firewalld和iptables的关系：
firewalld自身并不具备防火墙的功能，而是和iptables一样需要通过内核的netfilter来实现。
也就是说firewalld和iptables一样，他们的作用都是用于维护规则，而真正使用规则干活的是内核的netfilter，
只不过firewalld和iptables的结构以及使用方法不一样罢了。
firewalld简介：
firewalld是centos7的一大特性，最大的好处有两个：
支持动态更新，不用重启服务；加入了防火墙的“zone”概念；
firewalld有图形界面和工具界面
firewalld的字符界面管理工具是 firewall-cmd
firewalld默认配置文件有两个：/usr/lib/firewalld/ （系统配置，尽量不要修改）和 /etc/firewalld/ （用户配置地址）
“zone”概念：
我们知道每个zone就是一套规则集，但是有那么多zone，对于一个具体的请求来说应该使用哪个zone（哪套规则）来处理呢？
对于一个接受到的请求具体使用哪个zone，firewalld是通过三种方法来判断的：
1、source，也就是源地址 优先级最高
2、interface，接收请求的网卡 优先级第二
3、firewalld.conf中配置的默认zone 优先级最低
这三个的优先级按顺序依次降低，也就是说如果按照source可以找到就不会再按interface去查找，如果前两个都找不到才会使用第三个。
基于用户对网络中设备和通信所给与的信任程度，防火墙可用于将网络划分成不同的区域，区域类型如下：
- drop（丢弃）
任何接收的网络数据包都被丢弃，没有任何回复。仅能有发送出去的网络连接。 - block（限制）
任何接收的网络连接都被 IPv4 的 icmp-host-prohibited 信息和 IPv6 的 icmp6-adm-prohibited 信息所拒绝。 - public（公共）
在公共区域内使用，不能相信网络内的其他计算机不会对您的计算机造成危害，只能接收经过选取的连接。 - external（外部）
特别是为路由器启用了伪装功能的外部网。您不能信任来自网络的其他计算机，
不能相信它们不会对您的计算机造成危害，只能接收经过选择的连接。 - dmz（非军事区）
用于您的非军事区内的电脑，此区域内可公开访问，可以有限地进入您的内部网络，仅仅接收经过选择的连接。 - work（工作）
用于工作区。您可以基本相信网络内的其他电脑不会危害您的电脑。仅仅接收经过选择的连接。 - home（家庭）
用于家庭网络。您可以基本信任网络内的其他计算机不会危害您的计算机。仅仅接收经过选择的连接。 - internal（内部）
用于内部网络。您可以基本上信任网络内的其他计算机不会威胁您的计算机。仅仅接受经过选择的连接。 - trusted（信任）
可接受所有的网络连接。
启动控制命令：
查看防火墙状态 systemctl status firewalld.service firewall-cmd --statefirewall-cmd --list-all
启动防火墙 systemctl start firewalld.service
关闭防火墙 systemctl stop firewalld.service
重新启动防火墙 systemctl restart firewalld.service
状态查询:
显示状态： firewall-cmd --state
查看区域信息: firewall-cmd --get-active-zones
# firewall-cmd --get-active-zones
public
interfaces: eth0
firewall-cmd --get-zone-of-interface=eth0
firewall-cmd --zone=public --add-interface=eth0
# firewall-cmd --set-default-zone=public 立即生效无需重启
查看所有打开的端口：
# firewall-cmd --zone=public --list-ports
新增端口到区域：
# firewall-cmd --zone=public --add-port=8080/tcp 临时添加，执行后立即生效
# firewall-cmd --zone=public --add-port=8080/tcp --permanent 永久添加，重载后生效
# firewall--cmd --reload 重载配置文件（不改变之前状态）
删除端口到区域： # firewall-cmd --zone=public --remove-port=8080/tcp 临时关掉，执行后立即生效
# firewall-cmd --zone=public --remove-port=8080/tcp --permanent 永久添删除，重载后生效
# firewall-cmd --reload 重载配置文件
Usage: firewall-cmd [OPTIONS...]
