iptables规则备份和恢复、firewalld的9个zone、firewalld关于zone和service操作


声明:本文转载自https://my.oschina.net/u/3706916/blog/1584236,转载目的在于传递更多信息,仅供学习交流之用。如有侵权行为,请联系我,我会及时删除。

插播一条广告→2021 ByteDance字节跳动内推←各城市、各方向的岗位都有,大量招人!


保存和备份iptables规则

service iptables save //会把规则保存到/etc/sysconfig/iptables
把iptables规则备份到my.ipt文件中:
iptables-save > my.ipt 恢复刚才备份的规则:
iptables-restore < my.ipt


1.保存规则

[root@linux-128 ~]# service iptables save iptables: Saving firewall rules to /etc/sysconfig/iptables:[  确定  ] 

它会保存到配置文件/etc/sysconfig/iptables中

[root@linux-128 ~]# cat /etc/sysconfig/iptables # Generated by iptables-save v1.4.21 on Mon Dec  4 02:46:23 2017 *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [162:11232] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -j REJECT --reject-with icmp-host-prohibited COMMIT # Completed on Mon Dec  4 02:46:23 2017 

2.备份规则

[root@linux-128 ~]# iptables-save >/tmp/myiptables.rule 

查看规则

[root@linux-128 ~]# cat /tmp/myiptables.rule # Generated by iptables-save v1.4.21 on Mon Dec  4 02:49:42 2017 *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [261:20920] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -j REJECT --reject-with icmp-host-prohibited COMMIT # Completed on Mon Dec  4 02:49:42 2017 

3.恢复规则

[root@linux-128 ~]# iptables-restore </tmp/myiptables.rule 

恢复规则一般使用备份规则中,注意:服务器或者重启iptables,它会自动加载配置文件中的规则


firewalld的9个zone

• 打开firewalld
• systemctl disable iptables
• systemctl stop iptables
• systemctl enable firewalld
• systemctl start firewalld
• firewalld默认有9个zone
• 默认zone为public
• firewall-cmd --get-zones //查看所有zone
• firewall-cmd --get-default-zone//查看默认zone


  1. 关闭开机自动启动netfilter
[root@linux-128 ~]# systemctl disable iptables Removed symlink /etc/systemd/system/basic.target.wants/iptables.service. 
  1. 关闭netfilter
[root@linux-128 ~]# systemctl stop iptables 
  1. 设置开机启动firewalld
[root@linux-128 ~]# systemctl enable firewalld Created symlink from /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service to /usr/lib/systemd/system/firewalld.service. Created symlink from /etc/systemd/system/basic.target.wants/firewalld.service to /usr/lib/systemd/system/firewalld.service. 
  1. 启动firewalld
[root@linux-128 ~]# systemctl start firewalld 
  1. 查看firewalld的默认规则
[root@linux-128 ~]# iptables -t nat -nvL Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)  pkts bytes target     prot opt in     out     source               destination     0     0 PREROUTING_direct  all  --  *      *       0.0.0.0/0            0.0.0.0/0     0     0 PREROUTING_ZONES_SOURCE  all  --  *      *       0.0.0.0/0            0.0.0.0/0     0     0 PREROUTING_ZONES  all  --  *      *       0.0.0.0/0            0.0.0.0/0  Chain INPUT (policy ACCEPT 0 packets, 0 bytes)  pkts bytes target     prot opt in     out     source               destination  Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)  pkts bytes target     prot opt in     out     source               destination     0     0 OUTPUT_direct  all  --  *      *       0.0.0.0/0            0.0.0.0/0  Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)  pkts bytes target     prot opt in     out     source               destination     0     0 POSTROUTING_direct  all  --  *      *       0.0.0.0/0            0.0.0.0/0     0     0 POSTROUTING_ZONES_SOURCE  all  --  *      *       0.0.0.0/0            0.0.0.0/0     0     0 POSTROUTING_ZONES  all  --  *      *       0.0.0.0/0            0.0.0.0/0  Chain OUTPUT_direct (1 references)  pkts bytes target     prot opt in     out     source               destination  Chain POSTROUTING_ZONES (1 references)  pkts bytes target     prot opt in     out     source               destination     0     0 POST_public  all  --  *      ens33   0.0.0.0/0            0.0.0.0/0           [goto]     0     0 POST_public  all  --  *      +       0.0.0.0/0            0.0.0.0/0           [goto]  Chain POSTROUTING_ZONES_SOURCE (1 references)  pkts bytes target     prot opt in     out     source               destination  Chain POSTROUTING_direct (1 references)  pkts bytes target     prot opt in     out     source               destination  Chain POST_public (2 references)  pkts bytes target     prot opt in     out     source               destination     0     0 POST_public_log  all  --  *      *       0.0.0.0/0            0.0.0.0/0     0     0 POST_public_deny  all  --  *      *       0.0.0.0/0            0.0.0.0/0     0     0 POST_public_allow  all  --  *      *       0.0.0.0/0            0.0.0.0/0  Chain POST_public_allow (1 references)  pkts bytes target     prot opt in     out     source               destination  Chain POST_public_deny (1 references)  pkts bytes target     prot opt in     out     source               destination  Chain POST_public_log (1 references)  pkts bytes target     prot opt in     out     source               destination  Chain PREROUTING_ZONES (1 references)  pkts bytes target     prot opt in     out     source               destination     0     0 PRE_public  all  --  ens33  *       0.0.0.0/0            0.0.0.0/0           [goto]     0     0 PRE_public  all  --  +      *       0.0.0.0/0            0.0.0.0/0           [goto]  Chain PREROUTING_ZONES_SOURCE (1 references)  pkts bytes target     prot opt in     out     source               destination  Chain PREROUTING_direct (1 references)  pkts bytes target     prot opt in     out     source               destination  Chain PRE_public (2 references)  pkts bytes target     prot opt in     out     source               destination     0     0 PRE_public_log  all  --  *      *       0.0.0.0/0            0.0.0.0/0     0     0 PRE_public_deny  all  --  *      *       0.0.0.0/0            0.0.0.0/0     0     0 PRE_public_allow  all  --  *      *       0.0.0.0/0            0.0.0.0/0  Chain PRE_public_allow (1 references)  pkts bytes target     prot opt in     out     source               destination  Chain PRE_public_deny (1 references)  pkts bytes target     prot opt in     out     source               destination  Chain PRE_public_log (1 references)  pkts bytes target     prot opt in     out     source               destination 
  1. firewalld有9个zone;zone是firewalld的一个单位,centos7默认是public.

