阿里雲經典網絡關閉端口不對公網開放

由於咱們如今用的是以CentOS 7爲主，主要使用的防火牆爲firewall而不是CentOS 6的Iptables.

阿里雲的服務器的防火牆默認是關閉的，請注意我這裏說的不是專有網絡而是經典網絡，因此只要你開放了一個端口，外網就能夠訪問。

首先啓動防火牆

service firewalld start

咱們以redis的6379端口爲例，配置只容許內網訪問，外網不容許訪問的配置，假如本機的IP爲172.31.27.68，容許訪問的IP爲172.31.27.67，172.31.27.69。

firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="172.31.27.67" port protocol="tcp" port="6379" accept"

firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="172.31.27.69" port protocol="tcp" port="6379" accept"

開放端口段

firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="172.31.27.69" port protocol="tcp" port="30000-31000" accept"

固然若是想讓某一個端口能夠對公網開放，能夠設置

firewall-cmd --zone=public --permanent --add-port=8000/tcp

這樣全部的IP地址均可以訪問。

重啓防火牆

service firewalld restart

咱們進入/etc/firewalld/zones能夠看到cat public.xml

<?xml version="1.0" encoding="utf-8"?>
<zone>
  <short>Public</short>
  <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
  <service name="ssh"/>
  <service name="dhcpv6-client"/>
  <rule family="ipv4">
    <source address="172.31.27.67"/>
    <port protocol="tcp" port="6379"/>
    <accept/>
  </rule>
  <rule family="ipv4">
    <source address="172.31.27.69"/>
    <port protocol="tcp" port="6379"/>
    <accept/>
  </rule>
</zone>

查看配置結果

firewall-cmd --list-all
public
  target: default
  icmp-block-inversion: no
  interfaces: 
  sources: 
  services: ssh dhcpv6-client
  ports: 
  protocols: 
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 
    rule family="ipv4" source address="172.31.27.67" port port="6379" protocol="tcp" accept
    rule family="ipv4" source address="172.31.27.69" port port="6379" protocol="tcp" accept

若是要移除該配置能夠設置

firewall-cmd --permanent --remove-rich-rule="rule family="ipv4" source address="xx.xx.xx.xx" port protocol="tcp" port="6379" accept"

firewall-cmd --zone= public --remove-port=8000/tcp --permanent

移除後也要重啓防火牆

service firewalld restart