Firewall and iptables firewall services in Linux

Firewall
Firewall-cmd--state View the state of the firewall
Firewall-cmd--get-active-zones is currently located in the domain
Firewall-cmd--get-default-zone Viewing the default domain
Firewall-cmd--get-zones View All domains

Fiewall-cmd--zone=public---list-all View specific information in this domain pubic

Firewall-cmd--get-services View the services you can add
Firewall-cmd--list-all-zones View specific information for all domains
Experiment Ji
Firewall-cmd--set-default-zone=public Set Default domain to Punblic

Firewall-cmd--add-source=172.25.254.203-zone=trusted this time for 172.25.254.203 domain as trusted is full trust
Firewall-cmd--remove-source=172.25.254.203--zone=trusted Remove this setting

First create a new network card, configured as a different network segment of the IP new interface eth1
Firewall-cmd--remve-interface-eth1--zone=public Remove the default public domain of the new NIC
Firewall-cmd--add-intreface=eth1--zone=trusted Set the eth1 domain to trusted
Firewall-cmd--get-active-zones look at the current domain, you will find two

/ETC/FIREWALLD system default settings, can be modified
/LIB/FIREWALLD system all settings Firewall-cmd--permanent--add-port=8080/tcp
Firewall-cmd--add-service=http
can also
Vim/etc/firewalld/zones/public.xml settings
and XML depends on the settings of the current domain.

Any modification in that way requires overloading.
Firewall-cmd--reload to complete the current task after overloading

Firewall-cmd--complete-reload Terminate current task and reload
-----------------------
Three-table five-chain
Firewall-cmd--direct--remove-rule IPv4 filter INPUT 2-s 172.25.254.204-p tcp--dport 22-j ACCEPT
Firewall-cmd--direct--add-rule IPv4 filter INPUT 2! -S 172.25.254.204-p TCP--deport 22-j ACCEPT address translation Firewall-cmd--add-forward-port=port=22:proto=tcp:toport=22:toaddr= 172.25.254.125

Firewall-cmd--add-masquerade

Firewall-cmd--list-all

Firewall-cmd--add-masquerade
Firewall-cmd--add-rich-rule= "rule Family=ipv4 source address=172.25.254.103 Masquerade

Vim/etc/sysctl.conf

Net.ipv4.ip_forward=1

Client

Set IP to 192.168.0.3, Gateway to 192.168.0.103

On the client connection via SSH 172.25.254.3, view login 172.25.254.3 user is 172.25.254.103

Firewall-cmd--add-icmp=block=echo-request timeout=10

-----------------

Iptables

IPTABLES-NL Display Policy
Iptables-f Purge Policy

Iptables-a input-i lo-j ACCEPT

Iptables-a input-i lo-j ACCEPT

Iptables-a input-s 172.25.254.250-j ACCEPT # #添加

Iptables-i INPUT 2-s 172.25.254.250-p tcp--dport 22-j ACCEPT # #插入

Iptables-r INPUT 2-s 172.25.254.250-p tcp--dport 22-j DROP # #修改

iptables-d INPUT 2 # #删除

Iptables-p INPUT DROP # #修改默认策略

Iptables-p INPUT DROP

Iptables-a input-m State--state related,established-j ACCEPT # #访问过的, Access can be accessed
Iptables-a input-i lo-m State--state new-j ACCEPT # #接受访问本地回环网络
Iptables-a input-p tcp-m State--state new-m TCP--dport 22-j ACCEPT # #接受访问22端口
Iptables-a input-p tcp-m State--state new-m TCP--dport 80-j ACCEPT # #接受访问80端口
Iptables-a input-p tcp-m State--state new-m TCP--dport 53-j ACCEPT # #接受访问53端口
Iptables-a input-j REJECT # #拒绝其他访问

Create a new chain

Iptables-n Westos

Change the chain name

IPTABLES-E Westos HELLO

Delete Chain

Iptables-x HELLO

Firewall and iptables firewall services in Linux