iptables规则备份与恢复, firewalld介绍-白红宇

iptables规则备份与恢复, firewalld介绍

阅读量：6003 次

发布时间：2019-06-20

本文共 10598 字，大约阅读时间需要 35 分钟。

iptables规则备份和恢复

service iptables save # 会把规则保存到/etc/sysconfig/iptables

把iptables规则备份到指定文件中 iptables-save test.txt

根据备份文件恢复规则 iptables-restore < test.txt

[root@test-a ~]# iptables-save > /tmp/ipt.txt[root@test-a ~]# cat /tmp/ipt.txt# Generated by iptables-save v1.4.21 on Tue Oct 30 08:00:50 2018*filter:INPUT ACCEPT [0:0]:FORWARD ACCEPT [0:0]:OUTPUT ACCEPT [185:23467]-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT-A INPUT -p icmp -j ACCEPT-A INPUT -i lo -j ACCEPT-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT-A INPUT -j REJECT --reject-with icmp-host-prohibited-A FORWARD -j REJECT --reject-with icmp-host-prohibitedCOMMIT# Completed on Tue Oct 30 08:00:50 2018[root@test-a ~]# iptables -nvLChain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target     prot opt in     out     source               destination                 369 29192 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0                          state RELATED,ESTABLISHED    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0                     0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0                     1    52 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0                          state NEW tcp dpt:22   25  4853 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0                          reject-with icmp-host-prohibitedChain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target     prot opt in     out     source               destination                   0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0                          reject-with icmp-host-prohibitedChain OUTPUT (policy ACCEPT 252 packets, 31171 bytes) pkts bytes target     prot opt in     out     source               destination               [root@test-a ~]# iptables -F[root@test-a ~]# iptables -nvLChain INPUT (policy ACCEPT 6 packets, 432 bytes) pkts bytes target     prot opt in     out     source               destinationChain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target     prot opt in     out     source               destinationChain OUTPUT (policy ACCEPT 4 packets, 448 bytes) pkts bytes target     prot opt in     out     source               destination[root@test-a ~]# iptables-restore < /tmp/ipt.txt[root@test-a ~]# iptablesiptables v1.4.21: no command specifiedTry `iptables -h' or 'iptables --help' for more information.[root@test-a ~]# iptables -nvLChain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target     prot opt in     out     source               destination   31  2264 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:22    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibitedChain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target     prot opt in     out     source               destination    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibitedChain OUTPUT (policy ACCEPT 18 packets, 2032 bytes) pkts bytes target     prot opt in     out     source               destination

firewalled(centos7之后的版本)

打开firewalled

systemctl disable iptables

systemctl stop iptables

systemctl enable firewalld

systemctl start firewalld

systemctl restart firewalld

firewalld 默认有9个zone

默认zone为public

firewalld-cmd --get-zones #查看所有zone

firewalld-cmd --get-default-zone # 查看默认zone

zone的含义
drop(丢弃) 任何接收的网络数据包都被丢弃，没有任何回复。仅能有发送出去的网络连接。
block(限制) 任何接收的网络连接都被IPv4的icmp-host-prohibited信息和IPv6的icmp6-adm-prohibited信息所拒绝。
public(公共) 在公共区域内使用，不能相信网络内的其他计算机不会对你的计算机造成危害，只能接收经过选取的连接。
external(外部) 特别是为路由器启用了伪装功能的外部网。你不能信任来自网络的其他计算机，不能相信它们不会对你的计算机造成危害，只能接收经过选择的连接。
dmz(非军事区) 用于你的非军事区内的电脑，此区域内可公开访问，可以有限地进入你的内部网络，仅仅接收经过选择的连接。
work(工作) 用于工作区。你可以基本信任网络内的其他电脑不会危害你的电脑。仅仅接收经过选择的连接。
home(家庭) 用于家庭网络。你可以基本信任网络内的其他计算机不会危害你的计算机。仅仅接收经过选择的连接。
internal(内部) 用于内部网络。你可以基本上信任网络内的其他计算机不会威胁你的计算机。仅仅接收经过选择的连接。
trusted(信任) 可接受所有的网络连接。

# 打开firewalled，先关闭netfilter的iptables服务[root@test-a ~]# systemctl disable iptablesrm '/etc/systemd/system/basic.target.wants/iptables.service'[root@test-a ~]# systemctl stop iptables  [root@test-a ~]# systemctl enable firewalldln -s '/usr/lib/systemd/system/firewalld.service' '/etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service'ln -s '/usr/lib/systemd/system/firewalld.service' '/etc/systemd/system/basic.target.wants/firewalld.service'[root@test-a ~]# systemctl start firewalld[root@test-a ~]# iptables -nvL  # firewalld的规则比netfilter展示的要多Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target     prot opt in     out     source               destination   32  2368 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctsta              te RELATED,ESTABLISHED    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0    0     0 INPUT_direct  all  --  *      *       0.0.0.0/0            0.0.0.0/0    0     0 INPUT_ZONES_SOURCE  all  --  *      *       0.0.0.0/0            0.0.0.0/0                          0     0 INPUT_ZONES  all  --  *      *       0.0.0.0/0            0.0.0.0/0    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            rejec              t-with icmp-host-prohibitedChain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target     prot opt in     out     source               destination    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctsta ...# 查询zone[root@test-a ~]# firewall-cmd --get-zonesblock dmz drop external home internal public trusted work[root@test-a ~]# firewall-cmd --get-default-zonepublic

