study/uTools-Manuals
1
0
Fork 0
mirror of https://github.com/fofolee/uTools-Manuals.git synced 2025-10-11 00:43:20 +08:00
Code Issues Packages Projects Releases Wiki Activity

语法高亮，滚动条美化，设置页面调整

Browse Source
This commit is contained in:
fofolee
2019-04-19 02:41:09 +08:00
parent 1e8f76c000
commit 359d29ee0b
1590 changed files with 12328 additions and 11441 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
docs/linux/firewall-cmd.html
View File

@@ -9,9 +9,9 @@
</ol>
<p>firewalld自身并不具备防火墙的功能，而是和iptables一样需要通过内核的netfilter来实现，也就是说firewalld和 iptables一样，他们的作用都是用于维护规则，而真正使用规则干活的是内核的netfilter，只不过firewalld和iptables的结 构以及使用方法不一样罢了。</p>
<h3 id="语法">语法</h3>
<pre><code>finger(选项)(参数)</code></pre>
<pre><code class="language-bash">finger(选项)(参数)</code></pre>
<h3 id="实例">实例</h3>
<div class="sourceCode" id="cb2"><pre class="sourceCode bash"><code class="sourceCode bash"><a class="sourceLine" id="cb2-1" data-line-number="1"><span class="co"># 安装firewalld</span></a>
<div class="sourceCode" id="cb2"><pre><code class="language-bash"><a class="sourceLine" id="cb2-1" data-line-number="1"><span class="co"># 安装firewalld</span></a>
<a class="sourceLine" id="cb2-2" data-line-number="2"><span class="ex">yum</span> install firewalld firewall-config</a>
<a class="sourceLine" id="cb2-3" data-line-number="3"></a>
<a class="sourceLine" id="cb2-4" data-line-number="4"></a>
@@ -29,7 +29,7 @@
<a class="sourceLine" id="cb2-16" data-line-number="16"><span class="ex">systemctl</span> start iptables</a>
<a class="sourceLine" id="cb2-17" data-line-number="17"><span class="ex">systemctl</span> enable iptables</a></code></pre></div>
<p>配置firewalld</p>
<div class="sourceCode" id="cb3"><pre class="sourceCode bash"><code class="sourceCode bash"><a class="sourceLine" id="cb3-1" data-line-number="1"><span class="ex">firewall-cmd</span> --version # 查看版本</a>
<div class="sourceCode" id="cb3"><pre><code class="language-bash"><a class="sourceLine" id="cb3-1" data-line-number="1"><span class="ex">firewall-cmd</span> --version # 查看版本</a>
<a class="sourceLine" id="cb3-2" data-line-number="2"><span class="ex">firewall-cmd</span> --help # 查看帮助</a>
<a class="sourceLine" id="cb3-3" data-line-number="3"></a>
<a class="sourceLine" id="cb3-4" data-line-number="4"><span class="co"># 查看设置：</span></a>
@@ -86,7 +86,7 @@
<a class="sourceLine" id="cb3-55" data-line-number="55"><span class="co"># 永久修改网络接口enp03s为内部区域（internal）</span></a>
<a class="sourceLine" id="cb3-56" data-line-number="56"><span class="ex">firewall-cmd</span> --permanent --zone=internal --change-interface=enp03s</a></code></pre></div>
<p>服务管理</p>
<div class="sourceCode" id="cb4"><pre class="sourceCode bash"><code class="sourceCode bash"><a class="sourceLine" id="cb4-1" data-line-number="1"><span class="co"># 显示服务列表 </span></a>
<div class="sourceCode" id="cb4"><pre><code class="language-bash"><a class="sourceLine" id="cb4-1" data-line-number="1"><span class="co"># 显示服务列表 </span></a>
<a class="sourceLine" id="cb4-2" data-line-number="2"><span class="ex">Amanda</span>, FTP, Samba和TFTP等最重要的服务已经被FirewallD提供相应的服务，可以使用如下命令查看：</a>
<a class="sourceLine" id="cb4-3" data-line-number="3"></a>
<a class="sourceLine" id="cb4-4" data-line-number="4"><span class="ex">firewall-cmd</span> --get-services</a>
@@ -110,7 +110,7 @@
<a class="sourceLine" id="cb4-22" data-line-number="22"><span class="ex">firewall-cmd</span> --permanent --zone=internal --add-service=http</a>
<a class="sourceLine" id="cb4-23" data-line-number="23"><span class="ex">firewall-cmd</span> --reload # 在不改变状态的条件下重新加载防火墙</a></code></pre></div>
<p>端口管理</p>
<div class="sourceCode" id="cb5"><pre class="sourceCode bash"><code class="sourceCode bash"><a class="sourceLine" id="cb5-1" data-line-number="1"><span class="co"># 打开443/TCP端口</span></a>
<div class="sourceCode" id="cb5"><pre><code class="language-bash"><a class="sourceLine" id="cb5-1" data-line-number="1"><span class="co"># 打开443/TCP端口</span></a>
<a class="sourceLine" id="cb5-2" data-line-number="2"><span class="ex">firewall-cmd</span> --add-port=443/tcp</a>
<a class="sourceLine" id="cb5-3" data-line-number="3"></a>
<a class="sourceLine" id="cb5-4" data-line-number="4"><span class="co"># 永久打开3690/TCP端口</span></a>
@@ -123,13 +123,13 @@
