CentOS 7 firewall setting example

How to check firewall rules in centos 7

CentOS 7 firewall setting example
CentOS 7 firewall setting example
Centos 7 firewall commands
Assume that the firewall ports of postgres, pcsd, and corosync (which are components of a PostgreSQL HA cluster) need to be opened on CentOS 7. The following is the execution process.
Centos 7 firewall cmd
Ipvs: 5432/tcp
Pcsd: 2224/tcp
Corosync: 5405/udp
5432 is the default port of postgrs and is easy to detect. We recommend that you change it to a non-default port.
How to open firewall in centos 7
There are two network devices on the machine. One is the Intranet and the other is the Internet. By default, both network devices are bound to the public area.
Turn on firewall centos 7
[root@node1 ~]# firewall-cmd  --list-allpublic (default, active)  interfaces: eno16777736 eno33554984  sources:   services: dhcpv6-client ssh  ports:   masquerade: no  forward-ports:   icmp-blocks: echo-reply  rich rules: 
Now we need to open the ports required by the PostgreSQL HA cluster on the Intranet. The above eno33554984 is the internal network, first move it to the internal area
Enable port firewall centos 7
firewall-cmd  --zone=internal --change-interface=eno33554984 
Add "ZONE = internal" to the ifcfg file to make it take effect permanently.

echo "ZONE=internal" >> /etc/sysconfig/network-scripts/ifcfg-eno33554984 
Enable PostgreSQL, pcsd, and corosync ports.

firewall-cmd  --permanent --zone=internal --add-port=5432/tcpfirewall-cmd  --permanent --zone=internal --add-port=2224/tcpfirewall-cmd  --permanent --zone=internal --add-port=5405/udpfirewall-cmd  --reload[root@node1 ~]# firewall-cmd  --list-all --zone=internalinternal (active)  interfaces: eno33554984  sources:   services: dhcpv6-client ipp-client mdns samba-client ssh  ports: 5432/tcp 2224/tcp 5405/udp  masquerade: no  forward-ports:   icmp-blocks:   rich rules: 
You need to open the ipvs port on the public network to access a specific machine (for example, 192.168.0.213, of course, this address is false), you can use rich-rule.

firewall-cmd --permanent --zone=public --add-rich-rule="rule family=ipv4 source address=192.168.0.213/32 port protocol="tcp" port="5432" accept"firewall-cmd  --reload