CentOS7 debugging firewall/iptables

CentOS7 debugging firewall/iptables

CentOS7 replaced iptables with the firewall command. Here we need to distinguish between "iptables service" and "iptables command ". Although firewalld is an alternative to the provided firewall management iptables service, it still uses iptables to filter kernel command dynamic communication packets. Therefore, it is replaced by the iptables service instead of the iptables command.

To use the iptables service, run the following command:

systemctl stop firewalld systemctl disable firewalld yum install iptables-services touch /etc/sysconfig/iptables systemctl start iptables systemctl enable iptables touch /etc/sysconfig/ip6tables systemctl start ip6tables systemctl enable ip6table

To install firewalld and firewall-cmd, refer to link

Check the Firewall Status firewall-cmd --stat Temporarily open ftp service firewall-cmd --add-service=ftp Permanently open ftp service firewall-cmd --add-service=ftp --permanent Disable ftp service firewall-cmd --remove-service=ftp --permanent Configure the firewall to enable the http service permanently in the public area firewall-cmd --permanent --zone=public --add-service=http Add a specified Open Port firewall-cmd --add-port=1324/tcp To make the previous settings take effect, restart the service. systemctl restart firewalld Or use the following command to restart the Service (reload after firewall policy configuration) firewall-cmd --complete-reload Firewall-cmd -- reload (these two sentences have the same function) Check whether port 21 of the ftp service is open iptables -L -n | grep 21 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:21 ctstate NEW Query the ftp service activation status firewall-cmd --query-service ftp View current rule firewall-cmd --list-all Only some IP addresses are allowed to access the local service configuration. firewall-cmd --permanent --zone=public --add-rich-rule="rule family="ipv4" \ source address="192.168.0.4/24" service name="http" accept" Allow only some IP addresses to access the local port configuration firewall-cmd --permanent --zone=public --add-rich-rule="rule family="ipv4" \ source address="192.168.0.4/24" \ port protocol="tcp" port="8080" accept"

Public configuration file location:/etc/firewalld/zones/public. xml

More: http://oracle-base.com/articles/linux/linux-firewall-firewalld.php? Utm_source = tuicool