备份iptables,firewalld有关zone,service的操作

保存和备份iptables规则

• service iptables save //会把规则保存到配置文件/etc/sysconfig/iptables，开机启动的规则
• iptables-save > /tmp/my.ipt //把iptables规则备份到my.ipt文件中
• iptables-restore < /tmp/my.ipt //恢复备份的规则
  • service iptables save 保存恢复的规则

firewalld的9个zone

• 打开firewalld
  • systemctl disable iptables
  • systemctl stop iptables
  • systemctl enable firewalld
  • systemctl start firewalld
• firewalld默认有9个zone,每个zone是一个规则集
• 默认的zone为pulic
• firewall-cmd --get-zones //查看所有zone

  [root@akuilinux02 ~]# firewall-cmd --get-zones
  block dmz drop external home internal public trusted work

• firewall-cmd --get-default-zone//查看默认zone

  [root@akuilinux02 ~]# firewall-cmd --get-default-zone
  public

• 9种zone解释
  • drop(丢弃)，任何接收的网络数据包都被丢弃，没有任何回复, 仅能有发送出去的网络连接
  • block(限制)，任何接收的网络连接都被IPv4的icmp-host-prohibited信息和IPv6的icmp6-dam-prohibited信息所拒绝
  • pulic(公共)在公共区域内使用,不能相信网络内的其他计算机不会对你的计算机造成危害,只能接收经过选取的连接
  • external(外部)特别是为路由器启用了伪装功能的外部网。你不能信任来自网络的其他计算机,不能相信它们不会对你的计算机造成危害,只能接收经过选择的连接
  • dmz(非军事区)用于你的非军事区内的电脑，此区域内可公开访问,可以有限的进入你的内部网络,仅仅接收经过选择的连接
  • work(工作)用于工作区，你可以基本相信网络内的其他计算机不会危害你的电脑,仅仅接收经过选择的连接
  • home（家庭）用于家庭网络，你可以基本信任网络内的其他计算机不会危害你的计算机,仅仅接收经过选择的连接
  • trusted(信任)可接收所有的网络连接

关于zone的操作

• firewall-cmd --set-default-zone=work //设定默认zone

  [root@akuilinux02 ~]# firewall-cmd --set-default-zone=work
  success

• firewall-cmd --get-zone-of-interface=ens33 //查指定网卡

  [root@akuilinux02 ~]# firewall-cmd --get-zone-of-interface=ens33
  work
  [root@akuilinux02 ~]# firewall-cmd --get-zone-of-interface=ens37
  work
  [root@akuilinux02 ~]# firewall-cmd --get-zone-of-interface=lo
  no zone
  [root@akuilinux02 ~]# systemctl restart firewalld
  [root@akuilinux02 ~]# firewall-cmd --get-zone-of-interface=ens37
  work
  [root@akuilinux02 ~]# firewall-cmd --get-zone-of-interface=lo
  no zone

• firewall-cmd --zone=public --add-interface=lo //给指定网卡设置zone

  [root@akuilinux02 ~]# firewall-cmd --zone=dmz --add-interface=ens37
  The interface is under control of NetworkManager, setting zone to 'dmz'.
  success
  [root@akuilinux02 ~]# firewall-cmd --get-zone-of-interface=ens37
  dmz
  [root@akuilinux02 ~]# firewall-cmd --zone=public --add-interface=lo
  success
  [root@akuilinux02 ~]# firewall-cmd --get-zone-of-interface=lo
  public

• firewall-cmd --zone=dmz --change-interface=lo //针对网卡更改zone

  [root@akuilinux02 ~]# firewall-cmd --zone=block --change-interface=ens37
  The interface is under control of NetworkManager, setting zone to 'block'.
  success
  [root@akuilinux02 ~]# firewall-cmd --get-zone-of-interface=ens37
  block

• firewall-cmd --zone=dmz --remove-interface=lo //针对网卡删除zone

  [root@akuilinux02 ~]# firewall-cmd --zone=block --remove-interface=ens37
  The interface is under control of NetworkManager, setting zone to default.
  success
  [root@akuilinux02 ~]# firewall-cmd --get-zone-of-interface=ens37
  work

