42.每日一个Linux命令----firewall

描述：防火墙

指令：

运行时模式下对区域进行的修改不是永久有效的。从新加载或者重启后修改将失效。

要永久有效需加 --permanent，永久选项不直接影响运行时的状态。这些选项仅在重载或者重启服务时可用。

为了使用运行时和永久设置，须要分别设置二者。

firewall-cmd --state

firewall-cmd --reload

firewall-cmd --get-zones

firewall-cmd --get-services

firewall-cmd --icmptypes

firewall-cmd --list-all-zones

firewall-cmd --list-all

firewall-cmd --get-default-zone

firewall-cmd --set-default-zone

firewall-cmd --get-active-zones

firewall-cmd --get-zone-of-interface=<interface>

firewall-cmd --zone=<zone> --add-interface=<interface>

firewall-cmd --zone=<zone> --change-interface=<interface>

firewall-cmd --zone=<zone> --remove-interface=<interface>

firewall-cmd --zone=<zone> --query-interface=<interface>

firewall-cmd --zone=<zone> --list-services

firewall-cmd --panic-on

firewall-cmd --panic-off

firewall-cmd --query-panic

firewall-cmd [--zone=<zone>] --add-service=<service> [--timeout=<seconds>]

firewall-cmd [--zone=<zone>] --add-port=<port>/<protocol>

firewall-cmd [--zone=<zone>] --remove-port=<port>/<protocol>

firewall-cmd [--zone=<zone>] --query-port=<port>/<protocol>

启用区域中的IP假装功能

firewall-cmd --add-masquerade

firewall-cmd --remove-masquerade

firewall-cmd --query-masquerade

firewall-cmd  --query-icmp-block=<icmptype>

firewall-cmd  --add-icmp-block=<icmptype>

firewall-cmd  --remove-icmp-block=<icmptype>   

firewall-cmd --zone=public --add-icmp-block=echo-reply

firewall-cmd [--zone=<zone>] --add-forward-port=port=<port>:proto=<protocol>:toport=<port>:toaddr=<address>

firewall-cmd [--zone=<zone>] --add-forward-port=port=<port>:proto=<protocol>:toport=<port>

firewall-cmd [--zone=<zone>] --add-forward-port=port=<port>:proto=<protocol>:toaddr=<address>

firewall-cmd [--zone=<zone>] --remove-forward-port=port=<port>:proto=<protocol>:toport=<port>:toaddr=<address>

firewall-cmd [--zone=<zone>] --query-forward-port=port=<port>:proto=<protocol>:toport=<port>:toaddr=<address>

firewall-cmd [--zone=<zone>] --add-forward-port=port=<port>[-<port>]:proto=<protocol> { :toport=<port>[-<port>] | :toaddr=<address> | :toport=<port>[-<port>]:toaddr=<address> }