2018-1-26 Linux Learning Notes

10.19 iptables Regular backup and recovery

• Save Iptalbes Rules
  Service Iptables Save//The rules will be saved to/etc/sysconfig/iptables
• Backing up iptalbes rules to the/tmp/my.ipt file
  Iptables-save >/tmp/my.ipt
• Iptalbes rules for recovering backups
  Iptables-restore </tmp/my.ipt

10.20 Firewalld 9 Zone

• To turn off NetFilter (iptables), open the Firewalld method:
  Systemctl Disable Iptables
  Systemctl Stop Iptables
  Systemctl Enable Firewalld
  Systemctl Start Firewalld

• Firewalld has 9 zones, default is public
  drop (Discard) : Any received packets are discarded without any reply. Only the network connections that are sent out can be available.
  block (limit) : Any received network connection is rejected by IPv4 icmp-host-prohibited information and IPv6 icmp-adm-prohibited information.
  public : used in a common area, you cannot trust that other computers within your network will not be harmful to your computer, and can only receive selected connections.
  External (external) : An extranet that specifically enables spoofing for routers. You cannot trust other computers that come from the network, and you cannot believe that they are not harmful to your computer, only receive selected connections.
  DMZ (demilitarized zone) : For computers in your demilitarized zone, this area is publicly accessible and can be limited to your internal network, receiving only selected connections.
  Work : For workspaces, you can basically trust that other computers within your network will not compromise your computer and only receive selected connections.
  Home (Home) : For home networking, you can basically trust that other computers within your network will not compromise your computer and only receive selected connections.
  Internal (internal) : For internal networks, you can basically trust other computers within your network to not compromise your computer, just accept selected connections.
  Trusted (trust) : All network connections are acceptable.
• Related commands:
  Firewall-cmd--get-zones//View all Zone
  Firewall-cmd--get-default-zone//view default Zone
  10.21 Firewalld About zone operation

  Firewall-cmd--set-default-zone=work//Set Default Zone
  Firewall-cmd--GET-ZONE-OF-INTERFACE=ENS33//view specified NIC
  Firewall-cmd--zone=public--add-interface=ens33//Set zone for specified NIC
  Firewall-cmd--ZONE=DMZ--change-interface=ens33//For changing zone
  Firewall-cmd--ZONE=DMZ--remove-interface=ens33//remove zone for NIC
  Firewall-cmd--get-active-zones//view the zone where all network cards are located
  

10.22 Firewalld about service operations

Firewall-cmd--get-services//View all services
Firewall-cmd--list-services//View what services are in the current zone
Firewall-cmd--zone=public--add-service=http//Add HTTP to the public zone
Firewall-cmd--zone=public--remove-service=http

Profile templates for Ls/usr/lib/firewalld/zones//zone

The Firewall-cmd--zone=public--add-service=http--permanent//Plus permanent option changes the configuration file and then generates the configuration file in the/etc/firewalld/zones directory.

Requirements: FTP Service custom port 1121, need to release FTP under work zone
cp/usr/lib/firewalld/services/ftp.xml/etc/firewalld/services/
Vi/etc/firewalld/services/ftp.xml//Change 21 to 1121
cp/usr/lib/firewalld/zones/work.xml/etc/firewalld/zones/
Vi/etc/firewalld/zones/work.xml//Add a line
<service name= "ftp"/>
Firewall-cmd--reload//Reload
Firewall-cmd--zone=work--list-services

2018-1-26 Linux Learning Notes