firewalld - CentOS 7 的動態防火牆

如同先前在 [完全用 GNU/Linux 工作] 07. 簡易的防火牆一文提到，Ubuntu 從 8.04 LTS 開始多了 ufw 這個簡單的防火牆，CentOS 也在 7.0 導入可以動態管理防火牆的 firewalld。Weithenn 前輩的 CentOS 7.3 基礎設定 (10) - 調整 Firewalld 防火牆規則一文很好的解說了 firewalld 與 iptables 的差異，想深入了解的伙伴不妨參考一下。

firewalld 還有個跟 Windows 7 類似的網路共用設定機制，在官方文件中是使用界域 ¹ (zone) 來敘述這項依據不同環境所設計的網路區域功能。我們可以藉由在各種不同的 zone 進行設置，來達到公開網域 (public network zone) 不開 ssh 埠口，而內部網域 (internal network zone) 則允許等較複雜的信任等級配置。這部份凍仁還未深入研究，在此就不多加說明。

1. 安裝與初始化

[ jonny@CentOS ~ ]
$ sudo yum install firewalld [Enter]

[ jonny@CentOS ~ ]
$ systemctl status firewalld [Enter]

● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
   Active: active (running) since Sun 2017-09-24 09:03:55 UTC; 14min ago
     Docs: man:firewalld(1)
 Main PID: 4376 (firewalld)
   CGroup: /system.slice/firewalld.service
           └─4376 /usr/bin/python -Es /usr/sbin/firewalld –nofork –nopid 

[ jonny@CentOS ~ ]
$ sudo systemctl start firewalld [Enter]

[ jonny@CentOS ~ ]
$ sudo systemctl enable firewalld [Enter]

Created symlink from /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service to /usr/lib/systemd/system/firewalld.service.
Created symlink from /etc/systemd/system/basic.target.wants/firewalld.service to /usr/lib/systemd/system/firewalld.service.

2. 基礎操作

[ jonny@CentOS ~ ]
$ sudo firewall-cmd –state [Enter]
running

[ jonny@CentOS ~ ]
$ sudo firewall-cmd –add-service=http –permanent [Enter]
success

[ jonny@CentOS ~ ]
$ sudo firewall-cmd –add-port=10050/tcp –permanent [Enter]
success

[ jonny@CentOS ~ ]
$ sudo firewall-cmd –remove-service=dhcpv6-client <br />    –permanent [Enter]
success

[ jonny@CentOS ~ ]
$ sudo firewall-cmd –remove-port=10050/tcp –permanent [Enter]
success

[ jonny@CentOS ~ ]
$ sudo firewall-cmd –reload [Enter]
success

[ jonny@CentOS ~ ]
$ sudo firewall-cmd –list-all [Enter]
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: enp0s3
  sources:
  services: http ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  sourceports:
  icmp-blocks:
  rich rules:

3. 進階使用

3.1. 允許 (accept) 特定 IP 連線

[ jonny@CentOS ~ ]
$ sudo firewall-cmd –add-rich-rule ‘rule family=“ipv4” <br />    source address=”192.168.1.²⁄₃₂” accept’ –permanent [Enter]

[ jonny@CentOS ~ ]
$ sudo firewall-cmd –add-rich-rule ‘rule family=“ipv4” <br />    source address=”192.168.2.0/24” service name=”ssh” accept’ <br />   –permanent [Enter]

3.2. 拒絕 (reject) 或阻擋 (drop) 特定 IP 連線

[ jonny@CentOS ~ ]
$ sudo firewall-cmd –add-rich-rule ‘rule <br />    family=“ipv4” source address=”110.88.4.⁵⁄₃₂” reject’ <br />    –permanent [Enter]

[ jonny@CentOS ~ ]
$ sudo firewall-cmd –add-rich-rule ‘rule <br />    family=“ipv4” source address=”27.16.3.0/24” port port=”22” <br />    drop’ –permanent [Enter]

3.3. 允許特定埠口連線

[ jonny@CentOS ~ ]
$ sudo firewall-cmd –add-port=32700-33000/tcp –permanent [Enter]

3.4. 圖形化介面

[ jonny@CentOS ~ ]
$ sudo yum install firewall-config [Enter]