General Options
-h, --help Prints a short help text and exists
-V, --version Print the version string of firewalld
-q, --quiet Do not print status messages
Status Options
--state Return and print firewalld state 防火墙状态
--reload Reload firewall and keep state information 不改变状态 重新载入防火墙信息（加载前的连接信息会保留）
--complete-reload Reload firewall and loose state information 完全重新加载防火墙信息（加载前的连接信息不保留，注意22端口）
--runtime-to-permanent Create permanent from runtime configuration 保存当前配置到配置文件
Permanent Options
--permanent Set an option permanently Usable for options maked with [P] 设置永久可用配置
Zone Options
--get-default-zone Print default zone for connections and interfaces 显示默认zone
--set-default-zone=<zone> Set default zone 设置默认zone
--get-active-zones Print currently active zones 显示当前活动的zone
--get-zones Print predefined zones [P] 显示所有zone
--get-services Print predefined services [P] 显示所有服务
--get-icmptypes Print predefined icmptypes [P] 显示所有协议
--get-zone-of-interface=<interface> Print name of the zone the interface is bound to [P] 查看指定端口zone信息
--get-zone-of-source=<source>[/<mask>] Print name of the zone the source[/mask] is bound to [P] 查看指定来源的zone信息
--list-all-zones List everything added for or enabled in all zones [P] 查看所有的zone信息
--new-zone=<zone> Add a new zone [P only] 增加一个zone
--delete-zone=<zone> Delete an existing zone [P only] 删除一个zone
--zone=<zone> Use this zone to set or query options, else default zone Usable for options maked with [Z]
使用这个zone 设置或查询 不指定则是对默认zone进行设置
--get-target Get the zone target [P] [Z]
--set-target=<target> Set the zone target [P] [Z]
IcmpType Options
--new-icmptype=<icmptype> Add a new icmptype [P only] 增加一个icmp类型
--delete-icmptype=<icmptype> Delete and existing icmptype [P only] 删除一个icmp类型
Service Options
--new-service=<service> Add a new service [P only] 增加一个服务
--delete-service=<service> Delete and existing service [P only] 删除一个服务
Options to Adapt and Query Zones
--list-all List everything added for or enabled in a zone [P] [Z] 查看默认zone信息
--list-services List services added for a zone [P] [Z] 查看默认zone服务信息
--timeout=<timeval> Enable an option for timeval time, where timeval is 超时选项，时间单位可以为 s、m、h 秒、分钟、小时
a number followed by one of letters 's' or 'm' or 'h'
Usable for options maked with [T]
--add-service=<service> Add a service for a zone [P] [Z] [T] 为某个zone增加一个新服务
--remove-service=<service> Remove a service from a zone [P] [Z] 为某个zone删除一个新服务
--query-service=<service> Return whether service has been added for a zone [P] [Z] zone中某服务是否已添加
--list-ports List ports added for a zone [P] [Z] 列出zone中已添加的端口
--add-port=<portid>[-<portid>]/<protocol> Add the port for a zone [P] [Z] [T] 为zone添加一个端口 端口/协议
--remove-port=<portid>[-<portid>]/<protocol> Remove the port from a zone [P] [Z] 为zone删除一个端口 端口/协议
--query-port=<portid>[-<portid>]/<protocol> Return whether the port has been added for zone [P] [Z] 查询已增加的端口
--list-icmp-blocks List Internet ICMP type blocks added for a zone [P] [Z] 列出zone中的icmp模块
--add-icmp-block=<icmptype> Add an ICMP block for a zone [P] [Z] [T] 为zone增加一个icmp模块
--remove-icmp-block=<icmptype> Remove the ICMP block from a zone [P] [Z] 为zone删除一个icmp模块
--query-icmp-block=<icmptype> Return whether an ICMP block has been added for a zone [P] [Z] 查询zone中的icmp模块
--list-forward-ports List IPv4 forward ports added for a zone [P] [Z] 查看zone内的 端口转发
--add-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]]
Add the IPv4 forward port for a zone [P] [Z] [T] 为zone内增加端口转发
实例：22端口接收的数据 转发到3753端口
firewall-cmd --zone=external --add-forward-port=port=22:proto=tcp:toport=3753
firewall-cmd --zone=public --add-forward-port=port=22:proto=tcp:toaddr=10.0.0.1:toport=3753
实例：22端口接收的数据 转发到10.0.0.1服务器的3753端口
--remove-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]]
Remove the IPv4 forward port from a zone [P] [Z] 为zone内删除某个端口转发
--query-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]]
Return whether the IPv4 forward port has been added for a zone [P] [Z] 查询zone内的端口转发
--add-masquerade Enable IPv4 masquerade for a zone [P] [Z] [T] 启用区域中的IP伪装功能（端口转发用到此功能）
--remove-masquerade Disable IPv4 masquerade for a zone [P] [Z] 禁用区域中的IP伪装
--query-masquerade Return whether IPv4 masquerading has been enabled for a zone [P] [Z] 查询zone内ip伪装是否生效
--list-rich-rules List rich language rules added for a zone [P] [Z] 列出zone内 rich规则
--add-rich-rule=<rule> Add rich language rule 'rule' for a zone [P] [Z] [T] 向某zone中添加一条rich rule 规则
实例：允许10.0.0.1 10.0.0段所有访问所有端口
firewall-cmd --add-rich-rule="rule family=ipv4 source address=10.0.0.1/24 accept"
实例：仅允许指定IP10.0.0.1访问3306端口
