保存和备份iptables规则
service iptables save //会把规则保存到/etc/sysconfig/iptables
把iptables规则备份到my.ipt文件中：
iptables-save > my.ipt 恢复刚才备份的规则：
iptables-restore < my.ipt
1.保存规则
[root@linux-128 ~]# service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[ 确定 ]
它会保存到配置文件/etc/sysconfig/iptables中
[root@linux-128 ~]# cat /etc/sysconfig/iptables
# Generated by iptables-save v1.4.21 on Mon Dec 4 02:46:23 2017
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [162:11232]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Mon Dec 4 02:46:23 2017
2.备份规则
[root@linux-128 ~]# iptables-save >/tmp/myiptables.rule
查看规则
[root@linux-128 ~]# cat /tmp/myiptables.rule
# Generated by iptables-save v1.4.21 on Mon Dec 4 02:49:42 2017
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [261:20920]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Mon Dec 4 02:49:42 2017
3.恢复规则
[root@linux-128 ~]# iptables-restore </tmp/myiptables.rule
恢复规则一般使用备份规则中，注意：服务器或者重启iptables，它会自动加载配置文件中的规则
firewalld的9个zone
• 打开firewalld
• systemctl disable iptables
• systemctl stop iptables
• systemctl enable firewalld
• systemctl start firewalld
• firewalld默认有9个zone
• 默认zone为public
• firewall-cmd --get-zones //查看所有zone
• firewall-cmd --get-default-zone//查看默认zone
- 关闭开机自动启动netfilter
[root@linux-128 ~]# systemctl disable iptables
Removed symlink /etc/systemd/system/basic.target.wants/iptables.service.
- 关闭netfilter
[root@linux-128 ~]# systemctl stop iptables
- 设置开机启动firewalld
[root@linux-128 ~]# systemctl enable firewalld
Created symlink from /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service to /usr/lib/systemd/system/firewalld.service.
Created symlink from /etc/systemd/system/basic.target.wants/firewalld.service to /usr/lib/systemd/system/firewalld.service.
- 启动firewalld
[root@linux-128 ~]# systemctl start firewalld
- 查看firewalld的默认规则
[root@linux-128 ~]# iptables -t nat -nvL
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 PREROUTING_direct all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 PREROUTING_ZONES_SOURCE all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 PREROUTING_ZONES all -- * * 0.0.0.0/0 0.0.0.0/0
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 OUTPUT_direct all -- * * 0.0.0.0/0 0.0.0.0/0
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 POSTROUTING_direct all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 POSTROUTING_ZONES_SOURCE all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 POSTROUTING_ZONES all -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT_direct (1 references)
pkts bytes target prot opt in out source destination
Chain POSTROUTING_ZONES (1 references)
pkts bytes target prot opt in out source destination
0 0 POST_public all -- * ens33 0.0.0.0/0 0.0.0.0/0 [goto]
0 0 POST_public all -- * + 0.0.0.0/0 0.0.0.0/0 [goto]
Chain POSTROUTING_ZONES_SOURCE (1 references)
pkts bytes target prot opt in out source destination
Chain POSTROUTING_direct (1 references)
pkts bytes target prot opt in out source destination
Chain POST_public (2 references)
pkts bytes target prot opt in out source destination
0 0 POST_public_log all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 POST_public_deny all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 POST_public_allow all -- * * 0.0.0.0/0 0.0.0.0/0
Chain POST_public_allow (1 references)
pkts bytes target prot opt in out source destination
Chain POST_public_deny (1 references)
pkts bytes target prot opt in out source destination
Chain POST_public_log (1 references)
pkts bytes target prot opt in out source destination
Chain PREROUTING_ZONES (1 references)
pkts bytes target prot opt in out source destination
0 0 PRE_public all -- ens33 * 0.0.0.0/0 0.0.0.0/0 [goto]
0 0 PRE_public all -- + * 0.0.0.0/0 0.0.0.0/0 [goto]
Chain PREROUTING_ZONES_SOURCE (1 references)
pkts bytes target prot opt in out source destination
Chain PREROUTING_direct (1 references)
pkts bytes target prot opt in out source destination
Chain PRE_public (2 references)
pkts bytes target prot opt in out source destination
0 0 PRE_public_log all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 PRE_public_deny all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 PRE_public_allow all -- * * 0.0.0.0/0 0.0.0.0/0
Chain PRE_public_allow (1 references)
pkts bytes target prot opt in out source destination
Chain PRE_public_deny (1 references)
pkts bytes target prot opt in out source destination
Chain PRE_public_log (1 references)
pkts bytes target prot opt in out source destination
-
firewalld有9个zone；zone是firewalld的一个单位，centos7默认是public.
