防火墙的更改的两种方式

# 查看防火墙状态
systemctl status firewalld
service iptables status

• iptables

# 编辑iptables防火墙内容，i进入编辑状态
vi /etc/sysconfig/iptables
# 允许某个IP访问某个端口或者端口段
# 框架
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [273:41231]

  # 内容

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited

# 10022远程端口访问
-A INPUT -s 10.120.179.80/32 -p tcp --dport 10022 ACCEPT
#  对某一个IP全端口开放
-A INPUT -s 10.120.179.80/32 -j ACCEPT
# 对一个IP段开放某一个端口
-I INPUT -m iprange --src-range 10.120.179.69-10.120.179.120 -p tcp --dport 8886 -j ACCEPT
# 禁掉某个端口
-A INPUT -p tcp --dport 5989 -j DROP

# 改动后重启防火墙
service iptables restart
systemctl restart iptables(未知)

• firewalld

# 编辑防火墙文件
vi /etc/firewalld/zones/public.xml
# 允许某个IP访问某个端口或者端口段
# 框架
<?xml version="1.0" encoding="utf-8">
<zone>
  <short>Public</short>
  <descripion>For use in public areas.You do not trust the other computers on networks to not harm your computer.Only selected in comming connection are accepted.</descripion>
  <service name="dhcpv6-client"/>
  # 加入允许的IP和端口
</zone>

# 规则
# 10022访问限制
<rule family="ipv4"><source address="10.120.179.80"/><port protocol="tcp" port="10022"/><accept/></rule>
# 全端口开放
<rule family="ipv4"><source address="10.120.179.80"/><accept/></rule>
# 端口段配置
<rule family="ipv4"><source address="10.120.179.80"/><port protocol="tcp" port="8881-8889"/><accept/></rule>

#重启防火墙
systemctl restart firewalld
firewall-cmd --reload

• 附

firewall-cmd --get-zones  	#显示预定义的区域 
firewall-cmd --get-service  	#显示预定义的服务 
firewall-cmd --get-icmptypes	#显示预定义的 ICMP 类型 
# 显示当前系统中的默认区域
firewall-cmd --get-default-zone
# 设置网络连接或接口的默认区域
[root@localhost ~]# firewall-cmd --set-default-zone=work
success
[root@localhost ~]# firewall-cmd --get-default-zone
work

# 显示默认区域的所有规则
[root@localhost ~]# firewall-cmd --list-all
public (active) 
target: default 
icmp-block-inversion: no 
interfaces: ens33 
# 显示指定区域内允许访问的所有端口号
[root@localhost ~]# firewall-cmd --zone=public --list-ports
# 启用internal区域22端口的TCP协议组合
 [root@localhost ~]# firewall-cmd --zone=internal --add-port=22/tcp --timeout=5m
  success

  ## //--timeout=5m：表示五分钟后删除该端口，多用于测试
 
# 查询internal区域中是否启用了22端口和TCP协议组合
[root@localhost ~]# firewall-cmd --zone=internal --query-port=22/tcp
no

# 配置端口
[root@localhost ~]# firewall-cmd --permanent --zone=internal --list-ports
[root@localhost ~]# firewall-cmd --permanent --zone=internal --add-port=22/tcp
success
[root@localhost ~]# firewall-cmd --permanent --zone=internal --list-ports
22/tcp

# 配置ICMP阻塞

work区域ICMP阻塞
[root@localhost ~]# firewall-cmd --permanent --zone=work --list-icmp-blocks
[root@localhost ~]# firewall-cmd --permanent --zone=work --add-icmp-block=echo-request
success
[root@localhost ~]# firewall-cmd --permanent --zone=work --list-icmp-blocks
echo-request
internal区域ICMP阻塞
[root@localhost ~]# firewall-cmd --permanent --zone=internal --list-icmp-blocks
[root@localhost ~]#  firewall-cmd --permanent --zone=internal --add-icmp-block=echo-request
success
[root@localhost ~]# firewall-cmd --permanent --zone=internal --list-icmp-blocks
echo-request
# public区域ICMP阻塞
[root@localhost ~]# firewall-cmd --permanent --zone=public --list-icmp-blocks
[root@localhost ~]# firewall-cmd --permanent --zone=public --add-icmp-block=echo-request
success
[root@localhost ~]# firewall-cmd --permanent --zone=public --list-icmp-blocks
echo-request
[root@localhost ~]# firewall-cmd --reload
success