Centos7 Firewall configuration application instance reference

Centos7 Firewall configuration application instance reference

For simple configuration, refer to learning:

-- When permanent is set to permanent, add this parameter at the beginning or end of the command. Otherwise, the setting becomes invalid after the firewall is reloaded or restarted!

Open Port:

# Firewall-cmd -- zone = public -- add-port = 80/tcp -- permanent

# Firewall-cmd -- zone = public -- add-port = 22/tcp -- permanent

You can specify multiple At A Time:

# Firewall-cmd -- zone = public -- permanent -- add-port = 111/tcp -- add-port = 139/tcp -- add-port = 445/tcp

Firewall-cmd -- reload

View All opened ports:

# Firewall-cmd -- list-port

# Firewall-cmd -- zone = public -- list-ports

Enable disguise:

# Firewall-cmd [-- zone = zone] -- add-masquerade

# Firewall-cmd -- remove-masquerade

# Firewall-cmd -- query-masquerade

Add region interface:

# Firewall-cmd [-- zone = zone] -- add-interface = <interface>

# Firewall-cmd -- zone = public -- add-interface = eth0

List features of all enabled regions

Firewall-cmd -- list-all-zones

All features enabled in the output zone <zone>. If the region is omitted, information about the default region is displayed.

# Firewall-cmd -- zone = public -- list-all

Enable a service:

Firewall-cmd -- add-service = http

Firewall-cmd -- add-service = vnc-server

# Firewall-cmd -- zone = public -- add-service = nfs -- add-service = samba-client -- permanent

Firewall-cmd -- remove-service = service remove a service

Query: firewall-cmd -- list-service

NAT address translation:

Firewall-cmd [-- zone = <zone>] -- add-forward-port = <port> [-<port>]: proto = <protocol> {: toport = <port> [-<port>] |: toaddr = <address> |: toport = <port> [-<port>]: toaddr = <address>}

IP port forwarding:

# Firewall-cmd -- add-forward-port = 222: proto = tcp: toport = 333: toaddr = 192.168.1.100

Local forwarding:

# Firewall-cmd -- add-forward-port = 9898: proto = tcp: toport = 8088: toaddr =

Success

Query:

# Firewall-cmd -- list-forward-port

# Firewall-cmd -- list-port

# Firewall-cmd -- list-all

Remove:

# Firewall-cmd -- remove-forward-port = 222: proto = tcp: toport = 333: toaddr =

# Firewall-cmd -- remove-forward-port = 222: proto = tcp: toport = 333: toaddr = 192.168.1.100

Graphical Configuration tool: # firewall-config

Custom rules:

/Sbin/iptables-t filter-I INPUT_direct 2-s 192.168.1.1-p tcp -- dport = 22-j DROP

Usage: -- direct -- add-rule {ipv4 | ipv6 | eb} <table> <chain> <priority> <args>

# Firewall-cmd -- permanent -- direct -- add-rule ipv4 filter INPUT 1-s 192.168.1.0/24-p tcp -- dport = 22-j ACCEPT

# Firewall-cmd -- permanent -- direct -- add-rule ipv4 filter INPUT 2-p tcp -- dport = 22-j DROP

# Firewall-cmd -- reload

# Firewall-cmd -- direct -- get-all-rules

Ipv4 filter INPUT 1-s 192.168.1.0/24-p tcp -- dport = 22-j ACCEPT

Ipv4 filter INPUT 2-p tcp -- dport = 22-j DROP

Official reference