一、前文
本文直接進(jìn)行Linux系統(tǒng)firewalld防火墻的應(yīng)用實(shí)操
- 對(duì)外端口開(kāi)放使用
- 對(duì)內(nèi)端口限制ip地址使用
- 不使用端口默認(rèn)關(guān)閉
基礎(chǔ)知識(shí)請(qǐng)查閱：Linux系統(tǒng)firewalld防火墻的基本操作
進(jìn)階知識(shí)請(qǐng)查閱：Linux系統(tǒng)firewalld防火墻的進(jìn)階操作（日志保存 IP網(wǎng)段 ssh服務(wù)）
應(yīng)用實(shí)操請(qǐng)查閱：Linux系統(tǒng)firewalld防火墻的應(yīng)用實(shí)操（對(duì)外端口開(kāi)放使用，對(duì)內(nèi)端口限制ip地址使用，不使用端口默認(rèn)關(guān)閉）
應(yīng)用實(shí)操請(qǐng)查閱：Linux系統(tǒng)firewalld防火墻的應(yīng)用實(shí)操（禁止屏蔽海外國(guó)外IP訪問(wèn)）
二、啟動(dòng)firewalld
- firewalld 默認(rèn)不啟動(dòng)
systemctl status firewalld
[root@iZ2ze30dygwd6yh7gu6lskZ ~]# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
Active: inactive (dead)
Docs: man:firewalld(1)
- firewalld的規(guī)則是默認(rèn)拒絕訪問(wèn)
systemctl start firewalld
systemctl status firewalld
[root@iZ2ze30dygwd6yh7gu6lskZ ~]# systemctl start firewalld
[root@iZ2ze30dygwd6yh7gu6lskZ ~]# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
Active: active (running) since Sun 2022-08-14 23:10:53 CST; 6s ago
Docs: man:firewalld(1)
Main PID: 14774 (firewalld)
Tasks: 2 (limit: 26213)
Memory: 21.7M
CGroup: /system.slice/firewalld.service
└─14774 /usr/libexec/platform-python -s /usr/sbin/firewalld --nofork --nopid
Aug 14 23:10:53 iZ2ze30dygwd6yh7gu6lskZ systemd[1]: Starting firewalld - dynamic firewall daemon...
Aug 14 23:10:53 iZ2ze30dygwd6yh7gu6lskZ systemd[1]: Started firewalld - dynamic firewall daemon.
- 所以啟動(dòng)firewalld后，雖然服務(wù)器ip還能ping得通。
- 但是，端口卻telnet不通了。
telnet 8.140.110.xxx 80
telnet 8.140.110.xxx 8080
telnet 8.140.110.xxx 443
telnet 8.140.110.xxx 8443
三、開(kāi)放端口
- 80/8080/443/8443等對(duì)外開(kāi)放的端口，允許所有ip永久訪問(wèn)
firewall-cmd --add-port=80/tcp --permanent
firewall-cmd --add-port=8080/tcp --permanent
firewall-cmd --add-port=443/tcp --permanent
firewall-cmd --add-port=8443/tcp --permanent
firewall-cmd --reload
firewall-cmd --list-all
[root@iZ2ze30dygwd6yh7gu6lskZ ~]# firewall-cmd --add-port=80/tcp --permanent
success
[root@iZ2ze30dygwd6yh7gu6lskZ ~]# firewall-cmd --add-port=8080/tcp --permanent
success
[root@iZ2ze30dygwd6yh7gu6lskZ ~]# firewall-cmd --add-port=443/tcp --permanent
success
[root@iZ2ze30dygwd6yh7gu6lskZ ~]# firewall-cmd --add-port=8443/tcp --permanent
success
[root@iZ2ze30dygwd6yh7gu6lskZ ~]# firewall-cmd --reload
success
[root@iZ2ze30dygwd6yh7gu6lskZ ~]# firewall-cmd --list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: eth0
sources:
services: cockpit dhcpv6-client ssh
ports: 80/tcp 8080/tcp 443/tcp 8443/tcp
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
- telnet 測(cè)試也通了
telnet 8.140.110.xxx 80
telnet 8.140.110.xxx 8080
telnet 8.140.110.xxx 443
telnet 8.140.110.xxx 8443
四、特殊端口限制ip地址開(kāi)放
- 特殊端口，
- 比如22端口為了給遠(yuǎn)程連接ssh使用
- 比如3306端口為了mysql數(shù)據(jù)庫(kù)
- 比如6379端口為了redis數(shù)據(jù)庫(kù)
