CentOS 7 firewall setting example

Source: Internet
Author: User

How to check firewall rules in centos 7

CentOS 7 firewall setting example
CentOS 7 firewall setting example
Centos 7 firewall commands
Assume that the firewall ports of postgres, pcsd, and corosync (which are components of a PostgreSQL HA cluster) need to be opened on CentOS 7. The following is the execution process.
Centos 7 firewall cmd
Ipvs: 5432/tcp
Pcsd: 2224/tcp
Corosync: 5405/udp
5432 is the default port of postgrs and is easy to detect. We recommend that you change it to a non-default port.
How to open firewall in centos 7
There are two network devices on the machine. One is the Intranet and the other is the Internet. By default, both network devices are bound to the public area.
Turn on firewall centos 7
[root@node1 ~]# firewall-cmd  --list-allpublic (default, active)  interfaces: eno16777736 eno33554984  sources:   services: dhcpv6-client ssh  ports:   masquerade: no  forward-ports:   icmp-blocks: echo-reply  rich rules: 
Now we need to open the ports required by the PostgreSQL HA cluster on the Intranet. The above eno33554984 is the internal network, first move it to the internal area
Enable port firewall centos 7
firewall-cmd  --zone=internal --change-interface=eno33554984 
Add "ZONE = internal" to the ifcfg file to make it take effect permanently.

echo "ZONE=internal" >> /etc/sysconfig/network-scripts/ifcfg-eno33554984 
Enable PostgreSQL, pcsd, and corosync ports.

firewall-cmd  --permanent --zone=internal --add-port=5432/tcpfirewall-cmd  --permanent --zone=internal --add-port=2224/tcpfirewall-cmd  --permanent --zone=internal --add-port=5405/udpfirewall-cmd  --reload[root@node1 ~]# firewall-cmd  --list-all --zone=internalinternal (active)  interfaces: eno33554984  sources:   services: dhcpv6-client ipp-client mdns samba-client ssh  ports: 5432/tcp 2224/tcp 5405/udp  masquerade: no  forward-ports:   icmp-blocks:   rich rules: 
You need to open the ipvs port on the public network to access a specific machine (for example, 192.168.0.213, of course, this address is false), you can use rich-rule.

firewall-cmd --permanent --zone=public --add-rich-rule="rule family=ipv4 source address=192.168.0.213/32 port protocol="tcp" port="5432" accept"firewall-cmd  --reload

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.