firewall-cmd --add-rich-rule="rule family=ipv4 source address=10.0.0.1 port port=3306 protocol=tcp accept"
实例：拒绝10.0.0.1访问3306端口
firewall-cmd --add-rich-rule="rule family=ipv4 source address=10.0.0.1 port port=9100 protocol=tcp reject"
允许 accept
拒绝 reject
丢弃 drop
--remove-rich-rule=<rule> Remove rich language rule 'rule' from a zone [P] [Z]
--query-rich-rule=<rule> Return whether a rich language rule 'rule' has been added for a zone [P] [Z]
Options to Handle Bindings of Interfaces
--list-interfaces List interfaces that are bound to a zone [P] [Z] 列出某zone中绑定的端口
--add-interface=<interface> Bind the <interface> to a zone [P] [Z] 为某zone 增加一个端口
--change-interface=<interface> Change zone the <interface> is bound to [Z] 修改zone中绑定的端口
--query-interface=<interface> Query whether <interface> is bound to a zone [P] [Z] 查询zone中绑定的端口
--remove-interface=<interface> Remove binding of <interface> from a zone [P] [Z] 移除zone中绑定的端口
Options to Handle Bindings of Sources
--list-sources List sources that are bound to a zone [P] [Z]
--add-source=<source>[/<mask>] Bind <source>[/<mask>] to a zone [P] [Z]
--change-source=<source>[/<mask>] Change zone the <source>[/<mask>] is bound to [Z]
--query-source=<source>[/<mask>] Query whether <source>[/<mask>] is bound to a zone [P] [Z]
--remove-source=<source>[/<mask>] Remove binding of <source>[/<mask>] from a zone [P] [Z]
Direct Options
--direct First option for all direct options
--get-all-chains Get all chains [P]
--get-chains {ipv4|ipv6|eb} <table> Get all chains added to the table [P]
--add-chain {ipv4|ipv6|eb} <table> <chain> Add a new chain to the table [P]
--remove-chain {ipv4|ipv6|eb} <table> <chain> Remove the chain from the table [P]
--query-chain {ipv4|ipv6|eb} <table> <chain> Return whether the chain has been added to the table [P]
--get-all-rules Get all rules [P]
--get-rules {ipv4|ipv6|eb} <table> <chain> Get all rules added to chain in table [P]
--add-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>... Add rule to chain in table [P]
--remove-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>... Remove rule with priority from chain in table [P]
--remove-rules {ipv4|ipv6|eb} <table> <chain> Remove rules from chain in table [P]
--query-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>... Return whether a rule with priority has been added to chain in table [P]
--passthrough {ipv4|ipv6|eb} <arg>... Pass a command through (untracked by firewalld)
--get-all-passthroughs Get all tracked passthrough rules [P]
--get-passthroughs {ipv4|ipv6|eb} <arg>... Get tracked passthrough rules [P]
--add-passthrough {ipv4|ipv6|eb} <arg>... Add a new tracked passthrough rule [P]
--remove-passthrough {ipv4|ipv6|eb} <arg>... Remove a tracked passthrough rule [P]
--query-passthrough {ipv4|ipv6|eb} <arg>... Return whether the tracked passthrough rule has been added [P]
Lockdown Options
--lockdown-on Enable lockdown.
--lockdown-off Disable lockdown.
--query-lockdown Query whether lockdown is enabled
Lockdown Whitelist Options
--list-lockdown-whitelist-commands List all command lines that are on the whitelist [P]
--add-lockdown-whitelist-command=<command> Add the command to the whitelist [P]
--remove-lockdown-whitelist-command=<command> Remove the command from the whitelist [P]
--query-lockdown-whitelist-command=<command> Query whether the command is on the whitelist [P]
--list-lockdown-whitelist-contexts List all contexts that are on the whitelist [P]
--add-lockdown-whitelist-context=<context> Add the context context to the whitelist [P]
--remove-lockdown-whitelist-context=<context> Remove the context from the whitelist [P]
--query-lockdown-whitelist-context=<context> Query whether the context is on the whitelist [P]
--list-lockdown-whitelist-uids List all user ids that are on the whitelist [P]
--add-lockdown-whitelist-uid=<uid> Add the user id uid to the whitelist [P]
--remove-lockdown-whitelist-uid=<uid> Remove the user id uid from the whitelist [P]
--query-lockdown-whitelist-uid=<uid> Query whether the user id uid is on the whitelist [P]
--list-lockdown-whitelist-users List all user names that are on the whitelist [P]
--add-lockdown-whitelist-user=<user> Add the user name user to the whitelist [P]
--remove-lockdown-whitelist-user=<user> Remove the user name user from the whitelist [P]
--query-lockdown-whitelist-user=<user> Query whether the user name user is on the whitelist [P]
Panic Options
--panic-on Enable panic mode
--panic-off Disable panic mode
--query-panic Query whether panic mode is enabled