Introduction to CentOS 7 firewalld

Introduction to CentOS 7 firewalld
To learn how to install apache, open port 80. Since the firewalld is used by default after centos 7, the iptables setting method on the internet is no longer used, and the iptable will not be used anyway, simply move to the official document and learn firewalld. It seems easier than iptables. Official Document address: Firewall (system configuration, do not modify as much as possible) and/etc/firewalld/(user configuration address) zone Concept: hardware firewall generally has three zones by default, firewalld introduces this concept. By default, the system exists in the following areas (correct if any error occurs, as described in this document): drop: discards all packets by default. block: rejects all external connections, allow internal connection public: Specify external connection can enter external: This is not clear, the function is the same as above, allow the specified external connection dmz: The same as the hardware firewall, restricted public connections can enter the work: work zone. The concept is the same as workgoup. It is also a specified external connection. Allow home: similar to the home Group internal: trust all connections. Not too familiar with the firewall, I haven't figured out whether the functions of public, external, dmz, work, and home must be customized to allow connections, specific Use of the difference also need high Guidance 2, install firewalldroot execute # yum install firewalld firewall-config3, run, stop, disable firewalld start: # systemctl start firewalld view status: # systemctl status firewalld or firewall-cmd -- state stop: # systemctl disable firewalld disable: # systemctl stop firewalld4. Configure firewalld to view version: $ firewall-cmd -- version to view help: $ firewall-cmd -- help view settings: Display status: $ firewall-cmd -- state view region information: $ firewall-cmd -- get-active-zones view region of a specified interface: $ firewall-cmd -- get-zone-of-interface = eth0: reject all packages: # firewall-cmd -- panic-on: # firewall-cmd -- panic-off: $ firewall-cmd -- query-panic: # firewall-cmd -- reload # The difference between firewall-cmd -- complete-reload is that the first one does not need to be disconnected, that is, one of the firewalld features dynamically add rules, and the second one needs to be disconnected, it is similar to restarting a service to add interfaces to a region, the default interfaces are all in public # firewall-cmd -- zone = public -- add-interface = eth0, which takes effect permanently, plus -- permanent and reload the firewall to set the default interface region # firewall-cmd -- set-default -zone = public takes effect immediately. You do not need to restart and open the port (it seems that this is the most common) view All opened ports: # firewall-cmd -- zone = dmz -- list-ports Add a port to the region: # firewall-cmd -- zone = dmz -- add-port = 8080/tcp to take effect permanently. Open a service as above. Similar to visualize a port, the service must be added to the configuration file, the/etc/firewalld directory contains the services folder, which is not detailed, for details, refer to the document # firewall-cmd -- zone = work -- add-service = smtp remove service # firewall-cmd -- zone = work -- remove-service = smtp. It also has the port forwarding function, custom complex Rule Functions, lockdown, because I haven't used it yet, I will study it later.