firewall
- 查看firewall开放端口
firewall-cmd --list-ports复制代码
- 开启端口
firewall-cmd --zone=public --add-port=80/tcp --permanent复制代码
- 命令含义
–zone #作用域–add-port=80/tcp #添加端口，格式为：端口/通讯协议–permanent #永久生效，没有此参数重启后失效复制代码
- 重启防火墙
firewall-cmd --reload #重启firewallsystemctl stop firewalld.service #停止firewallsystemctl disable firewalld.service #禁止firewall开机启动复制代码
iptables
- 禁用/停止自带的firewalld服务
#停止firewalld服务systemctl stop firewalld#禁用firewalld服务systemctl mask firewalld复制代码
- 安装iptables防火墙
#安装yum install iptables-services复制代码
- 编辑防火墙配置文件
vi /etc/sysconfig/iptables复制代码
# sample configuration for iptables service# you can edit this manually or use system-config-firewall# please do not ask us to add additional ports/services to this default configuration*filter:INPUT ACCEPT [0:0]:FORWARD ACCEPT [0:0]:OUTPUT ACCEPT [0:0]-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT-A INPUT -p icmp -j ACCEPT-A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT-A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT-A INPUT -p tcp -m state --state NEW -m tcp --dport 20 -j ACCEPT-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT-A INPUT -m state --state NEW -m tcp -p tcp --dport 3306 -j ACCEPT-A INPUT -j REJECT --reject-with icmp-host-prohibited-A FORWARD -j REJECT --reject-with icmp-host-prohibitedCOMMIT#：wq！退出复制代码
- 设置
systemctl restart iptables.service #最后重启防火墙使配置生效 systemctl enable iptables.service #设置防火墙开机启动复制代码