-
查看所有的zone
[root@linux-128 ~]# firewall-cmd --get-zones
work drop internal external trusted home dmz public block //刚好9个zone
- 查看系统默认的zone
[root@linux-128 ~]# firewall-cmd --get-default-zone
public
- 9个zone的介绍
firewalld关于zone的操作
• firewall-cmd --set-default-zone=work //设定默认zone
• firewall-cmd --get-zone-of-interface=ens33 //查指定网卡
• firewall-cmd --zone=public --add-interface=lo //给指定网卡设置zone
• firewall-cmd --zone=dmz --change-interface=lo //针对网卡更改zone
• firewall-cmd --zone=dmz --remove-interface=lo //针对网卡删除zone
• firewall-cmd --get-active-zones //查看系统所有网卡所在的zone
- 修改默认的zone值
[root@linux-128 ~]# firewall-cmd --get-default-zone //查看系统默认的zone
public
[root@linux-128 ~]# firewall-cmd --set-default-zone=work //修改默认的zone值
success
[root@linux-128 ~]# firewall-cmd --get-default-zone //查看系统默认的zone
work
- 查看指定网卡所在zone
[root@linux-128 ~]# firewall-cmd --get-zone-of-interface=ens33
work
- 给指定的网卡设置zone
[root@linux-128 ~]# firewall-cmd --zone=home --add-interface=lo //指定网卡lo为zone
success
[root@linux-128 ~]# firewall-cmd --get-zone-of-interface=lo //查看网卡lo的zone
home
- 针对网卡更改zone
[root@linux-128 ~]# firewall-cmd --zone=dmz --change-interface=lo //将网卡lo的zone修改成dmz
success
[root@linux-128 ~]# firewall-cmd --get-zone-of-interface=lo //查看网卡lo的zone
dmz
- 针对网卡删除zone
[root@linux-128 ~]# firewall-cmd --zone=dmz --remove-interface=lo
success
[root@linux-128 ~]# firewall-cmd --get-zone-of-interface=lo
no zone
- 查看系统所有网卡所在的zone
[root@linux-128 ~]# firewall-cmd --get-active-zones
work
interfaces: ens33
firewalld关于service的操作
• firewall-cmd --get-services 查看所有的servies
• firewall-cmd --list-services //查看当前zone下有哪些service
• firewall-cmd --zone=public --add-service=http //把http增加到public zone下面
• firewall-cmd --zone=public --remove-service=http
• ls /usr/lib/firewalld/zones/ //zone的配置文件模板
• firewall-cmd --zone=public --add-service=http --permanent //更改配置文件，之后会在/etc/firewalld/zones目录下面生成配置文件
• 需求：ftp服务自定义端口1121，需要在work zone下面放行ftp
• cp /usr/lib/firewalld/services/ftp.xml /etc/firewalld/services
• vi /etc/firewalld/services/ftp.xml //把21改为1121
• cp /usr/lib/firewalld/zones/work.xml /etc/firewalld/zones/
• vi /etc/firewalld/zones/work.xml //增加一行
• <service name="ftp"/>
• firewall-cmd --reload //重新加载
• firewall-cmd --zone=work --list-services
- 查看所有的servies
[root@linux-128 ~]# firewall-cmd --get-services
RH-Satellite-6 amanda-client amanda-k5-client bacula bacula-client ceph ceph-mon dhcp dhcpv6 dhcpv6-client dns docker-registry dropbox-lansync freeipa-ldap freeipa-ldaps freeipa-replication ftp high-availability http https imap imaps ipp ipp-client ipsec iscsi-target kadmin kerberos kpasswd ldap ldaps libvirt libvirt-tls mdns mosh mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3 pop3s postgresql privoxy proxy-dhcp ptp pulseaudio puppetmaster radius rpc-bind rsyncd samba samba-client sane smtp smtps snmp snmptrap squid ssh synergy syslog syslog-tls telnet tftp tftp-client tinc tor-socks transmission-client vdsm vnc-server wbem-https xmpp-bosh xmpp-client xmpp-local xmpp-server
