/tags/firewalld/ Recent content in Firewalld on Blog Hugo zh-cn Mon, 15 Aug 2022 08:19:59 +0000 /posts/2022-08-15-linux-firewalld%E9%85%8D%E7%BD%AE/ Mon, 15 Aug 2022 08:19:59 +0000 /posts/2022-08-15-linux-firewalld%E9%85%8D%E7%BD%AE/ <p>Firewalld目前是RHEL和Centos默认的防火墙工具，取代了之前的iptables，不过二者都不是真正的防火墙，是用来定义防火墙策略的防火墙管理工具。iptables服务会把配置好的防火墙策略交由内核层面的netfilter网络过滤器来处理，而firewalld服务则是把配置好的防火墙策略交由内核层面的nftables包过滤框架来处理。</p> <h2 id="相关概念">相关概念</h2> <p>firewalld定义了几个概念：</p> <ul> <li><strong>zone</strong>: 安全域，类似于Window上的域网络，工作网络，家庭网络，Internet网络等，不同的安全作用域其安全级别不同，安全程度不同，家庭zone的安全规则就是最宽松的。</li> <li><strong>service</strong>: 它是zone里面的定义一个规则集，它将iptables中单独根据 入接口，出接口，源目端口，协议等定义单独规则整合为一个规则集合，方便识别和管理。</li> <li><strong>protocol</strong>: 定义协议规则</li> <li><strong>port</strong>，source-port：基于端口定义规则，port我的理解:定义源和目标为指定端口的规则。</li> <li><strong>source</strong>: 定义源地址规则</li> <li><strong>interface</strong>: 定义基于出入接口的规则。</li> <li><strong>direct</strong>: 直接定义原始iptables规则。</li> </ul> <h2 id="安全区">安全区</h2> <p>相较于传统的防火墙工具，FireWalld引入了区域（Zone）的概念</p> <div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#f92672">[</span>root@VM-0-2-centos ~<span style="color:#f92672">]</span><span style="color:#75715e"># systemctl start firewalld //firewalld默认处于关闭状态</span> </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#f92672">[</span>root@VM-0-2-centos ~<span style="color:#f92672">]</span><span style="color:#75715e"># systemctl status firewalld //查看防火墙状态</span> </span></span><span style="display:flex;"><span>● firewalld.service - firewalld - dynamic firewall daemon </span></span><span style="display:flex;"><span> Loaded: loaded <span style="color:#f92672">(</span>/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled<span style="color:#f92672">)</span> </span></span><span style="display:flex;"><span> Active: active <span style="color:#f92672">(</span>running<span style="color:#f92672">)</span> since Mon 2022-08-15 09:57:24 CST; 17min ago </span></span><span style="display:flex;"><span> Docs: man:firewalld<span style="color:#f92672">(</span>1<span style="color:#f92672">)</span> </span></span><span style="display:flex;"><span> Main PID: <span style="color:#ae81ff">3318</span> <span style="color:#f92672">(</span>firewalld<span style="color:#f92672">)</span> </span></span><span style="display:flex;"><span> Tasks: <span style="color:#ae81ff">2</span> <span style="color:#f92672">(</span>limit: 12158<span style="color:#f92672">)</span> </span></span><span style="display:flex;"><span> Memory: 27.1M </span></span><span style="display:flex;"><span> CPU: 358ms </span></span><span style="display:flex;"><span> CGroup: /system.slice/firewalld.service </span></span><span style="display:flex;"><span> └─3318 /usr/bin/python3 -s /usr/sbin/firewalld --nofork --nopid </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span>Aug <span style="color:#ae81ff">15</span> 09:57:24 VM-0-2-centos systemd<span style="color:#f92672">[</span>1<span style="color:#f92672">]</span>: Starting firewalld - dynamic firewall daemon... </span></span><span style="display:flex;"><span>Aug <span style="color:#ae81ff">15</span> 09:57:24 VM-0-2-centos systemd<span style="color:#f92672">[</span>1<span style="color:#f92672">]</span>: Started firewalld - dynamic firewall daemon. </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#f92672">[</span>root@VM-0-2-centos ~<span style="color:#f92672">]</span><span style="color:#75715e"># firewall-cmd --get-default-zone //firewalld默认安全区</span> </span></span><span style="display:flex;"><span>public </span></span></code></pre></div><p>可以看到FireWalld默认区域为Public，FireWalld定义了以下区域</p>