  2. 查看所有的zone

[root@linux-128 ~]# firewall-cmd --get-zones work drop internal external trusted home dmz public block  //刚好9个zone 
  1. 查看系统默认的zone
[root@linux-128 ~]# firewall-cmd --get-default-zone public 
  1. 9个zone的介绍 输入图片说明

firewalld关于zone的操作

• firewall-cmd --set-default-zone=work //设定默认zone
• firewall-cmd --get-zone-of-interface=ens33 //查指定网卡
• firewall-cmd --zone=public --add-interface=lo //给指定网卡设置zone
• firewall-cmd --zone=dmz --change-interface=lo //针对网卡更改zone
• firewall-cmd --zone=dmz --remove-interface=lo //针对网卡删除zone
• firewall-cmd --get-active-zones //查看系统所有网卡所在的zone


  1. 修改默认的zone值
[root@linux-128 ~]# firewall-cmd --get-default-zone   //查看系统默认的zone public [root@linux-128 ~]# firewall-cmd --set-default-zone=work //修改默认的zone值 success [root@linux-128 ~]# firewall-cmd --get-default-zone  //查看系统默认的zone work 
  1. 查看指定网卡所在zone
[root@linux-128 ~]# firewall-cmd --get-zone-of-interface=ens33 work 
  1. 给指定的网卡设置zone
[root@linux-128 ~]# firewall-cmd --zone=home --add-interface=lo     //指定网卡lo为zone success [root@linux-128 ~]# firewall-cmd --get-zone-of-interface=lo   //查看网卡lo的zone home 
  1. 针对网卡更改zone
[root@linux-128 ~]# firewall-cmd --zone=dmz --change-interface=lo  //将网卡lo的zone修改成dmz success [root@linux-128 ~]# firewall-cmd --get-zone-of-interface=lo  //查看网卡lo的zone dmz 
  1. 针对网卡删除zone
[root@linux-128 ~]# firewall-cmd --zone=dmz  --remove-interface=lo success [root@linux-128 ~]# firewall-cmd --get-zone-of-interface=lo no zone 
  1. 查看系统所有网卡所在的zone
[root@linux-128 ~]# firewall-cmd --get-active-zones work   interfaces: ens33 

firewalld关于service的操作

• firewall-cmd --get-services 查看所有的servies
• firewall-cmd --list-services //查看当前zone下有哪些service
• firewall-cmd --zone=public --add-service=http //把http增加到public zone下面
• firewall-cmd --zone=public --remove-service=http
• ls /usr/lib/firewalld/zones/ //zone的配置文件模板
• firewall-cmd --zone=public --add-service=http --permanent //更改配置文件,之后会在/etc/firewalld/zones目录下面生成配置文件
• 需求:ftp服务自定义端口1121,需要在work zone下面放行ftp
• cp /usr/lib/firewalld/services/ftp.xml /etc/firewalld/services
• vi /etc/firewalld/services/ftp.xml //把21改为1121
• cp /usr/lib/firewalld/zones/work.xml /etc/firewalld/zones/
• vi /etc/firewalld/zones/work.xml //增加一行
• <service name="ftp"/>
• firewall-cmd --reload //重新加载
• firewall-cmd --zone=work --list-services


