Centos 7 默认iptables 如使用 firewalld 先停用iptables在单独安装
sudo systemctl stop iptables
sudo systemctl disable iptables
sudo yum install firewalld
sudo systemctl start firewalld
sudo systemctl enable firewalldCentOS Stream 8/9 默认firewalld 下面为常用命令
查看防火墙状态
sudo systemctl status firewalld启动防火墙 停止防火墙
sudo systemctl start firewalld
sudo systemctl stop firewalld开机启动 禁止开机启动 查看是否开机启动
sudo systemctl enable firewalld
sudo systemctl disable firewalld
sudo systemctl is-enabled firewalld以下命令中包含–permanent 为永久生效，反之为临时 重启失效
打开80端口
sudo firewall-cmd --zone=public --add-port=80/tcp --permanent关闭80端口
firewall-cmd --zone=public --remove-port=80/tcp --permanent禁用默认全局SSH服务 如果禁用默认全局SSH必须使用rich-rule指定IP和端口
sudo firewall-cmd --remove-service=ssh --permanent启用全局SSH服务 全局SSH服务优先级高于rich-rule 所以 开了全局SSH rich-rule不会生效必须禁用后才能指定IP或IP段访问端口
sudo firewall-cmd --add-service=ssh --permanent增加允许指定ip访问22 （I支持iP或IP段）
sudo firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="1.1.1.1" port protocol="tcp" port="22" accept' --permanent
sudo firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="1.1.1.1/16" port protocol="tcp" port="22" accept' --permanent删除指定IP访问22
sudo firewall-cmd --zone=public --remove-rich-rule='rule family="ipv4" source address="1.1.1.1" port protocol="udp" port="22" accept' --permanent
sudo firewall-cmd --zone=public --remove-rich-rule='rule family="ipv4" source address="1.1.1.1/16" port protocol="udp" port="22" accept' --permanent屏蔽IP或IP段
sudo firewall-cmd --permanent --add-rich-rule="rule family=ipv4 source address=1.1.1.1 reject"
sudo firewall-cmd --permanent --add-rich-rule="rule family=ipv4 source address=1.1.1.1/16 reject"删除屏蔽IP或IP段
firewall-cmd --permanent --remove-rich-rule="rule family="ipv4" source address="1.1.1.1" reject"
firewall-cmd --permanent --remove-rich-rule="rule family="ipv4" source address="1.1.1.1/16" reject"重新加载防火墙配置
sudo firewall-cmd --reload查看公共规则
firewall-cmd --list-all --zone=public查看rich-rules规则
sudo firewall-cmd --list-rich-rules查看日志
cat /var/log/firewalld注：CentOS Stream 8 发行版中 报 警告 WARNING: AllowZoneDrifting is enabled. This is considered an insecure configuration option. It will be removed in a future release. Please consider disabling it now.
vi /etc/firewalld/firewalld.conf设置为
AllowZoneDrifting=no