1
2
3
4

systemctl stop firewalld
systemctl disable firewalld

firewall-cmd --reload       # 如果是 --permanent 持久化规则, 则还需要reload一次

1
2
3
4
5
6
7
8

firewall-cmd --state                # 查询运行状态

firewall-cmd --get-zone-of-interface=eth0               # 查看接口所属区域
firewall-cmd --get-default-zone                         # 获取默认区域
firewall-cmd --get-active-zones                         # 获取活动的区域
firewall-cmd --permanent --zone=public --get-target     # 获取此区域的默认动作

firewall-cmd --zone=public --list-all   # 获取全部规则

1
2
3
4
5
6
7
8
9

firewall-cmd --zone=public --add-port=80/tcp --permanent
firewall-cmd --zone=public --add-port=100-500/tcp           # 临时添加端口范围

firewall-cmd --zone=work --add-source=10.2.1.200

# 更换网卡所匹配的区域
firewall-cmd --zone=drop --change-interface=eth0

firewall-cmd --set-default-zone=drop

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

# 列出高级规则
firewall-cmd --list-rich-rules

# 添加细化的规则
firewall-cmd --zone=public --permanent --add-rich-rule 'rule family="ipv4" source address=10.27.10.181 port port=26379 protocol=tcp accept'

firewall-cmd --zone=public --permanent --remove-rich-rule='rule family="ipv4" source address="10.27.10.0/24" port port="22" protocol="tcp" accept'

# 添加某个网段的访问策略
firewall-cmd --zone=drop --permanent --add-rich-rule 'rule family="ipv4" source address=10.27.10.0/24 port port=9001 protocol=tcp accept'

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

firewall-cmd --zone=public  --remove-service=ssh
firewall-cmd --zone=public  --remove-service=ssh --permanent
firewall-cmd --zone=public  --remove-service=dhcpv6-client --permanent
firewall-cmd --zone=public  --remove-service=cockpit --permanent

firewall-cmd --zone=public  --add-icmp-block=echo-request
firewall-cmd --zone=public  --add-icmp-block=echo-reply

firewall-cmd --permanent --zone=trusted --add-source=10.2.2.0/24
firewall-cmd --permanent --zone=trusted --add-source=10.3.0.1/32
firewall-cmd --permanent --zone=trusted --add-source=192.168.0.175/32

firewall-cmd --permanent --zone=trusted --remove-source=192.168.0.175/24
firewall-cmd --permanent --zone=trusted --remove-source=10.2.1.5/32

firewall-cmd --permanent --zone=trusted --remove-source=192.168.0.175/32

firewall-cmd --zone=trusted --list-all

1
2
3
4
5
6

iptables-save > conf                    # 持久化配置
iptables-restore < conf                 # 恢复配置

iptables -L -n --line-number       # 查看规则
iptables -L -n                     # 查看规则
iptables -t nat -nL                # 查看转发表规则

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

iptables -D INPUT 6                     # 删除规则

iptables -I INPUT -p tcp --dport 17105 -j DROP      # 拒绝
iptables -I INPUT -p tcp --dport 8080 -j ACCEPT     # 允许

# 多端口
iptables -I INPUT -p tcp -m multiport --destination-ports 2022,20022 -s 10.1.136.43 -j ACCEPT -m comment --comment 'local network'


# 允许单个IP
iptables -I INPUT -p tcp --dport 9092 -s 10.24.10.100 -j ACCEPT -m comment --comment 'log app'

# IP范围
iptables -A INPUT -p tcp --dport 22 -m iprange --src-range 10.255.246.53-10.255.246.57 -j ACCEPT -m comment --comment 'ssh manager'

# 允许网段
iptables -I INPUT -p tcp --dport 9092 -s 10.24.10.0/24 -j ACCEPT -m comment --comment 'log app'

# 记录日志
iptables  -I cali-tw-cali03efd0d9a4d -s 10.20.4.241 -j LOG --log-prefix "test-2"
iptables  -D cali-tw-cali03efd0d9a4d -s 10.20.4.241 -j LOG --log-prefix "test-2"

1
2
3
4
5

# 拒绝某IP
iptables -t mangle -I PREROUTING -s 114.254.171.148 -j DROP
iptables -t raw -I PREROUTING -p tcp -m tcp --dport 80 -j DROP

iptables -t mangle -I PREROUTING -D 1

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

cat /etc/sysconfig/iptables

sysctl -a | grep ip_conntrack_max
cat /proc/sys/net/ipv4/netfilter/ip_conntrack_count

wc -l /proc/net/ip_conntrack

awk '{print $3}' /proc/net/ip_conntrack | sort -n | head

echo 'net.ipv4.ip_conntrack_max = 1024000' >> /etc/sysctl.conf
echo 'net.ipv4.netfilter.ip_conntrack_max = 1024000' >> /etc/sysctl.conf

sysctl -p

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

cat /etc/sysconfig/iptables

sysctl -a | grep net.nf_conntrack_max
wc -l /proc/net/nf_conntrack
cat /proc/sys/net/netfilter/nf_conntrack_count

echo 'net.nf_conntrack_max = 1024000' >>  /etc/sysctl.conf
echo 'net.netfilter.nf_conntrack_max = 1024000' >> /etc/sysctl.conf

sysctl -p

1
2
3
4
5
6
7
8
9

# 80 端口转 8080
iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to:8088

sysctl -w net.ipv4.ip_forward=1

# 清空nat表
iptables -F -t nat