CentOS 7 ：Failed to start IPv4 firewall with iptables.

左手的ㄟ右手 2022-06-04 08:09 205阅读 0赞

用iptables开启防火墙报错: Failed to start  IPv4 firewall with iptables.

![Center][]

错误原因：因为centos7.0默认不是使用iptables方式管理，而是firewalld方式。CentOS6.0防火墙用iptables管理。

解决办法有两个：使用firewalld方式。或者关闭firewalld,然后安装iptables。

一、关闭firewalld，安装iptables过程：

> 停止并屏蔽firewalld：
> 
>     systemctl stop firewalld
>     systemctl mask firewalld
> 
> 安装iptables-services：
> 
>     yum install iptables-services
> 
> 设置开机启动：
> 
>     systemctl enable iptables
> 
> 停止/启动/重启 防火墙：
> 
>     systemctl [stop|start|restart] iptables
>     #or
>     service iptables [stop|start|restart]
> 
> 保存防火墙配置：
> 
>   
> 
> 
>     service iptables save
>     #or
>     /usr/libexec/iptables/iptables.init save
> 
>   
>

按照上述命令配置后的界面：

![Center 1][]

二、从iptables切换回firewalld

1、先看firewalld的状态：inactive

![Center 2][]

2、安装firewalld

![Center 3][]

3、切换到firewalld，切换过程与切换iptables一样

![Center 4][]

/\*\*\*\*\*\*\*\*\*\*\*\*下面是iptables的一些命令\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*/

查询防火墙状态:

\[root@localhost ~\]\# service  iptables status

停止防火墙:

\[root@localhost ~\]\# service  iptables stop

启动防火墙:

\[root@localhost ~\]\# service  iptables start

重启防火墙:

\[root@localhost ~\]\# service  iptables restart

永久关闭防火墙:

\[root@localhost ~\]\# chkconfig  iptables off

永久关闭后启用:

\[root@localhost ~\]\# chkconfig  iptables on

开启端口：

\[root@localhost ~\]\# vim/etc/sysconfig/iptables

/\*\*\*\*\*\*\*\*\*\*下面是firewalld的一些命令\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*/

\#systemctl statusfirewalld  //查看状态，看电脑上是否已经安装firewalld

\#yum installfirewalld  //安装firewalld防火墙

\#systemctl startfirewalld.service   //开启防火墙

\#systemctl stop firewalld.service  //关闭防火墙

\#systemctl enable firewalld.service //设置开机自动启动

\#systemctl disable firewalld.service  //设置关闭开机制动启动

\#firewall-cmd--reload  //在不改变状态的条件下重新加载防火墙

启用某个服务

\#firewall-cmd --zone=public --add-service=https  //临时

\#firewall-cmd --permanent --zone=public --add-service=https  //永久

开启某个端口

\#firewall-cmd--permanent --zone=public --add-port=8080-8081/tcp  //永久

\#firewall-cmd  --zone=public --add-port=8080-8081/tcp   //临时

查看开启的端口和服务

\#firewall-cmd--permanent --zone=public --list-services   //服务空格隔开 例如 dhcpv6-client https ss

\#firewall-cmd--permanent --zone=public --list-ports //端口空格隔开  例如 8080-8081/tcp 8388/tcp 80/tcp

\#systemctl restartfirewalld.service  //修改配置后需要重启服务使其生效

\#firewall-cmd--zone=public --query-port=8080/tcp //查看服务是否生效（例：添加的端口为8080）

/\*\*\*\*\*\*\*\*\*\*下面是systemctl的一些命令\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*/

观察iptables和firewalld使用的两组命令，发现三个常用的命令：service、chkconfig、systemctl。那么它们分别是做什么的呢？（去网上搜索了一下给出了答案）