  1. 查看所有的servies
[root@linux-128 ~]# firewall-cmd --get-services RH-Satellite-6 amanda-client amanda-k5-client bacula bacula-client ceph ceph-mon dhcp dhcpv6 dhcpv6-client dns docker-registry dropbox-lansync freeipa-ldap freeipa-ldaps freeipa-replication ftp high-availability http https imap imaps ipp ipp-client ipsec iscsi-target kadmin kerberos kpasswd ldap ldaps libvirt libvirt-tls mdns mosh mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3 pop3s postgresql privoxy proxy-dhcp ptp pulseaudio puppetmaster radius rpc-bind rsyncd samba samba-client sane smtp smtps snmp snmptrap squid ssh synergy syslog syslog-tls telnet tftp tftp-client tinc tor-socks transmission-client vdsm vnc-server wbem-https xmpp-bosh xmpp-client xmpp-local xmpp-server 
  1. 查看当前zone下有哪些service
[root@linux-128 ~]# firewall-cmd --get-default-zone   //查看当前系统默认的zone work [root@linux-128 ~]# firewall-cmd --list-services   //查看当前系统默认的zone下有那些service ssh dhcpv6-client 
  1. 查看指定zone下有那些service
[root@linux-128 ~]# firewall-cmd --zone=public --list-services dhcpv6-client ssh http 
  1. 添加一个service到指定的zone下 [root@linux-128 ~]# firewall-cmd --zone=public --add-service=ftp //将服务ftp添加到public下 success [root@linux-128 ~]# firewall-cmd --zone=public --list-services //查看public下的service dhcpv6-client ssh http ftp

  2. 删除指定zone下的service

[root@linux-128 ~]# firewall-cmd --zone=public --remove-service=http //删除public下的服务http success [root@linux-128 ~]# firewall-cmd --zone=public --list-services   dhcpv6-client ssh ftp 
  1. zone的配置文件模板 [root@linux-128 ~]# ls /usr/lib/firewalld/zones block.xml dmz.xml drop.xml external.xml home.xml internal.xml public.xml trusted.xml

  2. 更改zone的配置文件

[root@linux-128 ~]# firewall-cmd --zone=public --add-service=http --permanent success  [root@linux-128 ~]# cat /etc/firewalld/zones/public.xml <?xml version="1.0" encoding="utf-8"?> <zone>   <short>Public</short>   <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>   <service name="dhcpv6-client"/>   <service name="http"/>    //已经添加   <service name="ssh"/> </zone> 

在添加一个service ftp

[root@linux-128 ~]# firewall-cmd --zone=public --add-service=ftp --permanent success [root@linux-128 ~]# cat /etc/firewalld/zones/public.xml <?xml version="1.0" encoding="utf-8"?> <zone>   <short>Public</short>   <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>   <service name="ftp"/>   //已经添加   <service name="dhcpv6-client"/>   <service name="http"/>   <service name="ssh"/> </zone> 

案例:需求:ftp服务自定义端口1121,需要在work zone下面放行ftp
拷贝配置文件ftp.xml

[root@linux-128 ~]# cp /usr/lib/firewalld/services/ftp.xml /etc/firewalld/services [root@linux-128 ~]# vi /etc/firewalld/services/ftp.xml 

配置文件如下:

<?xml version="1.0" encoding="utf-8"?> <service>   <short>FTP</short>   <description>FTP is a protocol used for remote file transfer. If you plan to make your FTP server publicly available, enable this option. You need the vsftpd package installed for this option to be useful.</description>   <port protocol="tcp" port="1121"/>   <module name="nf_conntrack_ftp"/> </service> 

拷贝配置文件work.xml

[root@linux-128 ~]# cp /usr/lib/firewalld/zones/work.xml /etc/firewalld/zones/ [root@linux-128 ~]# vi /etc/firewalld/zones/work.xml 

配置文件如下:

<?xml version="1.0" encoding="utf-8"?> <zone>   <short>Work</short>   <description>For use in work areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>   <service name="ssh"/>   <service name="dhcpv6-client"/>   <service name="ftp"/> </zone> 

重新加载 firewall-cmd --reload

[root@linux-128 ~]# firewall-cmd --reload success 

查看work下面的service

[root@linux-128 ~]# firewall-cmd --zone=work --list-services ssh dhcpv6-client ftp  

本文发表于2017年12月04日 08:38
(c)注:本文转载自https://my.oschina.net/u/3706916/blog/1584236,转载目的在于传递更多信息,并不代表本网赞同其观点和对其真实性负责。如有侵权行为,请联系我们,我们会及时删除.

阅读 752 讨论 0 喜欢 0

抢先体验

扫码体验
趣味小程序
文字表情生成器

闪念胶囊

直抵黄龙府,与诸君痛饮尔。

那时陪伴我的人啊,你们如今在何方。

不出意外的话,我们再也不会见了,祝你前程似锦。

这世界真好,吃野东西也要留出这条命来看看

行业标准总是平庸的

快捷链接
网站地图
提交友链
Copyright © 2016 - 2021 Cion.
All Rights Reserved.
京ICP备2021004668号-1