centos6.x及以前版本查看防火墙状态，哪些端口开放serviceiptablesstatus#或者/etc/init.d/iptablesstatus配置防火墙vim/etc/sysconfig/iptables#Firewallconfigurationwrittenbysystem-config-firewall#Manualcustomizationofthisfileisnotrecommended.*filter:INPUTACCEPT[0:0]:FORWARDACCEPT[0:0]:OUTPUTACCEPT[0:0]-AINPUT-mstate–stateESTABLISHED,RELATED-jACCEPT-AINPUT-picmp-jACCEPT-AINPUT-ilo-jACCEPT-AINPUT-mstate–stateNEW-mtcp-ptcp–dport22-jACCEPT#主要在此处添加开放端口配置-AINPUT-mstate–stateNEW-mtcp-ptcp–dport80-jACCEPT-AINPUT-mstate–stateNEW-mtcp-ptcp–dport8080-jACCEPT-AINPUT-jREJECT–reject-withicmp-host-prohibited-AFORWARD-jREJECT–reject-withicmp-host-prohibitedCOMMIT最后重启防火墙使配置生效serviceiptablesrestart#或者/etc/init.d/iptablesrestartcentos7.x及以后版本centos7版本对防火墙进行加强,不再使用原来的iptables,启用firewalld常用命令#启动：systemctlstartfirewalld#查看状态：systemctlstatusfirewalldfirewall-cmd–state#停止：systemctldisablefirewalld#禁用：systemctlstopfirewalld#查看所有打开的端口firewall-cmd–zone=public–list-ports#添加一个端口firewall-cmd–zone=public–add-port=80/tcp–permanent#添加一段端口firewall-cmd–zone=public–add-port=20-21/tcp–permanent#删除一个端口firewall-cmd–zone=public–remove-port=80/tcp–permanent#更新防火墙规则firewall-cmd–reloadfirewalld的基本使用启动：systemctl start firewalld查状态：systemctl status firewalld停止：systemctl disable firewalld禁用：systemctl stop firewalld在开机时启用一个服务：systemctl enable firewalld.service在开机时禁用一个服务：systemctl disable firewalld.service查看服务是否开机启动：systemctl is-enabled firewalld.service查看已启动的服务列表：systemctl list-unit-files|grep enabled查看启动失败的服务列表：systemctl –failed配置firewalld-cmd查看版本：firewall-cmd –version查看帮助：firewall-cmd –help显示状态：firewall-cmd –state查看所有打开的端口：firewall-cmd –zone=public –list-ports更新防火墙规则：firewall-cmd –reload查看区域信息: firewall-cmd –get-active-zones查看指定接口所属区域：firewall-cmd –get-zone-of-interface=eth0拒绝所有包：firewall-cmd –panic-on取消拒绝状态：firewall-cmd –panic-off查看是否拒绝：firewall-cmd –query-panic那怎么开启一个端口呢firewall-cmd –zone=public(作用域) –add-port=80/tcp(端口和访问类型) –permanent(永久生效)firewall-cmd –zone=public –add-service=http –permanentfirewall-cmd –reload # 重新载入，更新防火墙规则firewall-cmd –zone= public –query-port=80/tcp #查看firewall-cmd –zone= public –remove-port=80/tcp –permanent # 删除firewall-cmd –list-servicesfirewall-cmd –get-servicesfirewall-cmd –add-service=<service>firewall-cmd –delete-service=<service>#在每次修改端口和服务后/etc/firewalld/zones/public.xml文件就会被修改,所以也可以在文件中之间修改,然后重新加载#使用命令实际也是在修改文件，需要重新加载才能生效。firewall-cmd –zone=public –query-port=80/tcpfirewall-cmd –zone=public –query-port=8080/tcpfirewall-cmd –zone=public –query-port=3306/tcpfirewall-cmd –zone=public –add-port=8080/tcp –permanentfirewall-cmd –zone=public –add-port=3306/tcp –permanentfirewall-cmd –zone=public –query-port=3306/tcpfirewall-cmd –zone=public –query-port=8080/tcpfirewall-cmd –reload # 重新加载后才能生效firewall-cmd –zone=public –query-port=3306/tcpfirewall-cmd –zone=public –query-port=8080/tcp参数解释–add-service #添加的服务–zone #作用域–add-port=80/tcp #添加端口，格式为：端口/通讯协议–permanent #永久生效，没有此参数重启后失效详细用法firewall-cmd –permanent –zone=public –add-rich-rule=’rule family=”ipv4″ source address=”192.168.0.4/24″ service name=”http” accept’ #设置某个ip访问某个服务firewall-cmd –permanent –zone=public –remove-rich-rule=’rule family=”ipv4″ source address=”192.168.0.4/24″ service name=”http” accept’ #删除配置firewall-cmd –permanent –add-rich-rule ‘rule family=ipv4 source address=192.168.0.1/2 port port=80 protocol=tcp accept’ #设置某个ip访问某个端口firewall-cmd –permanent –remove-rich-rule ‘rule family=ipv4 source address=192.168.0.1/2 port port=80 protocol=tcp accept’ #删除配置firewall-cmd –query-masquerade # 检查是否允许伪装IPfirewall-cmd –add-masquerade # 允许防火墙伪装IPfirewall-cmd –remove-masquerade # 禁止防火墙伪装IPfirewall-cmd –add-forward-port=port=80:proto=tcp:toport=8080 # 将80端口的流量转发至8080firewall-cmd –add-forward-port=proto=80:proto=tcp:toaddr=192.168.1.0.1 # 将80端口的流量转发至192.168.0.1firewall-cmd –add-forward-port=proto=80:proto=tcp:toaddr=192.168.0.1:toport=8080 # 将80端口搭建ELK分布式日志解决方案 Springboot logback 输出日志到 ELKSpring Boot前后端分离项目解决跨域问题的3种方案Keepalived Nginx 实现高可用 Web 负载均衡
