官方文檔:REDHAT-USING FIREWALLS

安裝

# 安裝防火墻
yum install firewalld
# 查看版本
firewall-cmd --version
# 查看幫助
firewall-cmd --help

啟動，自啟動

# 開啟，關(guān)閉，重啟防火墻
systemctl start firewalld
systemctl stop firewalld
systemctl restart firewalld
# 設(shè)置/禁止開機(jī)啟動
systemctl enable firewalld
systemctl disable firewalld

查看狀態(tài)與端口設(shè)置

# 查看防火墻狀態(tài)，以下兩條指令均可
systemctl status firewalld
firewall-cmd --state

# 臨時開放端口/關(guān)閉端口，無需reload立即生效
firewall-cmd --zone=public --add-port=1225/tcp
firewall-cmd --zone=public --remove-port=1225/tcp
# 永久開放/關(guān)閉端口，需更新防火墻規(guī)則方可生效，
firewall-cmd  --permanent --zone=public --add-port=1225/tcp
firewall-cmd  --permanent --zone=public --remove-port=1225/tcp
# 更新防火墻規(guī)則
firewall-cmd --reload

# 查看開放端口列表
firewall-cmd --list-ports
# 查看
firewall-cmd --list-all
public
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: dhcpv6-client ss ssh
  ports: 2012/tcp 1225/tcp 80/tcp 8080/tcp
  protocols:
  masquerade: no
  forward-ports:
  sourceports:
  icmp-blocks:
  rich rules:

# 列出系統(tǒng)上可用的所有服務(wù)
firewall-cmd --get-services
# 輸出大概如下
RH-Satellite-6 amanda-client amanda-k5-client bacula bacula-client ceph ceph-mon dhcp dhcpv6 dhcpv6-client dns docker-registry dropbox-lansync freeipa-ldap freeipa-ldaps freeipa-replication ftp high-availability http https imap imaps ipp ipp-client ipsec iscsi-target kadmin kerberos kpasswd ldap ldaps libvirt libvirt-tls mdns mosh mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3 pop3s postgresql privoxy proxy-dhcp ptp pulseaudio puppetmaster radius rpc-bind rsyncd samba samba-client sane smtp smtps snmp snmptrap squid ss ssh synergy syslog syslog-tls telnet tftp tftp-client tinc tor-socks transmission-client vdsm vnc-server wbem-https xmpp-bosh xmpp-client xmpp-local xmpp-server

# 開啟服務(wù)/關(guān)閉服務(wù)
firewall-cmd --add-service ftp
firewall-cmd --remove-service ftp
firewall-cmd --add-service ssh
firewall-cmd --remove-service ssh
# 查詢服務(wù)的啟用狀態(tài)
firewall-cmd --query-service ftp
firewall-cmd --query-service ssh

# 列出系統(tǒng)服務(wù)或者用戶創(chuàng)建的服務(wù)
ls /etc/firewalld/services/
# 增加新服務(wù)，在上述目錄下生成新的文件
firewall-cmd --permanent --new-service=service-name
# 服務(wù)xml基本格式如下
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>SS</short>
  <description>Shadowsocks port
  </description>
  <port protocol="tcp" port="1225"/>
</service>