查看服务状态/刷新规则使生效:
systemctl status firewalld / service firewalld restart firewall-cmd --reload
永久打开端口:
firewall-cmd --add-port=8080/tcp --permanent
firewall-cmd --add-port=5000-5100/tcp --permanent
firewall-cmd --add-port={110/tcp,143/tcp} --permanent
firewall-cmd --add-service=smtp --permanent
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="127.0.0.1" port protocol="tcp" port="8000" accept"
#对指定远程IP地址127.0.0.1打开8000端口
永久禁止:
firewall-cmd --permanent --add-rich-rule="rule family=ipv4 source address='x.x.x.x/24' service name='ssh' drop"
列出所有的內容:
firewall-cmd --list-all-zones firewall-cmd --list-all
永久删除HTTP服务端口:
firewall-cmd --zone=public --permanent --remove-service=http
firewall-cmd --zone=public --permanent --remove-port=80/tcp
firewall-cmd --permanent --remove-rich-rule="rule family="ipv4" source address="127.0.0.1" port protocol="tcp" port="8000" accept"
端口转发:
firewall-cmd --permanent --add-forward-port=port=80:proto=tcp:toport=8080:toaddr=192.0.2.55 firewall-cmd --permanent --add-masquerade
转发和伪装(需要转发的网卡wg0,ip:10.200.200.1):
firewall-cmd --permanent --direct --add-rule ipv4 filter FORWARD 0 -i wg0 -o eth0 -j ACCEPT firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.200.200.1/24 masquerade'