- 查看当前zone下有哪些service
[root@linux-128 ~]# firewall-cmd --get-default-zone //查看当前系统默认的zone
work
[root@linux-128 ~]# firewall-cmd --list-services //查看当前系统默认的zone下有那些service
ssh dhcpv6-client
- 查看指定zone下有那些service
[root@linux-128 ~]# firewall-cmd --zone=public --list-services
dhcpv6-client ssh http
-
添加一个service到指定的zone下 [root@linux-128 ~]# firewall-cmd --zone=public --add-service=ftp //将服务ftp添加到public下 success [root@linux-128 ~]# firewall-cmd --zone=public --list-services //查看public下的service dhcpv6-client ssh http ftp
-
删除指定zone下的service
[root@linux-128 ~]# firewall-cmd --zone=public --remove-service=http //删除public下的服务http
success
[root@linux-128 ~]# firewall-cmd --zone=public --list-services
dhcpv6-client ssh ftp
-
zone的配置文件模板 [root@linux-128 ~]# ls /usr/lib/firewalld/zones block.xml dmz.xml drop.xml external.xml home.xml internal.xml public.xml trusted.xml
-
更改zone的配置文件
[root@linux-128 ~]# firewall-cmd --zone=public --add-service=http --permanent
success
[root@linux-128 ~]# cat /etc/firewalld/zones/public.xml
<?xml version="1.0" encoding="utf-8"?>
<zone>
<short>Public</short>
<description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
<service name="dhcpv6-client"/>
<service name="http"/> //已经添加
<service name="ssh"/>
</zone>
在添加一个service ftp
[root@linux-128 ~]# firewall-cmd --zone=public --add-service=ftp --permanent
success
[root@linux-128 ~]# cat /etc/firewalld/zones/public.xml
<?xml version="1.0" encoding="utf-8"?>
<zone>
<short>Public</short>
<description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
<service name="ftp"/> //已经添加
<service name="dhcpv6-client"/>
<service name="http"/>
<service name="ssh"/>
</zone>
案例：需求：ftp服务自定义端口1121，需要在work zone下面放行ftp
拷贝配置文件ftp.xml
[root@linux-128 ~]# cp /usr/lib/firewalld/services/ftp.xml /etc/firewalld/services
[root@linux-128 ~]# vi /etc/firewalld/services/ftp.xml
配置文件如下：
<?xml version="1.0" encoding="utf-8"?>
<service>
<short>FTP</short>
<description>FTP is a protocol used for remote file transfer. If you plan to make your FTP server publicly available, enable this option. You need the vsftpd package installed for this option to be useful.</description>
<port protocol="tcp" port="1121"/>
<module name="nf_conntrack_ftp"/>
</service>
拷贝配置文件work.xml
[root@linux-128 ~]# cp /usr/lib/firewalld/zones/work.xml /etc/firewalld/zones/
[root@linux-128 ~]# vi /etc/firewalld/zones/work.xml
配置文件如下：
<?xml version="1.0" encoding="utf-8"?>
<zone>
<short>Work</short>
<description>For use in work areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
<service name="ssh"/>
<service name="dhcpv6-client"/>
<service name="ftp"/>
</zone>
重新加载 firewall-cmd --reload
[root@linux-128 ~]# firewall-cmd --reload
success
查看work下面的service
[root@linux-128 ~]# firewall-cmd --zone=work --list-services
ssh dhcpv6-client ftp