一、防火墙服务
systemctl start firewalld.service #启动
systemctl stop firewalld.service #关闭
systemctl restart firewalldservice #重启
systemctl status firewalld.service #显示防火墙的状态
systemctl enable firewalld.service #开机时启动
systemctl disable firewalldservice #开机时禁用
systemctlis-enabled firewalldservice #查看防火墙是否开机启动
systemctl list-unit-files/grep enabled #查看已启动的服务列表
systemctl--failed #查看启动失败的服务列表
二、防火墙配置
firewall-cmd --version
firewall-cmd --help
firewall-cmd --state
firewall-cmd --zone=public --list-ports #查看所有打开的端口
firewall-cmd --get-active-zones #查看区域信息
firewall-cmd -get-zone-of-interface=eth0 #查看指定接口所属区域
firewall-cmd --panic-on #拒绝所有包、取消拒绝状态、查看是否拒绝
firewall-cmd --panic-off
firewall-cmd -query-panic
firewall-cmd--zone=public --add-port=3306/tcp --permanent #开启3306端口，-permanent永久生效(区域public)
firewall-cmd --add-port=65001-65010/tcp --permanent #永久增加65001-65010例外(全局)
firewall-cmd--reload
firewall-cmd --zone=public -queryport=3306/tcp #查看3306端口是否开放
firewall-cmd --zone=public --removeport=3306/tcp --permanent #删除3306端口配置
三、配置文件
[root]# vi /etc/firewalld/zones/public.xml
<?xml version="1.0" encoding="utf-8"?>
<zone>
<short>Public</short>
<description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
<service name="ssh"/>
<service name="dhcpv6-client"/>
<service name="cockpit"/>
<port port="8080" protocol="tcp"/>
<port port="8443" protocol="tcp"/>
<port port="8175" protocol="tcp"/>
<rule family="ipv4">
<source address="123.x.x.14"/>
<port protocol="tcp" port="10050-10051"/> ##可以开放端口地址范围"10050-10051"，不单只限定一个端口
<accept/>
</rule>
<rule family="ipv4">
<source address="192.x.x.114"/> ##放通指定ip，指定端口、协议
<port protocol="tcp" port="80"/>
<accept/>
</rule>
<rule family="ipv4"> ##放通任意ip访问服务器的9527端口
<port protocol="tcp" port="9527"/>
<accept/>
</rule>
</zone>