CentOS7的firewall和安装iptables

骑猪看日落 2022-05-18 08:19 334阅读 0赞

CentOS7 的防火墙默认使用是firewall，而我们通常使用iptables；

本文记录了firewall基础的命令和iptables的安装和使用。

firewall部分：

part1 : 服务命令

systemctl start firewalld#启动

systemctl status firewalld #查看运行状态

systemctl stop firewalld.service #停止firewall

systemctl disable firewalld.service #禁用：禁止firewall开机启动

firewall-cmd —state #查看默认防火墙状态（关闭后显示notrunning，开启后显示running）

firewall-cmd—reload 重启

part2 : 端口命令：

添加

firewall-cmd —zone=public —add-port=80/tcp —permanent （—permanent永久生效，没有此参数重启后失效）

重新载入

firewall-cmd —reload

查看

firewall-cmd —zone= public —query-port=80/tcp

删除

firewall-cmd —zone= public —remove-port=80/tcp —permanent

part3:示例

示例：firewall端口操作完之后需要重启服务生效

  1. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --query-port=3307/tcp
  2. no
  3. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --add-port=3307/tcp --permanent
  4. success
  5. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --query-port=3307/tcp
  6. no
  7. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --reload
  8. success
  9. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --query-port=3307/tcp
  10. yes

示例：mysql开放远程端口

  1. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --add-port=3306/tcp --permanent
  2. success
  3. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --reload
  4. success
  5. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --state
  6. running
  7. [root@iZ2zeczh9tfpmxmijw5qppZ ~]#
  8. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --query-port=3306/tcp
  9. yes
  10. [root@iZ2zeczh9tfpmxmijw5qppZ ~]#

iptables部分

part1 : 服务命令

systemctl start iptables #启动

systemctl status iptables #查看运行状态

systemctl restart iptables.service #停止iptables

systemctl stop iptables.service #停止iptables

systemctl disable iptables.service #禁用：禁止iptables开机启动

systemctl enable iptables.service #启用：设置iptables开机启动

part2 : 安装

step1 ： 查看是否安装

  1. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl status iptables
  2. Unit iptables.service could not be found.
  3. [root@iZ2zeczh9tfpmxmijw5qppZ ~]#

没有相关服务

step2 : yum install

  1. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# yum install iptables-services
  2. Loaded plugins: fastestmirror
  3. base | 3.6 kB 00:00:00
  4. epel | 4.3 kB 00:00:00
  5. extras | 3.4 kB 00:00:00
  6. mysql-connectors-community | 2.5 kB 00:00:00
  7. mysql-tools-community | 2.5 kB 00:00:00
  8. mysql56-community | 2.5 kB 00:00:00
  9. updates | 3.4 kB 00:00:00
  10. updates/7/x86_64/primary_db | 6.4 MB 00:00:06
  11. Loading mirror speeds from cached hostfile
  12. * base: mirrors.aliyuncs.com
  13. * epel: mirrors.aliyuncs.com
  14. * extras: mirrors.aliyuncs.com
  15. * updates: mirrors.aliyuncs.com
  16. Resolving Dependencies
  17. --> Running transaction check
  18. ---> Package iptables-services.x86_64 0:1.4.21-17.el7 will be installed
  19. --> Finished Dependency Resolution
  21. Dependencies Resolved
  23. ========================================================================================================================================
  24. Package Arch Version Repository Size
  25. ========================================================================================================================================
  26. Installing:
  27. iptables-services x86_64 1.4.21-17.el7 base 50 k
  29. Transaction Summary
  30. ========================================================================================================================================
  31. Install 1 Package
  33. Total download size: 50 k
  34. Installed size: 24 k
  35. Is this ok [y/d/N]: Y
  36. Downloading packages:
  37. iptables-services-1.4.21-17.el7.x86_64.rpm | 50 kB 00:00:00
  38. Running transaction check
  39. Running transaction test
  40. Transaction test succeeded
  41. Running transaction
  42. Installing : iptables-services-1.4.21-17.el7.x86_64 1/1
  43. warning: /etc/sysconfig/iptables created as /etc/sysconfig/iptables.rpmnew
  44. Verifying : iptables-services-1.4.21-17.el7.x86_64 1/1
  46. Installed:
  47. iptables-services.x86_64 0:1.4.21-17.el7
  49. Complete!
  50. [root@iZ2zeczh9tfpmxmijw5qppZ ~]#

安装成功！

step3 : check

  1. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl status iptables
  2. iptables.service - IPv4 firewall with iptables
  3. Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled; vendor preset: disabled)
  4. Active: inactive (dead)
  5. [root@iZ2zeczh9tfpmxmijw5qppZ ~]#

step4 : start

  1. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl start iptables
  2. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl enable iptables.service
  3. Created symlink from /etc/systemd/system/basic.target.wants/iptables.service to /usr/lib/systemd/system/iptables.service.
  4. [root@iZ2zeczh9tfpmxmijw5qppZ ~]#
  1. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl status iptables
  2. iptables.service - IPv4 firewall with iptables
  3. Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled; vendor preset: disabled)
  4. Active: active (exited) since Wed 2017-06-21 15:44:41 CST; 1min 17s ago
  5. Main PID: 506 (code=exited, status=0/SUCCESS)
  7. Jun 21 15:44:41 iZ2zeczh9tfpmxmijw5qppZ systemd[1]: Starting IPv4 firewall with iptables...
  8. Jun 21 15:44:41 iZ2zeczh9tfpmxmijw5qppZ iptables.init[506]: iptables: Applying firewall rules: [ OK ]
  9. Jun 21 15:44:41 iZ2zeczh9tfpmxmijw5qppZ systemd[1]: Started IPv4 firewall with iptables.
  10. [root@iZ2zeczh9tfpmxmijw5qppZ ~]#

step5 : 修改配置文件

vi /etc/sysconfig/iptables

systemctl restart iptables.service #重启防火墙使配置生效

step6 ： 关闭**SELINUX**

vi/etc/selinux/config

#SELINUX=enforcing #注释掉

#SELINUXTYPE=targeted #注释掉

SELINUX=disabled #增加

:wq! #保存退出

setenforce 0 #使配置立即生效

备注：

SELINUX不关闭时，iptables不读取配置文件，一般采取关闭SELINUX的方式避免这种冲突

发表评论

表情：
评论列表 （有 0 条评论，334人围观）

还没有评论，来说两句吧...

相关阅读