firewalld常用用法

1.内部所有主机都需要通过管理机上网,关闭掉内部主机的eth0网卡

管理机开启防火墙的IP地址伪装功能

[root@m01 ~]#  firewall-cmd --add-masquerade --permanent
success
[root@m01 ~]#  firewall-cmd --reload
success
[root@m01 ~]# ssh root@172.16.1.7
root@172.16.1.7's password: 
Last login: Wed Jun 12 16:31:06 2019 from 10.0.0.2
[root@web01 ~]# ping baidu.com
ping: baidu.com: Name or service not known

内网机修改网卡信息，网关指向管理机

[root@web01 ~]# vim /etc/sysconfig/network-scripts/ifcfg-eth1
TYPE=Ethernet
BOOTPROTO=none
NAME=eth1
DEVICE=eth1
ONBOOT=yes
IPADDR=172.16.1.7
GATEWAY=172.16.1.61
PREFIX=24 

添加DNS

[root@web01 ~]# cat /etc/resolv.conf

Generated by NetworkManager

nameserver 223.6.6.6
[root@web01 ~]# systemctl restart network
[root@web01 ~]# ifdown eth1 && ifup eth1
Device 'eth1' successfully disconnected.
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/11)
[root@web01 ~]# ping baidu.com
PING baidu.com (220.181.38.148) 56(84) bytes of data.
64 bytes from 220.181.38.148 (220.181.38.148): icmp_seq=1 ttl=128 time=26.2 ms

2.管理主机(10.0.0.3)仅允许公司的10.0.0.1的IP地址连接,其他统统拒绝.

[root@m01 ~]# firewall-cmd --add-rich-rule='rule family=ipv4 source address=10.0.0.1/32 service name=ssh accept'
success

[root@m01 ~]# firewall-cmd --list-all 


#测试
[root@m01 ~]# ssh root@10.0.0.3
ssh: connect to host 10.0.0.3 port 22: No route to host

      ssh root@10.0.0.3
root@10.0.0.3's password: 
Last login: Wed Jun 12 20:28:28 2019 from 172.16.1.5

3.将9000端口做成一个服务名称,比如php-fpm,则代表放行9000

[root@m01 ~]# cd /usr/lib/firewalld/services/
[root@m01 services]# cp http.xml php-fpm.xml
[root@m01 services]#  vim php-fpm.xml

<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>php-fpm</short>
  <description>php-fpm Server</description>
  <port protocol="tcp" port="9000"/>
</service>
[root@m01 services]# systemctl restart firewalld.service 
[root@m01 services]# firewall-cmd --add-service=php-fpm
success
[root@m01 services]# firewall-cmd --list-all

4.在负载均衡服务上,仅放行80和443,22端口只有10.0.0.2能正常连接,其他统统拒绝.

[root@m01 ~]# firewall-cmd --add-service={https,http}
[root@m01 ~]# firewall-cmd --add-rich-rule='rule family=ipv4 source address=10.0.0.2/32 service name=ssh accept'
[root@m01 ~]# firewall-cmd --list-all