哲涛科技
编辑/etc/sysconfig/iptables文件
1.编辑/etc/sysconfig/iptables文件：vi /etc/sysconfig/iptables
按i键加入内容并保存：
-A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
注意是加在COMMIT前面!!
按ESC, 输入 wq回车!
2.重启服务：service iptables restart
3.查看端口是否开放：/sbin/iptables -L -n
CentOS 7 开放端口, 防火墙开端口, 开80,8080等端口
需要使用root权限
firewall-cmd --zone=public --add-port=80/tcp --permanent
关闭端口(已经添加的从防火墙中移除):
firewall-cmd --zone=public --remove-port=80/tcp --permanent
查看防火墙设置:
firewall-cmd --list-all
[root@localhost xrb]# firewall-cmd --list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: enp0s3
sources:
services: ssh dhcpv6-client
ports: 80/tcp
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
参数说明:
--zone #作用域
--add-port=80/tcp #添加端口，格式为：端口/通讯协议
--permanent #永久生效，没有此参数重启后失效
重启防火墙:
firewall-cmd --reload
或：
systemctl stop firewalld.service
systemctl start firewalld.service
或者：
systemctl restart firewalld.service
辅助资料 firewall-cmd :
Usage: firewall-cmd [OPTIONS...]
General Options
-h, --help Prints a short help text and exists
-V, --version Print the version string of firewalld
-q, --quiet Do not print status messages
Status Options
--state Return and print firewalld state
--reload Reload firewall and keep state information
--complete-reload Reload firewall and lose state information
--runtime-to-permanent
Create permanent from runtime configuration
--check-config Check permanent configuration for errors
Log Denied Options
--get-log-denied Print the log denied value
--set-log-denied=
Set log denied value
Automatic Helpers Options
--get-automatic-helpers
Print the automatic helpers value
--set-automatic-helpers=
Set automatic helpers value
Permanent Options
--permanent Set an option permanently
Usable for options marked with [P]
Zone Options
--get-default-zone Print default zone for connections and interfaces
--set-default-zone=
Set default zone
--get-active-zones Print currently active zones
--get-zones Print predefined zones [P]
--get-services Print predefined services [P]
--get-icmptypes Print predefined icmptypes [P]
--get-zone-of-interface=
Print name of the zone the interface is bound to [P]
--get-zone-of-source=
Print name of the zone the source is bound to [P]
--list-all-zones List everything added for or enabled in all zones [P]
--new-zone=
--new-zone-from-file=
Add a new zone from file with optional name [P only]
--delete-zone=
--load-zone-defaults=
Load zone default settings [P only] [Z]
--zone=
Usable for options marked with [Z]
--get-target Get the zone target [P only] [Z]
--set-target=
Set the zone target [P only] [Z]
--info-zone=
--path-zone=
IPSet Options
--get-ipset-types Print the supported ipset types
--new-ipset=
Add a new ipset [P only]
--new-ipset-from-file=
Add a new ipset from file with optional name [P only]
--delete-ipset=
Delete an existing ipset [P only]
--load-ipset-defaults=
Load ipset default settings [P only]
--info-ipset=
--path-ipset=
--get-ipsets Print predefined ipsets
--ipset=
Set new description to ipset [P only]
--ipset=
Print description for ipset [P only]
--ipset=
Set new short description to ipset [P only]
--ipset=
Print short description for ipset [P only]
--ipset=
Add a new entry to an ipset [P]
--ipset=
Remove an entry from an ipset [P]
--ipset=
Return whether ipset has an entry [P]
--ipset=
List entries of an ipset [P]
--ipset=
Add a new entries to an ipset [P]
--ipset=
Remove entries from an ipset [P]
IcmpType Options
--new-icmptype=
Add a new icmptype [P only]
--new-icmptype-from-file=
Add a new icmptype from file with optional name [P only]
--delete-icmptype=
Delete an existing icmptype [P only]
--load-icmptype-defaults=
Load icmptype default settings [P only]
--info-icmptype=
Print information about an icmptype
--path-icmptype=
Print file path of an icmptype [P only]
--icmptype=
Set new description to icmptype [P only]
--icmptype=
Print description for icmptype [P only]
--icmptype=
Set new short description to icmptype [P only]
--icmptype=
Print short description for icmptype [P only]
--icmptype=
Enable destination for ipv in icmptype [P only]
--icmptype=
Disable destination for ipv in icmptype [P only]
--icmptype=
Return whether destination ipv is enabled in icmptype [P only]
--icmptype=
List destinations in icmptype [P only]
Service Options
--new-service=
Add a new service [P only]
--new-service-from-file=
