CentOS7的firewall和安装iptables

来源：互联网发布：温暖的句子知乎编辑：程序博客网时间：2024/05/29 05:05

前言：CentOS7 的防火墙默认使用是firewall，而我们通常使用iptables；

本文记录了firewall基础的命令和iptables的安装和使用。

firewall部分：

part1 : 服务命令

systemctl start firewalld#启动

systemctl status firewalld #查看运行状态

systemctl stop firewalld.service #停止firewall

systemctl disable firewalld.service #禁用：禁止firewall开机启动

firewall-cmd --state #查看默认防火墙状态（关闭后显示notrunning，开启后显示running）

firewall-cmd--reload 重启

part2 : 端口命令：

添加

firewall-cmd --zone=public --add-port=80/tcp --permanent （--permanent永久生效，没有此参数重启后失效）

重新载入

firewall-cmd --reload

查看

firewall-cmd --zone= public --query-port=80/tcp

删除

firewall-cmd --zone= public --remove-port=80/tcp --permanent

part3:示例

示例：firewall端口操作完之后需要重启服务生效

[root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --query-port=3307/tcpno[root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --add-port=3307/tcp --permanentsuccess[root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --query-port=3307/tcpno[root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --reloadsuccess[root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --query-port=3307/tcpyes

示例：mysql开放远程端口

[root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --add-port=3306/tcp --permanentsuccess[root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --reloadsuccess[root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --staterunning[root@iZ2zeczh9tfpmxmijw5qppZ ~]#[root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --query-port=3306/tcpyes[root@iZ2zeczh9tfpmxmijw5qppZ ~]#

iptables部分

part1 : 服务命令

systemctl start iptables #启动

systemctl status iptables #查看运行状态

systemctl restart iptables.service #停止iptables

systemctl stop iptables.service #停止iptables

systemctl disable iptables.service #禁用：禁止iptables开机启动

systemctl enable iptables.service #启用：设置iptables开机启动

part2 : 安装

step1 ：查看是否安装

[root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl status iptablesUnit iptables.service could not be found.[root@iZ2zeczh9tfpmxmijw5qppZ ~]#

没有相关服务

step2 : yum install

[root@iZ2zeczh9tfpmxmijw5qppZ ~]# yum install iptables-servicesLoaded plugins: fastestmirrorbase                                                                                                             | 3.6 kB  00:00:00     epel                                                                                                             | 4.3 kB  00:00:00     extras                                                                                                           | 3.4 kB  00:00:00     mysql-connectors-community                                                                                       | 2.5 kB  00:00:00     mysql-tools-community                                                                                            | 2.5 kB  00:00:00     mysql56-community                                                                                                | 2.5 kB  00:00:00     updates                                                                                                          | 3.4 kB  00:00:00     updates/7/x86_64/primary_db                                                                                      | 6.4 MB  00:00:06     Loading mirror speeds from cached hostfile * base: mirrors.aliyuncs.com * epel: mirrors.aliyuncs.com * extras: mirrors.aliyuncs.com * updates: mirrors.aliyuncs.comResolving Dependencies--> Running transaction check---> Package iptables-services.x86_64 0:1.4.21-17.el7 will be installed--> Finished Dependency ResolutionDependencies Resolved======================================================================================================================================== Package                                Arch                        Version                             Repository                 Size========================================================================================================================================Installing: iptables-services                      x86_64                      1.4.21-17.el7                       base                       50 kTransaction Summary========================================================================================================================================Install  1 PackageTotal download size: 50 kInstalled size: 24 kIs this ok [y/d/N]: YDownloading packages:iptables-services-1.4.21-17.el7.x86_64.rpm                                                                       |  50 kB  00:00:00     Running transaction checkRunning transaction testTransaction test succeededRunning transaction  Installing : iptables-services-1.4.21-17.el7.x86_64                                                                               1/1 warning: /etc/sysconfig/iptables created as /etc/sysconfig/iptables.rpmnew  Verifying  : iptables-services-1.4.21-17.el7.x86_64                                                                               1/1 Installed:  iptables-services.x86_64 0:1.4.21-17.el7                                                                                              Complete![root@iZ2zeczh9tfpmxmijw5qppZ ~]#

安装成功！

step3 : check

[root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl status iptables   iptables.service - IPv4 firewall with iptables   Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled; vendor preset: disabled)   Active: inactive (dead)[root@iZ2zeczh9tfpmxmijw5qppZ ~]#

step4 : start

[root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl start iptables[root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl enable iptables.serviceCreated symlink from /etc/systemd/system/basic.target.wants/iptables.service to /usr/lib/systemd/system/iptables.service.[root@iZ2zeczh9tfpmxmijw5qppZ ~]#

[root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl status iptables   iptables.service - IPv4 firewall with iptables   Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled; vendor preset: disabled)   Active: active (exited) since Wed 2017-06-21 15:44:41 CST; 1min 17s ago Main PID: 506 (code=exited, status=0/SUCCESS)Jun 21 15:44:41 iZ2zeczh9tfpmxmijw5qppZ systemd[1]: Starting IPv4 firewall with iptables...Jun 21 15:44:41 iZ2zeczh9tfpmxmijw5qppZ iptables.init[506]: iptables: Applying firewall rules: [  OK  ]Jun 21 15:44:41 iZ2zeczh9tfpmxmijw5qppZ systemd[1]: Started IPv4 firewall with iptables.[root@iZ2zeczh9tfpmxmijw5qppZ ~]#

step5 : 修改配置文件

vi /etc/sysconfig/iptables

systemctl restart iptables.service #重启防火墙使配置生效

step6 ：关闭SELINUX

vi/etc/selinux/config

#SELINUX=enforcing #注释掉

#SELINUXTYPE=targeted #注释掉

SELINUX=disabled #增加

:wq! #保存退出

setenforce 0 #使配置立即生效

备注：

SELINUX不关闭时，iptables不读取配置文件，一般采取关闭SELINUX的方式避免这种冲突

阅读全文

1 0