Centos7防火墙配置详解( 三 ) _防火墙

02-2
service的相关指令
打印所有预定义的service（
/usr/lib/firewalld/services或/etc/firewalld/services下每个xml配置文件就是一个预定义的service）：
firewall-cmd [--permanent] --get-services列出此zone开启的服务列表：
firewall-cmd [--permanent] [--zone=zone] [--permanent] [--policy=policy] --list-services将一个service添加到一个zone，timeout可以为这个zone设置这个service的生效时间，过了这个生效时间，此service将从该zone中被移除。–timeout参数和–permanent参数是不兼容的
firewall-cmd [--permanent] [--zone=zone] [--permanent] [--policy=policy] --add-service=service [--timeout=timeval]

03、ipset的概念
ipset，顾名思义，就是可用于将多个IP或mac地址分组在一起。通过使用ipset，可以将不同的ip地址进行分组，简化ip地址的管理和zone的配置。ipset的配置文件在/etc/firewalld/ipsets目录下，该目录下一个xml配置文件对应一个ipset 。
03-1
ipset配置文件
例如，将以下ip地址组合为一个ipset，配置文件命名为ipset1.xml：
<?xml version="1.0" encoding="utf-8"?><ipset type="hash:net"><entry>10.12.18.201</entry><entry>192.168.5.201</entry></ipset>将以下mac地址组合为一个ipset，配置文件命名为ipset2.xml：
<?xml version="1.0" encoding="utf-8"?><ipset type="hash:mac"><entry>00:11:22:33:44:55</entry><entry>11:22:33:44:55:66</entry></ipset>在public.xml中引用这两个ipset：
<?xml version="1.0" encoding="utf-8"?><zone><short>Public</short><description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description><source ipset="ipset1" /><source ipset="ipset2" /><service name="dhcpv6-client"/><service name="ssh"/><rule family="ipv4"><source ipset="ipset1" /><port port="3306" protocol="tcp" /><accept /></rule><rule family="ipv4"><source ipset="ipset2" /><port port="8080" protocol="tcp" /><accept /></rule></zone>这等同于：
<?xml version="1.0" encoding="utf-8"?><zone><short>Public</short><description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description><source address="10.12.18.201" /><source address="192.168.5.201" /><source mac="00:11:22:33:44:55" /><source mac="11:22:33:44:55:66" /><service name="dhcpv6-client"/><service name="ssh"/><rule family="ipv4"><source address="10.12.18.201" /><port port="3306" protocol="tcp" /><accept /></rule><rule family="ipv4"><source address="192.168.5.201" /><port port="3306" protocol="tcp" /><accept /></rule><rule family="ipv4"><source mac="00:11:22:33:44:55" /><port port="8080" protocol="tcp" /><accept /></rule><rule family="ipv4"><source mac="11:22:33:44:55:66" /><port port="8080" protocol="tcp" /><accept /></rule></zone>显然，采用ipset可以极大简化配置。
04、简单实战案例：
04-1
查看firewalld
firewall-cmd --state04-2
启动关闭防火墙
#启动防火墙 systemctl start firewalld#重启防火墙systemctl restart firewalld 或 systemctl reload firewalld#关闭systemctl stop firewalld#设置开机自启动防火墙systemctl enable firewalld.service#查看防火墙设置开机自启是否成功systemctl is-enabled firewalld.service