Add a new service from file with optional name [P only]
--delete-service=
Delete an existing service [P only]
--load-service-defaults=
Load icmptype default settings [P only]
--info-service=
Print information about a service
--path-service=
Print file path of a service [P only]
--service=
Set new description to service [P only]
--service=
Print description for service [P only]
--service=
Set new short description to service [P only]
--service=
Print short description for service [P only]
--service=
Add a new port to service [P only]
--service=
Remove a port from service [P only]
--service=
Return whether the port has been added for service [P only]
--service=
List ports of service [P only]
--service=
Add a new protocol to service [P only]
--service=
Remove a protocol from service [P only]
--service=
Return whether the protocol has been added for service [P only]
--service=
List protocols of service [P only]
--service=
Add a new source port to service [P only]
--service=
Remove a source port from service [P only]
--service=
Return whether the source port has been added for service [P only]
--service=
List source ports of service [P only]
--service=
Add a new module to service [P only]
--service=
Remove a module from service [P only]
--service=
Return whether the module has been added for service [P only]
--service=
List modules of service [P only]
--service=
Set destination for ipv to address in service [P only]
--service=
Disable destination for ipv i service [P only]
--service=
Return whether destination ipv is set for service [P only]
--service=
List destinations in service [P only]
Options to Adapt and Query Zones
--list-all List everything added for or enabled in a zone [P] [Z]
--list-services List services added for a zone [P] [Z]
--timeout=
a number followed by one of letters 's' or 'm' or 'h'
Usable for options marked with [T]
--set-description=
Set new description to zone [P only] [Z]
--get-description Print description for zone [P only] [Z]
--set-short=
Set new short description to zone [P only] [Z]
--get-short Print short description for zone [P only] [Z]
--add-service=
Add a service for a zone [P] [Z] [T]
--remove-service=
Remove a service from a zone [P] [Z]
--query-service=
Return whether service has been added for a zone [P] [Z]
--list-ports List ports added for a zone [P] [Z]
--add-port=
Add the port for a zone [P] [Z] [T]
--remove-port=
Remove the port from a zone [P] [Z]
--query-port=
Return whether the port has been added for zone [P] [Z]
--list-protocols List protocols added for a zone [P] [Z]
--add-protocol=
Add the protocol for a zone [P] [Z] [T]
--remove-protocol=
Remove the protocol from a zone [P] [Z]
--query-protocol=
Return whether the protocol has been added for zone [P] [Z]
--list-source-ports List source ports added for a zone [P] [Z]
--add-source-port=
Add the source port for a zone [P] [Z] [T]
--remove-source-port=
Remove the source port from a zone [P] [Z]
--query-source-port=
Return whether the source port has been added for zone [P] [Z]
--list-icmp-blocks List Internet ICMP type blocks added for a zone [P] [Z]
--add-icmp-block=
Add an ICMP block for a zone [P] [Z] [T]
--remove-icmp-block=
Remove the ICMP block from a zone [P] [Z]
--query-icmp-block=
Return whether an ICMP block has been added for a zone
[P] [Z]
--add-icmp-block-inversion
Enable inversion of icmp blocks for a zone [P] [Z]
--remove-icmp-block-inversion
Disable inversion of icmp blocks for a zone [P] [Z]
--query-icmp-block-inversion
Return whether inversion of icmp blocks has been enabled
for a zone [P] [Z]
--list-forward-ports List IPv4 forward ports added for a zone [P] [Z]
--add-forward-port=port=
Add the IPv4 forward port for a zone [P] [Z] [T]
--remove-forward-port=port=
Remove the IPv4 forward port from a zone [P] [Z]
--query-forward-port=port=
Return whether the IPv4 forward port has been added for
a zone [P] [Z]
--add-masquerade Enable IPv4 masquerade for a zone [P] [Z] [T]
--remove-masquerade Disable IPv4 masquerade for a zone [P] [Z]
--query-masquerade Return whether IPv4 masquerading has been enabled for a
zone [P] [Z]
--list-rich-rules List rich language rules added for a zone [P] [Z]
--add-rich-rule=
Add rich language rule 'rule' for a zone [P] [Z] [T]
--remove-rich-rule=
Remove rich language rule 'rule' from a zone [P] [Z]
--query-rich-rule=