systemctl命令是系统服务管理器指令，它实际上将 service 和 chkconfig 这两个命令组合到一起。

<table style="direction:ltr; border-collapse:collapse; border-style:solid; border-color:#A3A3A3; border-width:1pt; margin-left:.3333in"> 
 <tbody> 
 <tr> 
 <td style="border-style:solid; border-color:#A3A3A3; border-width:1pt; vertical-align:top; width:1.4652in; padding:4pt 4pt 4pt 4pt"> 任务 </td> 
 <td style="border-style:solid; border-color:#A3A3A3; border-width:1pt; vertical-align:top; width:2.2895in; padding:4pt 4pt 4pt 4pt"> 旧指令 </td> 
 <td style="border-style:solid; border-color:#A3A3A3; border-width:1pt; vertical-align:top; width:3.918in; padding:4pt 4pt 4pt 4pt"> 新指令 </td> 
 </tr> 
 <tr> 
 <td style="border-style:solid; border-color:#A3A3A3; border-width:1pt; vertical-align:top; width:1.4652in; padding:4pt 4pt 4pt 4pt"> 使某服务自动启动 </td> 
 <td style="border-style:solid; border-color:#A3A3A3; border-width:1pt; vertical-align:top; width:2.2895in; padding:4pt 4pt 4pt 4pt"> chkconfig --level 3 httpd on </td> 
 <td style="border-style:solid; border-color:#A3A3A3; border-width:1pt; vertical-align:top; width:3.918in; padding:4pt 4pt 4pt 4pt"> systemctl enable httpd.service </td> 
 </tr> 
 <tr> 
 <td style="border-style:solid; border-color:#A3A3A3; border-width:1pt; vertical-align:top; width:1.4652in; padding:4pt 4pt 4pt 4pt"> 使某服务不自动启动 </td> 
 <td style="border-style:solid; border-color:#A3A3A3; border-width:1pt; vertical-align:top; width:2.2895in; padding:4pt 4pt 4pt 4pt"> chkconfig --level 3 httpd off </td> 
 <td style="border-style:solid; border-color:#A3A3A3; border-width:1pt; vertical-align:top; width:3.918in; padding:4pt 4pt 4pt 4pt"> systemctl disable httpd.service </td> 
 </tr> 
 <tr> 
 <td style="border-style:solid; border-color:#A3A3A3; border-width:1pt; vertical-align:top; width:1.4652in; padding:4pt 4pt 4pt 4pt"> 检查服务状态 </td> 
 <td style="border-style:solid; border-color:#A3A3A3; border-width:1pt; vertical-align:top; width:2.2895in; padding:4pt 4pt 4pt 4pt"> service httpd status </td> 
 <td style="border-style:solid; border-color:#A3A3A3; border-width:1pt; vertical-align:top; width:3.918in; padding:4pt 4pt 4pt 4pt"> systemctl status&nbsp;httpd.service（服务详细信息）&nbsp; systemctl is-active httpd.service（仅显示是否 Active) </td> 
 </tr> 
 <tr> 
 <td style="border-style:solid; border-color:#A3A3A3; border-width:1pt; vertical-align:top; width:1.4652in; padding:4pt 4pt 4pt 4pt"> 显示所有已启动的服务 </td> 
 <td style="border-style:solid; border-color:#A3A3A3; border-width:1pt; vertical-align:top; width:2.2895in; padding:4pt 4pt 4pt 4pt"> chkconfig --list </td> 
 <td style="border-style:solid; border-color:#A3A3A3; border-width:1pt; vertical-align:top; width:3.918in; padding:4pt 4pt 4pt 4pt"> systemctl list-units --type=service </td> 
 </tr> 
 <tr> 
 <td style="border-style:solid; border-color:#A3A3A3; border-width:1pt; vertical-align:top; width:1.4652in; padding:4pt 4pt 4pt 4pt"> 启动某服务 </td> 
 <td style="border-style:solid; border-color:#A3A3A3; border-width:1pt; vertical-align:top; width:2.2895in; padding:4pt 4pt 4pt 4pt"> service httpd start </td> 
 <td style="border-style:solid; border-color:#A3A3A3; border-width:1pt; vertical-align:top; width:3.918in; padding:4pt 4pt 4pt 4pt"> systemctl start httpd.service </td> 
 </tr> 
 <tr> 
 <td style="border-style:solid; border-color:#A3A3A3; border-width:1pt; vertical-align:top; width:1.4652in; padding:4pt 4pt 4pt 4pt"> 停止某服务 </td> 
 <td style="border-style:solid; border-color:#A3A3A3; border-width:1pt; vertical-align:top; width:2.2895in; padding:4pt 4pt 4pt 4pt"> service httpd stop </td> 
 <td style="border-style:solid; border-color:#A3A3A3; border-width:1pt; vertical-align:top; width:3.918in; padding:4pt 4pt 4pt 4pt"> systemctl stop httpd.service </td> 
 </tr> 
 <tr> 
 <td style="border-style:solid; border-color:#A3A3A3; border-width:1pt; vertical-align:top; width:1.4652in; padding:4pt 4pt 4pt 4pt"> 重启某服务 </td> 
 <td style="border-style:solid; border-color:#A3A3A3; border-width:1pt; vertical-align:top; width:2.2895in; padding:4pt 4pt 4pt 4pt"> service httpd restart </td> 
 <td style="border-style:solid; border-color:#A3A3A3; border-width:1pt; vertical-align:top; width:3.918in; padding:4pt 4pt 4pt 4pt"> systemctl restart httpd.service </td> 
 </tr> 
 </tbody> 
</table>

总结：

记是记不住的，实操才可以，熟能生巧。

抓住一个问题，深入去挖，往往能挖出一片，从而扫清一片盲点。深挖能出清泉。

参考文章：

[https://www.vkilo.com/rhel-7-iptables-service.html][https_www.vkilo.com_rhel-7-iptables-service.html]

[http://blog.csdn.net/Joe68227597/article/details/75207859][http_blog.csdn.net_Joe68227597_article_details_75207859]

[http://www.linuxidc.com/Linux/2012-06/63111.htm][https_www.vkilo.com_rhel-7-iptables-service.html]

[http://man.linuxde.net/systemctl][http_man.linuxde.net_systemctl]

[Center]: /images/20220604/ec94e095e65a4449b583cb23202c6ecb.png
[Center 1]: /images/20220604/78c92df4edb6406ba0c1ce00c0b40958.png
[Center 2]: /images/20220604/d2e38dd647ab49ae9a23720f545636f9.png
[Center 3]: /images/20220604/3dbc978999c949f9901e568b0cded669.png
[Center 4]: /images/20220604/9f54053189cd4afebd78edd47416cba3.png
[https_www.vkilo.com_rhel-7-iptables-service.html]: https://www.vkilo.com/rhel-7-iptables-service.html
[http_blog.csdn.net_Joe68227597_article_details_75207859]: http://blog.csdn.net/Joe68227597/article/details/75207859
[http_man.linuxde.net_systemctl]: http://man.linuxde.net/systemctl