CentOS7的firewall和安装iptables

骑猪看日落 2022-05-18 08:19 254阅读 0赞

CentOS7 的防火墙默认使用是firewall，而我们通常使用iptables；

本文记录了firewall基础的命令和iptables的安装和使用。

***firewall部分：***

**part1 : 服务命令**

systemctl start firewalld\#启动

systemctl status firewalld \#查看运行状态

systemctl stop firewalld.service \#停止firewall

systemctl disable firewalld.service \#禁用：禁止firewall开机启动

firewall-cmd --state \#查看默认防火墙状态（关闭后显示notrunning，开启后显示running）

firewall-cmd--reload 重启

part2 : 端口命令：

添加

firewall-cmd --zone=public --add-port=80/tcp --permanent   （--permanent永久生效，没有此参数重启后失效）

重新载入

firewall-cmd --reload

查看

firewall-cmd --zone= public --query-port=80/tcp

删除

firewall-cmd --zone= public --remove-port=80/tcp --permanent

**part3:示例**

示例：firewall端口操作完之后需要重启服务生效

1.  `[root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --query-port=3307/tcp`
2.  `no`
3.  `[root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --add-port=3307/tcp --permanent`
4.  `success`
5.  `[root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --query-port=3307/tcp`
6.  `no`
7.  `[root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --reload`
8.  `success`
9.  `[root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --query-port=3307/tcp`
10. `yes`

示例：mysql开放远程端口

1.  `[root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --add-port=3306/tcp --permanent`
2.  `success`
3.  `[root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --reload`
4.  `success`
5.  `[root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --state`
6.  `running`
7.  `[root@iZ2zeczh9tfpmxmijw5qppZ ~]#`
8.  `[root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --query-port=3306/tcp`
9.  `yes`
10. `[root@iZ2zeczh9tfpmxmijw5qppZ ~]#`

***iptables部分***

**part1 : 服务命令**

systemctl start iptables \#启动

systemctl status iptables \#查看运行状态

systemctl restart iptables.service \#停止iptables

systemctl stop iptables.service \#停止iptables

systemctl disable iptables.service \#禁用：禁止iptables开机启动

systemctl enable iptables.service \#启用：设置iptables开机启动

**part2 : 安装**

**step1 ： 查看是否安装**

1.  `[root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl status iptables`
2.  `Unit iptables.service could not be found.`
3.  `[root@iZ2zeczh9tfpmxmijw5qppZ ~]#`

没有相关服务

**step2 : yum install**

1.  `[root@iZ2zeczh9tfpmxmijw5qppZ ~]# yum install iptables-services`
2.  `Loaded plugins: fastestmirror`
3.  `base | 3.6 kB 00:00:00`
4.  `epel | 4.3 kB 00:00:00`
5.  `extras | 3.4 kB 00:00:00`
6.  `mysql-connectors-community | 2.5 kB 00:00:00`
7.  `mysql-tools-community | 2.5 kB 00:00:00`
8.  `mysql56-community | 2.5 kB 00:00:00`
9.  `updates | 3.4 kB 00:00:00`
10. `updates/7/x86_64/primary_db | 6.4 MB 00:00:06`
11. `Loading mirror speeds from cached hostfile`
12. `* base: mirrors.aliyuncs.com`
13. `* epel: mirrors.aliyuncs.com`
14. `* extras: mirrors.aliyuncs.com`
15. `* updates: mirrors.aliyuncs.com`
16. `Resolving Dependencies`
17. `--> Running transaction check`
18. `---> Package iptables-services.x86_64 0:1.4.21-17.el7 will be installed`
19. `--> Finished Dependency Resolution`
20.  
21. `Dependencies Resolved`
22.  
23. `========================================================================================================================================`
24. `Package Arch Version Repository Size`
25. `========================================================================================================================================`
26. `Installing:`
27. `iptables-services x86_64 1.4.21-17.el7 base 50 k`
28.  
29. `Transaction Summary`
30. `========================================================================================================================================`
31. `Install 1 Package`
32.  
33. `Total download size: 50 k`
34. `Installed size: 24 k`
35. `Is this ok [y/d/N]: Y`
36. `Downloading packages:`
37. `iptables-services-1.4.21-17.el7.x86_64.rpm | 50 kB 00:00:00`
38. `Running transaction check`
39. `Running transaction test`
40. `Transaction test succeeded`
41. `Running transaction`
42. `Installing : iptables-services-1.4.21-17.el7.x86_64 1/1`
43. `warning: /etc/sysconfig/iptables created as /etc/sysconfig/iptables.rpmnew`
44. `Verifying : iptables-services-1.4.21-17.el7.x86_64 1/1`
45.  
46. `Installed:`
47. `iptables-services.x86_64 0:1.4.21-17.el7`
48.  
49. `Complete!`
50. `[root@iZ2zeczh9tfpmxmijw5qppZ ~]#`

安装成功！

**step3 : check**

**step4 : start**

1.  `[root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl start iptables`
2.  `[root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl enable iptables.service`
3.  `Created symlink from /etc/systemd/system/basic.target.wants/iptables.service to /usr/lib/systemd/system/iptables.service.`
4.  `[root@iZ2zeczh9tfpmxmijw5qppZ ~]#`

1.  `[root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl status iptables`
2.  `iptables.service - IPv4 firewall with iptables`
3.  `Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled; vendor preset: disabled)`
4.  `Active: active (exited) since Wed 2017-06-21 15:44:41 CST; 1min 17s ago`
5.  `Main PID: 506 (code=exited, status=0/SUCCESS)`
6.   
7.  `Jun 21 15:44:41 iZ2zeczh9tfpmxmijw5qppZ systemd[1]: Starting IPv4 firewall with iptables...`
8.  `Jun 21 15:44:41 iZ2zeczh9tfpmxmijw5qppZ iptables.init[506]: iptables: Applying firewall rules: [ OK ]`
9.  `Jun 21 15:44:41 iZ2zeczh9tfpmxmijw5qppZ systemd[1]: Started IPv4 firewall with iptables.`
10. `[root@iZ2zeczh9tfpmxmijw5qppZ ~]#`

**step5 : 修改配置文件**

vi /etc/sysconfig/iptables

systemctl restart iptables.service \#重启防火墙使配置生效

**step6 ： 关闭****SELINUX**

vi/etc/selinux/config

\#SELINUX=enforcing \#注释掉

\#SELINUXTYPE=targeted \#注释掉

SELINUX=disabled \#增加

:wq! \#保存退出

setenforce 0 \#使配置立即生效

**备注：**

**SELINUX不关闭时，iptables不读取配置文件，一般采取关闭SELINUX的方式避免这种冲突**