• firewall-cmd --get-active-zones //查看系统所有网卡所在的zone

  [root@akuilinux02 ~]# firewall-cmd --get-active-zones
  work
  interfaces: ens33 ens37
  public
  interfaces: lo

  [root@aminglinux-02 ~]# firewall-cmd --get-zone-of-interface=ens37
  no zone  
  没有zone需要手动设置网卡配置文件并重启网卡和重启firewwalld服务

firewalld有关service的操作

• service是zone下面的子单元，指定的端口
• firewall-cmd --get-services 查看它支持的所有的servies

  [root@akuilinux02 ~]# firewall-cmd --get-services
  RH-Satellite-6 amanda-client amanda-k5-client bacula bacula-client bitcoin bitcoin-rpc bitcoin-testnet bitcoin-testnet-rpc ceph ceph-mon cfengine condor-collector ctdb dhcp dhcpv6 dhcpv6-client dns docker-registry dropbox-lansync elasticsearch freeipa-ldap freeipa-ldaps freeipa-replication freeipa-trust ftp ganglia-client ganglia-master high-availability http https imap imaps ipp ipp-client ipsec iscsi-target kadmin kerberos kibana klogin kpasswd kshell ldap ldaps libvirt libvirt-tls managesieve mdns mosh mountd ms-wbt mssql mysql nfs nrpe ntp open*** ovirt-imageio ovirt-storageconsole ovirt-vmconsole pmcd pmproxy pmwebapi pmwebapis pop3 pop3s postgresql privoxy proxy-dhcp ptp pulseaudio puppetmaster quassel radius rpc-bind rsh rsyncd samba samba-client sane sip sips smtp smtp-submission smtps snmp snmptrap spideroak-lansync squid ssh synergy syslog syslog-tls telnet tftp tftp-client tinc tor-socks transmission-client vdsm vnc-server wbem-https xmpp-bosh xmpp-client xmpp-local xmpp-server

• firewall-cmd --list-services //查看当前zone下有哪些service

  [root@akuilinux02 ~]# firewall-cmd --get-default-zone
  work
  [root@akuilinux02 ~]# firewall-cmd --list-services
  ssh dhcpv6-client

• firewall-cmd --zone=work --list-services //查看指定zone下的service

  [root@akuilinux02 ~]# firewall-cmd --zone=public --list-services
  ssh dhcpv6-client
  [root@akuilinux02 ~]# firewall-cmd --zone=block --list-services
  [root@akuilinux02 ~]# firewall-cmd --zone=trusted --list-services
  这两个下面都没有service

• firewall-cmd --zone=public --add-service=http //把http增加到public zone下面,这个是临时增加

  [root@akuilinux02 ~]# firewall-cmd --zone=public --add-service=http
  success
  [root@akuilinux02 ~]# firewall-cmd --zone=public --list-services
  ssh dhcpv6-client http
  [root@akuilinux02 ~]# firewall-cmd --zone=public --add-service=ftp
  success
  [root@akuilinux02 ~]# firewall-cmd --zone=public --list-services
  ssh dhcpv6-client http ftp

• firewall-cmd --zone=public --remove-service=http //移除
• firewall-cmd --zone=public --add-service=http --permanent //更改配置文件，之后会在/etc/firewalld/zones目录下面生成配置文件,永久增

  [root@akuilinux02 ~]# firewall-cmd --zone=public --add-service=http --permanent
  success
  [root@akuilinux02 ~]# ls /etc/firewalld/zones/public.xml
  /etc/firewalld/zones/public.xml
  [root@akuilinux02 ~]# cat !$
  cat /etc/firewalld/zones/public.xml
  
  
  Public
  For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.
  
  
  
  
  [root@akuilinux02 ~]# firewall-cmd --zone=public --add-service=ftp --permanent
  success
  [root@akuilinux02 ~]# cat /etc/firewalld/zones/public.xml
  
  
  Public
  For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.
  