<a class="sourceLine" id="cb5-11" data-line-number="11"><span class="co"># 查看防火墙，添加的端口也可以看到</span></a>
<a class="sourceLine" id="cb5-12" data-line-number="12"><span class="ex">firewall-cmd</span> --list-all</a></code></pre></div>
<p>直接模式</p>
<div class="sourceCode" id="cb6"><pre class="sourceCode bash"><code class="sourceCode bash"><a class="sourceLine" id="cb6-1" data-line-number="1"><span class="co"># FirewallD包括一种直接模式，使用它可以完成一些工作，例如打开TCP协议的9999端口</span></a>
<div class="sourceCode" id="cb6"><pre><code class="language-bash"><a class="sourceLine" id="cb6-1" data-line-number="1"><span class="co"># FirewallD包括一种直接模式，使用它可以完成一些工作，例如打开TCP协议的9999端口</span></a>
<a class="sourceLine" id="cb6-2" data-line-number="2"></a>
<a class="sourceLine" id="cb6-3" data-line-number="3"><span class="ex">firewall-cmd</span> --direct -add-rule ipv4 filter INPUT 0 -p tcp --dport 9000 -j ACCEPT</a>
<a class="sourceLine" id="cb6-4" data-line-number="4"><span class="ex">firewall-cmd</span> --reload</a></code></pre></div>
<p><strong>控制端口 / 服务</strong></p>
<p>可以通过两种方式控制端口的开放，一种是指定端口号另一种是指定服务名。虽然开放 http 服务就是开放了 80 端口，但是还是不能通过端口号来关闭，也就是说通过指定服务名开放的就要通过指定服务名关闭；通过指定端口号开放的就要通过指定端口号关闭。还有一个要注意的就是指定端口的时候一定要指定是什么协议，tcp 还是 udp。知道这个之后以后就不用每次先关防火墙了，可以让防火墙真正的生效。</p>
<div class="sourceCode" id="cb7"><pre class="sourceCode bash"><code class="sourceCode bash"><a class="sourceLine" id="cb7-1" data-line-number="1"><span class="ex">firewall-cmd</span> --add-service=mysql # 开放mysql端口</a>
<div class="sourceCode" id="cb7"><pre><code class="language-bash"><a class="sourceLine" id="cb7-1" data-line-number="1"><span class="ex">firewall-cmd</span> --add-service=mysql # 开放mysql端口</a>
<a class="sourceLine" id="cb7-2" data-line-number="2"><span class="ex">firewall-cmd</span> --remove-service=http # 阻止http端口</a>
<a class="sourceLine" id="cb7-3" data-line-number="3"><span class="ex">firewall-cmd</span> --list-services # 查看开放的服务</a>
<a class="sourceLine" id="cb7-4" data-line-number="4"><span class="ex">firewall-cmd</span> --add-port=3306/tcp # 开放通过tcp访问3306</a>
@@ -137,12 +137,12 @@
<a class="sourceLine" id="cb7-6" data-line-number="6"><span class="ex">firewall-cmd</span> --add-port=233/udp # 开放通过udp访问233</a>
<a class="sourceLine" id="cb7-7" data-line-number="7"><span class="ex">firewall-cmd</span> --list-ports # 查看开放的端口</a></code></pre></div>
<p>伪装 IP</p>
<div class="sourceCode" id="cb8"><pre class="sourceCode bash"><code class="sourceCode bash"><a class="sourceLine" id="cb8-1" data-line-number="1"><span class="ex">firewall-cmd</span> --query-masquerade <span class="co"># 检查是否允许伪装IP</span></a>
<div class="sourceCode" id="cb8"><pre><code class="language-bash"><a class="sourceLine" id="cb8-1" data-line-number="1"><span class="ex">firewall-cmd</span> --query-masquerade <span class="co"># 检查是否允许伪装IP</span></a>
<a class="sourceLine" id="cb8-2" data-line-number="2"><span class="ex">firewall-cmd</span> --add-masquerade # 允许防火墙伪装IP</a>
<a class="sourceLine" id="cb8-3" data-line-number="3"><span class="ex">firewall-cmd</span> --remove-masquerade# 禁止防火墙伪装IP</a></code></pre></div>
<p><strong>端口转发</strong></p>
<p>端口转发可以将指定地址访问指定的端口时，将流量转发至指定地址的指定端口。转发的目的如果不指定 ip 的话就默认为本机，如果指定了 ip 却没指定端口，则默认使用来源端口。 如果配置好端口转发之后不能用，可以检查下面两个问题： 1. 比如我将 80 端口转发至 8080 端口，首先检查本地的 80 端口和目标的 8080 端口是否开放监听了 2. 其次检查是否允许伪装 IP，没允许的话要开启伪装 IP</p>
<div class="sourceCode" id="cb9"><pre class="sourceCode bash"><code class="sourceCode bash"><a class="sourceLine" id="cb9-1" data-line-number="1"><span class="ex">firewall-cmd</span> --add-forward-port=port=80:proto=tcp:toport=8080 # 将80端口的流量转发至8080</a>
<div class="sourceCode" id="cb9"><pre><code class="language-bash"><a class="sourceLine" id="cb9-1" data-line-number="1"><span class="ex">firewall-cmd</span> --add-forward-port=port=80:proto=tcp:toport=8080 # 将80端口的流量转发至8080</a>
<a class="sourceLine" id="cb9-2" data-line-number="2"><span class="ex">firewall-cmd</span> --add-forward-port=port=80:proto=tcp:toaddr=192.168.0.1 <span class="co"># 将80端口的流量转发至192.168.0.1</span></a>
<a class="sourceLine" id="cb9-3" data-line-number="3"><span class="ex">firewall-cmd</span> --add-forward-port=port=80:proto=tcp:toaddr=192.168.0.1:toport=8080 <span class="co"># 将80端口的流量转发至192.168.0.1的8080端口</span></a></code></pre></div>
<ol type="1">