firewalld关于zone的操作

firewall-cmd --set-default-zone=work #设定默认zone

firewall-cmd --get-zone-of-interface=ens33 #查指定网卡

firewall-cmd --zone=public --add-interface=lo # 给指定网卡设置zone

firewall-cmd --zone=dmz --change-interface=lo # 针对网卡更改zone

firewall-cmd --zone=dmz --remove-interface=lo # 针对网卡删除zone

firewall-cmd --get-active-zones # 查看系统所有网卡所在的zone

[root@test-a ~]# firewall-cmd --set-default-zone=worksuccess[root@test-a ~]# firewall-cmd --get-default-zonework[root@test-a ~]# firewall-cmd --get-zone-of-interface=eno16777736work[root@test-a ~]# firewall-cmd --get-zone-of-interface=lono zone[root@test-a ~]# firewall-cmd --zone=public --add-interface=losuccess[root@test-a ~]# firewall-cmd --get-zone-of-interface=lopublic[root@test-a ~]# firewall-cmd --zone=dmz --change-interface=losuccess[root@test-a ~]# firewall-cmd --get-zone-of-interface=lodmz[root@test-a ~]#  firewall-cmd --zone=dmz --remove-interface=losuccess[root@test-a ~]# firewall-cmd --get-zone-of-interface=lono zone[root@test-a ~]# firewall-cmd --get-active-zoneswork  interfaces: eno16777736

firewalld关于service的操作

firewall-cmd --get-services # 查看所有的service

firewall-cmd --list-services # 查看当前zone下有哪些service

firewall-cmd --zone=public --add-service=http # 把http增加到public zone下面

firewall-cmd --zone=public --remove-service=http # 把public zone下面的http删除

ls /usr/lib/firewalld/zones/ #zone的配置模板

firewall-cmd --zone=public --add-service=http --permanent #更改配置文件，之后会在/etc/firewalld/zones 目录下生成配置文件

需求: ftp服务自定义端口1121，需要在work zone下面放行ftp

cp /usr/lib/firewalld/services/ftp.xml /etc/firewalld/services

vi /etc/firewalld/services/ftp.xml # 把21改为1121

cp /usr/lib/firewalld/zones/work.xml /etc/firewalld/zones/

vi /etc/firewalld/zones/work.xml # 增加一行

<service name="ftp" />

firewall-cmd -reload # 重新加载

firewall-cmd --zone=work --list-services

[root@test-a ~]#  firewall-cmd --get-servicesamanda-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns ftp high-availability http https imaps ipp ipp-client ipsec kerberos kpasswd ldap ldaps libvirt libvirt-tls mdns mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s postgresql proxy-dhcp radius rpc-bind samba samba-client smtp ssh telnet tftp tftp-client transmission-client vnc-server wbem-https[root@test-a ~]# firewall-cmd --zone=public --list-servicesdhcpv6-client ssh[root@test-a ~]# firewall-cmd --get-default-zonework[root@test-a ~]# firewall-cmd --zone=work --list-servicesdhcpv6-client ipp-client ssh[root@test-a ~]# firewall-cmd --zone=block --list-services # 没有services[root@test-a ~]# firewall-cmd --zone=public --add-service=httpsuccess[root@test-a ~]# firewall-cmd --zone=public --list-servicesdhcpv6-client http ssh[root@test-a ~]# firewall-cmd --zone=public --add-service=ftp --permanentsuccess[root@test-a ~]# cat /etc/firewalld/zones/public.xml # 可以看到只有ftp保存在文件了，http并没有
    
      
     
      Public
       
     
      For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.
       
       
       
     
    [root@test-a ~]# ls /usr/lib/firewalld/zones/block.xml  dmz.xml  drop.xml  external.xml  home.xml  internal.xml  public.xml  trusted.xml  work.xml[root@test-a ~]# ls /usr/lib/firewalld/services/amanda-client.xml      http.xml         libvirt.xml  pmwebapis.xml     ssh.xmlbacula-client.xml      imaps.xml        mdns.xml     pmwebapi.xml      telnet.xmlbacula.xml             ipp-client.xml   mountd.xml   pop3s.xml         tftp-client.xmldhcpv6-client.xml      ipp.xml          ms-wbt.xml   postgresql.xml    tftp.xmldhcpv6.xml             ipsec.xml        mysql.xml    proxy-dhcp.xml    transmission-client.xmldhcp.xml               kerberos.xml     nfs.xml      radius.xml        vnc-server.xmldns.xml                kpasswd.xml      ntp.xml      rpc-bind.xml      wbem-https.xmlftp.xml                ldaps.xml        openvpn.xml  samba-client.xmlhigh-availability.xml  ldap.xml         pmcd.xml     samba.xmlhttps.xml              libvirt-tls.xml  pmproxy.xml  smtp.xml[root@test-a ~]# cp /usr/lib/firewalld/services/ftp.xml /etc/firewalld/services/[root@test-a ~]# vi /etc/firewalld/services/ftp.xml[root@test-a ~]# cp /usr/lib/firewalld/zones/work.xml /etc/firewalld/zones/[root@test-a ~]# vi /etc/firewalld/zones/work.xml[root@test-a ~]# firewall-cmd --zone=work --list-servicesdhcpv6-client ipp-client ssh[root@test-a ~]# firewall-cmd --reloadsuccess[root@test-a ~]# firewall-cmd --zone=work --list-servicesdhcpv6-client ftp ipp-client ssh