firewall防火墙
1、查看firewall服务状态
systemctl status firewalld
停防火墙：systemctl stop firewalld
启防火墙：systemctl start firewalld
重启防火墙：systemctl restart firewalld
出现Active: active (running)切高亮显示则表示是启动状态。
出现 Active: inactive (dead)灰色表示停止，看单词也行。
2、开放和限制端口，所有ip都能访问该端口
# 开放80端口
firewall-cmd --permanent --add-port=80/tcp
# 移除80端口
firewall-cmd --permanent --remove-port=80/tcp
# 加载生效：
firewall-cmd --reload
3、开放某段ip的一个端口
# 放开整个网段192.168.187.*的7001端口，限制整个网段192.168.187.*的7001端口
firewall-cmd --permanent --add-rich-rule="rule family=ipv4 source address=192.168.187.0/24 port protocol=tcp port=7001 accept"
# 回收整个网段的7001端口
firewall-cmd --permanent --remove-rich-rule="rule family=ipv4 source address=192.168.187.0/24 port port=7001 protocol=tcp accept"
# 加载生效：firewall-cmd --reload
4、某个ip的范围端口放开和回收，端口范围0-65535
#放开某个ip的范围端口
firewall-cmd --permanent --add-rich-rule="rule family=ipv4 source address=192.168.187.1 port protocol=tcp port=0-65535 accept"
#回收某个ip的范围端口
firewall-cmd --permanent --remove-rich-rule="rule family=ipv4 source address=192.168.187.1 port port=0-65535 protocol=tcp accept"
加载生效：firewall-cmd --reload
5、某段ip和范围端口放开和回收
#放开某个网段某段端口，7000-7002是端口范围
firewall-cmd --permanent --add-rich-rule="rule family=ipv4 source address=192.168.187.0/24 port protocol=tcp port=7000-7002 accept"
#回收某个网段某段端口
firewall-cmd --permanent --remove-rich-rule="rule family=ipv4 source address=192.168.187.0/24 port port=7000-7002 protocol=tcp accept"
1、查看firewall服务状态
systemctl status firewalld
停防火墙：systemctl stop firewalld
启防火墙：systemctl start firewalld
重启防火墙：systemctl restart firewalld
出现Active: active (running)切高亮显示则表示是启动状态。
出现 Active: inactive (dead)灰色表示停止，看单词也行。
2、开放和限制端口，所有ip都能访问该端口
# 开放80端口
firewall-cmd --permanent --add-port=80/tcp
# 移除80端口
firewall-cmd --permanent --remove-port=80/tcp
# 加载生效：
firewall-cmd --reload
3、开放某段ip的一个端口
# 放开整个网段192.168.187.*的7001端口，限制整个网段192.168.187.*的7001端口
firewall-cmd --permanent --add-rich-rule="rule family=ipv4 source address=192.168.187.0/24 port protocol=tcp port=7001 accept"
# 回收整个网段的7001端口
firewall-cmd --permanent --remove-rich-rule="rule family=ipv4 source address=192.168.187.0/24 port port=7001 protocol=tcp accept"
# 加载生效：firewall-cmd --reload
4、某个ip的范围端口放开和回收，端口范围0-65535
#放开某个ip的范围端口
firewall-cmd --permanent --add-rich-rule="rule family=ipv4 source address=192.168.187.1 port protocol=tcp port=0-65535 accept"
#回收某个ip的范围端口
firewall-cmd --permanent --remove-rich-rule="rule family=ipv4 source address=192.168.187.1 port port=0-65535 protocol=tcp accept"
加载生效：firewall-cmd --reload
5、某段ip和范围端口放开和回收
#放开某个网段某段端口，7000-7002是端口范围
firewall-cmd --permanent --add-rich-rule="rule family=ipv4 source address=192.168.187.0/24 port protocol=tcp port=7000-7002 accept"
#回收某个网段某段端口
firewall-cmd --permanent --remove-rich-rule="rule family=ipv4 source address=192.168.187.0/24 port port=7000-7002 protocol=tcp accept"
