linux中防火牆策略管理工具firewalld
阿新 • • 發佈:2020-12-22
firewalld擁有命令列介面(CLI)和圖形使用者介面(GUI)
firewalld中有區域的概念,區域就是防火牆配置策略的模板。
firewalld中常用的區域名稱及策略規則:
以下實驗主要是命令列介面的常用命令
1、常用的引數表格
2、檢視firewalld服務當前所使用的區域
[root@PC1 ~]# firewall-cmd --get-default-zone ## 當前的區域為public
public
3、檢視eno16777728網絡卡在firewalld服務中的區域
[root@PC1 network-scripts]# nmcli connection show ## 檢視網絡卡名稱
NAME UUID TYPE DEVICE
eno16777728 d6f581bd-b571-43bf-bb9c-c37d935855ee 802-3-ethernet eno16777728
[root@PC1 network-scripts]# firewall-cmd --get-zone-of-interface=eno16777728 ## 網絡卡在firewalld服務中的區域為public
public
4、將eno16777728的網絡卡區域設定為external(模式為permanent)
[root@PC1 network-scripts]# firewall-cmd --permanent --zone=external --change-interface =eno16777728 ## 將網絡卡在firewalld服務中區域修改為external
success
[root@PC1 network-scripts]# firewall-cmd --get-zone-of-interface=eno16777728 ## 當前並未生效(因為使用的permanent模式)
public
[root@PC1 network-scripts]# firewall-cmd --permanent --get-zone-of-interface=eno16777728
external
5、將firewalld服務的當前區域設定為external(執行模式為runtime)
[root@PC1 network-scripts]# firewall-cmd --get-default-zone ## 當前的服務區域為public
public
[root@PC1 network-scripts]# firewall-cmd --set-default-zone=external ## 設定為external
success
[root@PC1 network-scripts]# firewall-cmd --get-default-zone ## 修改成功(因為執行模式為runtime)
external
6、測試應急模式(192.168.10.10位當前設定的主機, 192.168.10.20為另一臺主機)
[root@PC2 ~]# ifconfig | head -n 3
eno16777728: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.10.20 netmask 255.255.255.0 broadcast 192.168.10.255
inet6 fe80::20c:29ff:fe25:bb3e prefixlen 64 scopeid 0x20<link>
[root@PC2 ~]# ping -c 3 192.168.10.10
PING 192.168.10.10 (192.168.10.10) 56(84) bytes of data.
64 bytes from 192.168.10.10: icmp_seq=1 ttl=64 time=0.261 ms
64 bytes from 192.168.10.10: icmp_seq=2 ttl=64 time=0.215 ms
64 bytes from 192.168.10.10: icmp_seq=3 ttl=64 time=0.195 ms
--- 192.168.10.10 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2000ms
rtt min/avg/max/mdev = 0.195/0.223/0.261/0.032 ms
[root@PC1 network-scripts]# firewall-cmd --panic-on ## 開啟應急模式
success
[root@PC2 ~]# ping -c 3 192.168.10.10
PING 192.168.10.10 (192.168.10.10) 56(84) bytes of data.
--- 192.168.10.10 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 1999ms
[root@PC1 network-scripts]# firewall-cmd --panic-off ## 關閉應急模式
success
[root@PC2 ~]# ping -c 3 192.168.10.10
PING 192.168.10.10 (192.168.10.10) 56(84) bytes of data.
