CentOS防火墙设置

以前总结的一系列CentOS安装中间件的教程，都是假设在防火墙关闭的状况下进行的，在实战中可能会遇到端口不通等状况，若是是ECS云服务器，能够经过修改安全组策略的方式开启或关闭端口访问，但若是是本身的机器，须要手动关闭防火墙（或开启指定端口的访问），下面就介绍下CentOS 7和CentOS 6防火墙的经常使用设置

首先，确认服务器操做系统版本：

shell> cat /etc/redhat-release
CentOS Linux release 7.6.1810 (Core)
复制代码

CentOS 7

一、firewall服务

1）查看状态

Active: active (running)，防火墙已开启

shell> systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
   Active: active (running) since Mon 2020-04-06 00:03:45 CST; 2s ago
     Docs: man:firewalld(1)
 Main PID: 5463 (firewalld)
   CGroup: /system.slice/firewalld.service
           └─5463 /usr/bin/python2 -Es /usr/sbin/firewalld --nofork --nopid
复制代码

Active: inactive (dead)，防火墙已关闭

shell> systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
   Active: inactive (dead)
     Docs: man:firewalld(1)
复制代码

2）启动&中止

启动

shell> systemctl start firewalld
复制代码

中止

shell> systemctl stop firewalld
复制代码

重启

shell> systemctl restart firewalld
复制代码

3）开机自启动

容许开机启动

shell> systemctl enable firewalld
复制代码

禁止开机启动

shell> systemctl disable firewalld
复制代码

综上，CentOS 7若是想简单粗暴的完全关闭防火墙，直接执行：

shell> systemctl stop firewalld
shell> systemctl disable firewalld
复制代码

二、firewall命令

1）查看状态

running，防火墙已开启

shell> firewall-cmd --state
running
复制代码

not running，防火墙未开启

shell> firewall-cmd --state
not running
复制代码

2）查看防火墙规则

shell> firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: enp2s0
  sources: 
  services: ssh dhcpv6-client
  ports: 3888/tcp 2181/tcp
  protocols: 
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules:
复制代码

3）端口控制

查看全部开启的端口

shell> firewall-cmd --list-ports
3888/tcp 2181/tcp
复制代码

查看指定端口是否开启

shell> firewall-cmd --query-port=3306/tcp
no
shell> firewall-cmd --query-port=2181/tcp
yes
复制代码

添加端口

shell> firewall-cmd --add-port=2888/tcp --permanent  
success
shell> firewall-cmd --add-port=65001-65010/tcp --permanent
shell> firewall-cmd --reload
success
# 查看是否添加成功
shell> firewall-cmd --list-ports                   
3888/tcp 2181/tcp 2888/tcp
复制代码

删除端口

shell> firewall-cmd --remove-port=2888/tcp --permanent   
success
shell> firewall-cmd --reload    
success
# 查看是否删除成功
shell> firewall-cmd --list-ports
3888/tcp 2181/tcp
复制代码

范围添加

shell> firewall-cmd --add-port=65001-65010/tcp --permanent
success
shell> firewall-cmd --reload
success
shell> firewall-cmd --list-ports
3888/tcp 2181/tcp 65001-65010/tcp
复制代码

从新加载（修改防火墙规则后须要执行reload）

shell> firewall-cmd --reload    
success
复制代码

CentOS 6

一、查看状态

防火墙已开启

shell> service iptables status
Table: filter
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:8888 
2    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:9200 
3    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:9000 
4    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:7002 
5    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:15672 
6    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:15672 
7    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:8000 
8    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:8082 
9    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:8010 
10   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:8769 
11   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:6379 
12   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:3306 
13   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:5672 
14   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:15672 
15   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:2181 
16   ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
17   ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           
18   ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
19   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22 
20   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:80 
21   REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited 
22   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:7002 
23   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:8001 
24   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           multiport dports 8888 

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination         
1    REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination
复制代码

防火墙已关闭

shell> service iptables status
iptables: Firewall is not running.
复制代码

二、启动&中止

开启防火墙

shell> service iptables start
iptables: Applying firewall rules:                         [  OK  ]
复制代码

关闭防火墙

shell> service iptables stop
iptables: Setting chains to policy ACCEPT: filter          [  OK  ]
iptables: Flushing firewall rules:                         [  OK  ]
iptables: Unloading modules:                               [  OK  ]
复制代码

重启防火墙

shell> service iptables restart
iptables: Setting chains to policy ACCEPT: filter          [  OK  ]
iptables: Flushing firewall rules:                         [  OK  ]
iptables: Unloading modules:                               [  OK  ]
iptables: Applying firewall rules:                         [  OK  ]
复制代码

三、开机自启动

容许开机启动

shell> chkconfig iptables on
复制代码

禁止开机启动

shell> chkconfig iptables off
复制代码

综上，CentOS 6若是想简单粗暴的完全关闭防火墙，直接执行：

shell> service iptables stop
shell> chkconfig iptables off
复制代码

四、开放指定端口

shell> vim /etc/sysconfig/iptables
复制代码

添加如下内容（假设要开放的端口为”2888“）

-A INPUT -p tcp -m tcp --dport 2888 -j ACCEPT
复制代码

重启防火墙

shell> service iptables restart
复制代码

shell> service iptables status    
Table: filter
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination         
... 
16   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:2888 
...
复制代码