  
  
  
  
  [root@akuilinux02 ~]# firewall-cmd --zone=public --list-services
  ssh dhcpv6-client http ftp
  [root@akuilinux02 ~]# ls /etc/firewalld/zones/
  public.xml  public.xml.old
  每改一次会把旧的备份

• ls /usr/lib/firewalld/zones/ //zone的配置文件模板

  [root@akuilinux02 ~]# ls /usr/lib/firewalld/zones/
  block.xml  dmz.xml  drop.xml  external.xml  home.xml  internal.xml  public.xml  trusted.xml  work.xml
  [root@akuilinux02 ~]# ls /usr/lib/firewalld/services/
  amanda-client.xml        dropbox-lansync.xml      kadmin.xml       nrpe.xml                  quassel.xml            ssh.xml
  amanda-k5-client.xml     elasticsearch.xml        kerberos.xml     ntp.xml                   radius.xml             synergy.xml
  bacula-client.xml        freeipa-ldaps.xml        kibana.xml       open***.xml               RH-Satellite-6.xml     syslog-tls.xml
  bacula.xml               freeipa-ldap.xml         klogin.xml       ovirt-imageio.xml         rpc-bind.xml           syslog.xml
  bitcoin-rpc.xml          freeipa-replication.xml  kpasswd.xml      ovirt-storageconsole.xml  rsh.xml                telnet.xml
  bitcoin-testnet-rpc.xml  freeipa-trust.xml        kshell.xml       ovirt-vmconsole.xml       rsyncd.xml             tftp-client.xml
  bitcoin-testnet.xml      ftp.xml                  ldaps.xml        pmcd.xml                  samba-client.xml       tftp.xml
  bitcoin.xml              ganglia-client.xml       ldap.xml         pmproxy.xml               samba.xml              tinc.xml
  ceph-mon.xml             ganglia-master.xml       libvirt-tls.xml  pmwebapis.xml             sane.xml               tor-socks.xml
  ceph.xml                 high-availability.xml    libvirt.xml      pmwebapi.xml              sips.xml               transmission-client.xml
  cfengine.xml             https.xml                managesieve.xml  pop3s.xml                 sip.xml                vdsm.xml
  condor-collector.xml     http.xml                 mdns.xml         pop3.xml                  smtp-submission.xml    vnc-server.xml
  ctdb.xml                 imaps.xml                mosh.xml         postgresql.xml            smtps.xml              wbem-https.xml
  dhcpv6-client.xml        imap.xml                 mountd.xml       privoxy.xml               smtp.xml               xmpp-bosh.xml
  dhcpv6.xml               ipp-client.xml           mssql.xml        proxy-dhcp.xml            snmptrap.xml           xmpp-client.xml
  dhcp.xml                 ipp.xml                  ms-wbt.xml       ptp.xml                   snmp.xml               xmpp-local.xml
  dns.xml                  ipsec.xml                mysql.xml        pulseaudio.xml            spideroak-lansync.xml  xmpp-server.xml
  docker-registry.xml      iscsi-target.xml         nfs.xml          puppetmaster.xml          squid.xml

• 需求：ftp服务自定义端口1121，需要在work zone下面放行ftp
  • cp /usr/lib/firewalld/services/ftp.xml /etc/firewalld/services //拷贝service模板
  • vi /etc/firewalld/services/ftp.xml //把21改为1121

    [root@akuilinux02 ~]# vim /etc/firewalld/services/ftp.xml 
    
    
    FTP
    FTP is a protocol used for remote file transfer. If you plan to make your FTP server publicly available, enable this option. You need the vsftpd package installed for this option to be useful.
    
    

  • cp /usr/lib/firewalld/zones/work.xml /etc/firewalld/zones/ //拷贝zone模板
  • vi /etc/firewalld/zones/work.xml //增加一行,

    [root@akuilinux02 ~]# vim /etc/firewalld/zones/work.xml 
    
    
    Work
    For use in work areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.
    
    
    
    

  • firewall-cmd --reload //重新加载
  • firewall-cmd --zone=work --list-services

    [root@akuilinux02 ~]# firewall-cmd --reload
    success
    [root@akuilinux02 ~]# firewall-cmd --zone=work --list-services
    ssh ftp dhcpv6-client