42.每日一個Linux命令----firewall

描述：防火牆

指令：

運行時模式下對區域進行的修改不是永久有效的。從新加載或者重啓後修改將失效。

要永久有效需加 --permanent，永久選項不直接影響運行時的狀態。這些選項僅在重載或者重啓服務時可用。

爲了使用運行時和永久設置，須要分別設置二者。

firewall-cmd --state

firewall-cmd --reload

firewall-cmd --get-zones

firewall-cmd --get-services

firewall-cmd --icmptypes

firewall-cmd --list-all-zones

firewall-cmd --list-all

firewall-cmd --get-default-zone

firewall-cmd --set-default-zone

firewall-cmd --get-active-zones

firewall-cmd --get-zone-of-interface=<interface>

firewall-cmd --zone=<zone> --add-interface=<interface>

firewall-cmd --zone=<zone> --change-interface=<interface>

firewall-cmd --zone=<zone> --remove-interface=<interface>

firewall-cmd --zone=<zone> --query-interface=<interface>

firewall-cmd --zone=<zone> --list-services

firewall-cmd --panic-on

firewall-cmd --panic-off

firewall-cmd --query-panic

firewall-cmd [--zone=<zone>] --add-service=<service> [--timeout=<seconds>]

firewall-cmd [--zone=<zone>] --add-port=<port>/<protocol>

firewall-cmd [--zone=<zone>] --remove-port=<port>/<protocol>

firewall-cmd [--zone=<zone>] --query-port=<port>/<protocol>

啓用區域中的IP假裝功能

firewall-cmd --add-masquerade

firewall-cmd --remove-masquerade

firewall-cmd --query-masquerade

firewall-cmd  --query-icmp-block=<icmptype>

firewall-cmd  --add-icmp-block=<icmptype>

firewall-cmd  --remove-icmp-block=<icmptype>   

firewall-cmd --zone=public --add-icmp-block=echo-reply

firewall-cmd [--zone=<zone>] --add-forward-port=port=<port>:proto=<protocol>:toport=<port>:toaddr=<address>

firewall-cmd [--zone=<zone>] --add-forward-port=port=<port>:proto=<protocol>:toport=<port>

firewall-cmd [--zone=<zone>] --add-forward-port=port=<port>:proto=<protocol>:toaddr=<address>

firewall-cmd [--zone=<zone>] --remove-forward-port=port=<port>:proto=<protocol>:toport=<port>:toaddr=<address>

firewall-cmd [--zone=<zone>] --query-forward-port=port=<port>:proto=<protocol>:toport=<port>:toaddr=<address>

firewall-cmd [--zone=<zone>] --add-forward-port=port=<port>[-<port>]:proto=<protocol> { :toport=<port>[-<port>] | :toaddr=<address> | :toport=<port>[-<port>]:toaddr=<address> }