Linux Learning Summary (26) Firewalld of firewall rules

One iptables regular backup

service iptables saveWill save the rules to/etc/sysconfig/iptables
Back up the iptables rule to the My.ipt file
Iptables-save > My.ipt
Restore the rules you just backed up
Iptables-restore < My.ipt

Two Firewalld

First we proceed to the previous experiment to close netfilter open Firewalld

systemctl  disable iptablessystemctl  stop  iptablessystemctl  enable firewalldsystemctl  start  firewalld

FIREWALLD has 9 zone
firewall-cmd --get-zonesView all Zone
Block DMZ drop external home internal public trusted work
Let's look at the exact meaning.

1 Setting the default zone
firewall-cmd --set-default-zone=work
2 View Zone
firewall-cmd --get-default-zoneView the default Zone
firewall-md --get-zone-of-interface=ens33Specify the network card to view the configured zone
firewall-cmd --get-active-zonesView the zone where all network cards are located
3 Configuring Zone
firewall-cmd --zone=public --add-interface=loSet zone for specified NIC
firewall-cmd --zone=dmz --change-interface=loChange zone for NIC
firewall-cmd --zone=dmz --remove-interface=loRemove zone for NIC
4 Service Concept:
For port, release service, Zone call
firewall-cmd --get-servicesSee all Servies
firewall-cmd --list-servicesSee what service is in the current zone
firewall-cmd --zone=public --add-service=httpAdd HTTP to the public zone
firewall-cmd --zone=pugblic --remove-service=httpDelete Service
ls /usr/lib/firewalld/zones/Zone configuration file Template
firewall-cmd --zone=public --add-service=http --permanentThe configuration file is changed and then the configuration file is generated under the/etc/firewalld/zones directory
5 Requirements: FTP Service custom port 1121, need to release FTP under work zone
cp /usr/lib/firewalld/services/ftp.xml /etc/firewalld/services
vi /etc/firewalld/services/ftp.xmlChange 21 to 1121
cp /usr/lib/firewalld/zones/work.xml /etc/firewalld/zones/
vi /etc/firewalld/zones/work.xmlAdd a row
<service name= "ftp"/>
firewall-cmd --reloadReload
firewall-cmd --zone=work --list-servicesSee if FTP is available under work

Summary
Release a service in two steps:

1. Copy the corresponding service template to the specified configuration file directory/etc/firewalld/services
   Templates are files that end in. xml, and the /usr/lib/firewalld/services/ following
   Edit the configuration file, modify the port number
2. Copy the corresponding zone template to the specified path/etc/firewalld/zones/
   Template path is /usr/lib/firewalld/zones/ lower
   Edit the configuration file to add the appropriate service name, for example <service name= "ftp"/>
3. Reload Service Firewall-cmd--reload

Linux Learning Summary (26) Firewalld of firewall rules