- 這些特殊端口僅提供給開(kāi)發(fā)者訪問(wèn)，以及本地java程序訪問(wèn)，所以限制ip地址訪問(wèn)。
- 首先查詢自己的ip，然后把自己的ip添加進(jìn)規(guī)則。
文章來(lái)源：http://www.zghlxwxcb.cn/news/detail-449275.html
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="127.0.0.1" port protocol="tcp" port="22" accept'
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="127.0.0.1" port protocol="tcp" port="3306" accept'
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="127.0.0.1" port protocol="tcp" port="6379" accept'
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="59.61.25.232" port protocol="tcp" port="22" accept'
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="59.61.25.232" port protocol="tcp" port="3306" accept'
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="59.61.25.232" port protocol="tcp" port="6379" accept'
firewall-cmd --reload
- 這邊放了一個(gè)錯(cuò)誤，添加了
127.0.0.1的ip地址，但是本機(jī)java程序還是無(wú)法訪問(wèn)數(shù)據(jù)庫(kù)。 - 然后又嘗試了
localhost，直接報(bào)錯(cuò)。 - 最后添加了本機(jī)的ip
8.140.110.xxx才得以成功。
[root@iZ2ze30dygwd6yh7gu6lskZ home]# firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="localhost" port protocol="tcp" port="22" accept'
Error: INVALID_ADDR: localhost
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="8.140.110.xxx" port protocol="tcp" port="22" accept'
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="8.140.110.xxx" port protocol="tcp" port="3306" accept'
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="8.140.110.xxx" port protocol="tcp" port="6379" accept'
firewall-cmd --reload
[root@iZ2ze30dygwd6yh7gu6lskZ home]# firewall-cmd --list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: eth0
sources:
services: cockpit dhcpv6-client ssh
ports: 80/tcp 8080/tcp 443/tcp 8443/tcp
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family="ipv4" source address="59.61.25.232" port port="22" protocol="tcp" accept
rule family="ipv4" source address="59.61.25.232" port port="3306" protocol="tcp" accept
rule family="ipv4" source address="59.61.25.232" port port="6379" protocol="tcp" accept
rule family="ipv4" source address="8.140.110.xxx" port port="22" protocol="tcp" accept
rule family="ipv4" source address="8.140.110.xxx" port port="3306" protocol="tcp" accept
rule family="ipv4" source address="8.140.110.xxx" port port="6379" protocol="tcp" accept
- 測(cè)試驗(yàn)證
- 使用本地網(wǎng)絡(luò)（IP:59.61.25.232），則訪問(wèn)數(shù)據(jù)庫(kù)ok
- 使用手機(jī)熱點(diǎn)開(kāi)啟的網(wǎng)絡(luò)（IP:其他），則訪問(wèn)數(shù)據(jù)庫(kù)ng
覺(jué)得好，就一鍵三連唄（點(diǎn)贊+收藏+關(guān)注）文章來(lái)源地址http://www.zghlxwxcb.cn/news/detail-449275.html
到了這里，關(guān)于Linux系統(tǒng)firewalld防火墻的應(yīng)用實(shí)操（對(duì)外端口開(kāi)放使用，對(duì)內(nèi)端口限制ip地址使用，不使用端口默認(rèn)關(guān)閉）的文章就介紹完了。如果您還想了解更多內(nèi)容，請(qǐng)?jiān)谟疑辖撬阉鱐OY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！
