist [P]--remove-lockdown-whitelist-uid=<uid>Remove the user id uid from the whitelist [P]--query-lockdown-whitelist-uid=<uid>Query whether the user id uid is on the whitelist [P]--list-lockdown-whitelist-usersList all user names that are on the whitelist [P]--add-lockdown-whitelist-user=<user>Add the user name user to the whitelist [P]--remove-lockdown-whitelist-user=<user>Remove the user name user from the whitelist [P]--query-lockdown-whitelist-user=<user>Query whether the user name user is on the whitelist [P]

Panic Options

Panic Options--panic-on           Enable panic mode--panic-off          Disable panic mode--query-panic        Query whether panic mode is enabled