Return whether a rich language rule 'rule' has been
added for a zone [P] [Z]
Options to Handle Bindings of Interfaces
--list-interfaces List interfaces that are bound to a zone [P] [Z]
--add-interface=
Bind the
--change-interface=
Change zone the
--query-interface=
Query whether
--remove-interface=
Remove binding of
Options to Handle Bindings of Sources
--list-sources List sources that are bound to a zone [P] [Z]
--add-source=
Bind the source to a zone [P] [Z]
--change-source=
Change zone the source is bound to [Z]
--query-source=
Query whether the source is bound to a zone [P] [Z]
--remove-source=
Remove binding of the source from a zone [P] [Z]
Helper Options
--new-helper=
Add a new helper [P only]
--new-helper-from-file=
Add a new helper from file with optional name [P only]
--delete-helper=
Delete an existing helper [P only]
--load-helper-defaults=
Load helper default settings [P only]
--info-helper=
--path-helper=
--get-helpers Print predefined helpers
--helper=
Set new description to helper [P only]
--helper=
Print description for helper [P only]
--helper=
Set new short description to helper [P only]
--helper=
Print short description for helper [P only]
--helper=
Add a new port to helper [P only]
--helper=
Remove a port from helper [P only]
--helper=
Return whether the port has been added for helper [P only]
--helper=
List ports of helper [P only]
--helper=
Set module to helper [P only]
--helper=
Get module from helper [P only]
--helper=
Set family for helper [P only]
--helper=
Get module from helper [P only]
Direct Options
--direct First option for all direct options
--get-all-chains
Get all chains [P]
--get-chains {ipv4|ipv6|eb}
Get all chains added to the table [P]
--add-chain {ipv4|ipv6|eb}
Add a new chain to the table [P]
--remove-chain {ipv4|ipv6|eb}
Remove the chain from the table [P]
--query-chain {ipv4|ipv6|eb}
Return whether the chain has been added to the table [P]
--get-all-rules
Get all rules [P]
--get-rules {ipv4|ipv6|eb}
Get all rules added to chain in table [P]
--add-rule {ipv4|ipv6|eb}
Add rule to chain in table [P]
--remove-rule {ipv4|ipv6|eb}
Remove rule with priority from chain in table [P]
--remove-rules {ipv4|ipv6|eb}
Remove rules from chain in table [P]
--query-rule {ipv4|ipv6|eb}
Return whether a rule with priority has been added to
chain in table [P]
--passthrough {ipv4|ipv6|eb}
Pass a command through (untracked by firewalld)
--get-all-passthroughs
Get all tracked passthrough rules [P]
--get-passthroughs {ipv4|ipv6|eb}
Get tracked passthrough rules [P]
--add-passthrough {ipv4|ipv6|eb}
Add a new tracked passthrough rule [P]
--remove-passthrough {ipv4|ipv6|eb}
Remove a tracked passthrough rule [P]
--query-passthrough {ipv4|ipv6|eb}
Return whether the tracked passthrough rule has been
added [P]
Lockdown Options
--lockdown-on Enable lockdown.
--lockdown-off Disable lockdown.
--query-lockdown Query whether lockdown is enabled
Lockdown Whitelist Options
--list-lockdown-whitelist-commands
List all command lines that are on the whitelist [P]
--add-lockdown-whitelist-command=
Add the command to the whitelist [P]
--remove-lockdown-whitelist-command=
Remove the command from the whitelist [P]
--query-lockdown-whitelist-command=
Query whether the command is on the whitelist [P]
--list-lockdown-whitelist-contexts
List all contexts that are on the whitelist [P]
--add-lockdown-whitelist-context=
Add the context context to the whitelist [P]
--remove-lockdown-whitelist-context=
Remove the context from the whitelist [P]
--query-lockdown-whitelist-context=
Query whether the context is on the whitelist [P]
--list-lockdown-whitelist-uids
List all user ids that are on the whitelist [P]
--add-lockdown-whitelist-uid=
Add the user id uid to the whitelist [P]
--remove-lockdown-whitelist-uid=
Remove the user id uid from the whitelist [P]
--query-lockdown-whitelist-uid=
Query whether the user id uid is on the whitelist [P]
--list-lockdown-whitelist-users
List all user names that are on the whitelist [P]
--add-lockdown-whitelist-user=
Add the user name user to the whitelist [P]
--remove-lockdown-whitelist-user=
Remove the user name user from the whitelist [P]
--query-lockdown-whitelist-user=
Query whether the user name user is on the whitelist [P]
Panic Options
--panic-on Enable panic mode
--panic-off Disable panic mode
--query-panic Query whether panic mode is enabled
