CentOS7中，系統自帶的netfilter操作程序由iptables變爲firewalld。firewall有zone和service兩個概念，網口或者說nmcli下的conection可加入某個zone那麼這個con來的數據就會遵循zone下的規則，而每個zone下又有一些service，這些service不受zone默認規則的限制。可以通過con、zone、service的搭配來具體對某一業務進行規劃，保證系統安全。

一、firewalld中的9個zone

firewalld中有9個zone，各個zone的說明如下
drop
Any incoming network packets are dropped; there is no reply. Only outgoing network connections are possible.
block
Any incoming network connections are rejected with an icmp-host-prohibited message for IPv4 and icmp6-adm-prohibited for IPv6. Only network connections initiated from within the system are possible.
public
For use in public areas. You do not trust the other computers on the network to not harm your computer. Only selected incoming connections are accepted.
external
For use on external networks with masquerading enabled, especially for routers. You do not trust the other computers on the network to not harm your computer. Only selected incoming connections are accepted.
dmz
For computers in your demilitarized zone that are publicly-accessible with limited access to your internal network. Only selected incoming connections are accepted.
work
For use in work areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.
home
For use in home areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.
internal
For use on internal networks. You mostly trust the other computers on the networks to not harm your computer. Only selected incoming connections are accepted.
trusted
All network connections are accepted.

譯文：
由firewalld 提供的區域按照從不信任到信任的順序排序。
丟棄 drop
任何流入網絡的包都被丟棄，不作出任何響應。只允許流出的網絡連接。
阻塞 block
任何進入的網絡連接都被拒絕，並返回 IPv4 的 icmp-host-prohibited 報文或者 IPv6 的 icmp6-adm-prohibited 報文。只允許由該系統初始化的網絡連接。
公開 public
用以可以公開的部分。你認爲網絡中其他的計算機不可信並且可能傷害你的計算機。只允許選中的連接接入。
外部 external
用在路由器等啓用僞裝的外部網絡。你認爲網絡中其他的計算機不可信並且可能傷害你的計算機。只允許選中的連接接入。
隔離區dmz
用以允許隔離區（dmz）中的電腦有限地被外界網絡訪問。只接受被選中的連接。
工作 work
用在工作網絡。你信任網絡中的大多數計算機不會影響你的計算機。只接受被選中的連接。
家庭 home
用在家庭網絡。你信任網絡中的大多數計算機不會影響你的計算機。只接受被選中的連接。
內部 internal
用在內部網絡。你信任網絡中的大多數計算機不會影響你的計算機。只接受被選中的連接。
受信任的 trusted
允許所有網絡連接。