64 bytes from 192.168.10.10: icmp_seq=1 ttl=64 time=0.291 ms
64 bytes from 192.168.10.10: icmp_seq=2 ttl=64 time=0.226 ms
64 bytes from 192.168.10.10: icmp_seq=3 ttl=64 time=0.193 ms
--- 192.168.10.10 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2000ms
rtt min/avg/max/mdev = 0.193/0.236/0.291/0.044 ms
7、將firewalld服務的區域修改文public
[root@PC1 network-scripts]# firewall-cmd --get-default-zone
external
[root@PC1 network-scripts]# firewall-cmd --set-default-zone=public
success
[root@PC1 network-scripts]# firewall-cmd --get-default-zone
public
8、檢視public區域是否允許請求SSH和HTTPS協議的流量
[root@PC1 network-scripts]# firewall-cmd --zone=public --query-service=ssh
yes
[root@PC1 network-scripts]# firewall-cmd --zone=public --query-service=https
no
9、把firewalld服務中請求HTTPS協議的流量設定為永久允許,並立即生效
[root@PC1 network-scripts]# firewall-cmd --zone=public --add-service=https --permanent
success
[root@PC1 network-scripts]# firewall-cmd --reload
success
[root@PC1 network-scripts]# firewall-cmd --zone=public --query-service=https
yes
10、將firewalld服務中請求HTTP協議的流量設定為永久拒絕,並立即生效
[root@PC1 network-scripts]# firewall-cmd --zone=public --query-service=http
no
[root@PC1 network-scripts]# firewall-cmd --zone=public --add-service=http --permanent
success
[root@PC1 network-scripts]# firewall-cmd --reload
success
[root@PC1 network-scripts]# firewall-cmd --zone=public --query-service=http
yes
[root@PC1 network-scripts]# firewall-cmd --zone=public --remove-service=http --permanent
success
[root@PC1 network-scripts]# firewall-cmd --reload
success
[root@PC1 network-scripts]# firewall-cmd --zone=public --query-service=http
no
11、把在firewalld服務中訪問8080和8081埠的流量策略設定為允許,但僅限當前生效
[root@PC1 network-scripts]# firewall-cmd --zone=public --list-ports
[root@PC1 network-scripts]# firewall-cmd --zone=public --add-port=8080-8081/tcp
success
[root@PC1 network-scripts]# firewall-cmd --zone=public --list-ports
8080-8081/tcp
12、把原本訪問本機888埠的流量轉發到22埠,當前和長期均有效 (22埠為ssh服務的埠)
[root@PC2 ~]# ssh -p 888 192.168.10.10
ssh: connect to host 192.168.10.10 port 888: No route to host
[root@PC1 network-scripts]# firewall-cmd --permanent --zone=public --add-forward-port=port=888:proto=tcp:toport=22:toaddr=192.168.10.10
success
[root@PC1 network-scripts]# firewall-cmd --reload
success
[root@PC2 ~]# ssh -p 888 192.168.10.10
The authenticity of host '[192.168.10.10]:888 ([192.168.10.10]:888)' can't be established.
ECDSA key fingerprint is 0d:69:cb:ad:61:42:f3:f7:7b:93:4b:b4:af:83:4d:8e.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '[192.168.10.10]:888' (ECDSA) to the list of known hosts.
root@192.168.10.10's password:
Last login: Wed Dec 2 16:39:39 2020
[root@PC1 ~]# ifconfig | head -n 3
eno16777728: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.10.10 netmask 255.255.255.0 broadcast 192.168.10.255
inet6 fe80::20c:29ff:fe66:37f7 prefixlen 64 scopeid 0x20<link>
[root@PC1 ~]# exit
logout
Connection to 192.168.10.10 closed.
13、拒絕192.168.10.0/24網段的所有使用者訪問本機的ssh服務(firewalld中的富規則)
[root@PC2 ~]# ssh 192.168.10.10
The authenticity of host '192.168.10.10 (192.168.10.10)' can't be established.
ECDSA key fingerprint is 0d:69:cb:ad:61:42:f3:f7:7b:93:4b:b4:af:83:4d:8e.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.10.10' (ECDSA) to the list of known hosts.
root@192.168.10.10's password:
Last login: Tue Dec 22 14:18:10 2020 from 192.168.10.20
[root@PC1 ~]# ifconfig | head -n 3
eno16777728: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.10.10 netmask 255.255.255.0 broadcast 192.168.10.255
inet6 fe80::20c:29ff:fe66:37f7 prefixlen 64 scopeid 0x20<link>
[root@PC1 ~]# exit
logout
Connection to 192.168.10.10 closed.
[root@PC1 network-scripts]# firewall-cmd --permanent --zone=public --add-rich-rule="rule family="ipv4" source address="192.168.10.0/24" service name="ssh" reject"
success
[root@PC1 network-scripts]# firewall-cmd --reload
success
[root@PC2 ~]# ssh 192.168.10.10
ssh: connect to host 192.168.10.10 port 22: Connection refused
以上實驗演示了firewalld服務命令列形式的常規的防火牆配置。