#查看防火牆狀態：
firewall-cmd --state
#啓動firewall：
systemctl start firewalld.service
#設置開機自啓：
systemctl enable firewalld.service
#重啓防火牆：
systemctl restart firewalld.service
1. 查看默認防火牆狀態（關閉後顯示notrunning，開啓後顯示running）
firewall-cmd --state
2. 查看防火牆規則（只顯示/etc/firewalld/zones/public.xml中防火牆策略）
firewall-cmd --list-all
3. 查看所有的防火牆策略（即顯示/etc/firewalld/zones/下的所有策略）
firewall-cmd --list-all-zones
#對外開放65530端口
firewall-cmd --permanent --add-port=65530/tcp
firewall-cmd --permanent --add-port=80/tcp
#關閉端口
firewall-cmd --permanent --remove-port=65530/tcp
firewall-cmd --permanent --remove-port=22/tcp
firewall-cmd --permanent --remove-service=ssh #--zone=public
#添加規則
firewall-cmd --permanent --remove-service=ssh
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="192.168.1.194/32" port protocol="tcp" port="22" accept"
#reload使生效
firewall-cmd --reload
systemctl restart firewalld.service
配置內容
vi /etc/firewalld/zones/public.xml
刪除是add換remove
===================================================================================================
失敗!
首先開啓linux轉發功能
#臨時開啓方法:
echo "1" > /proc/sys/net/ipv4/ip_forward #該文件內容爲0，表示禁止數據包轉發，1表示允許，將其修改爲1。
#永久開啓方法
echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf
sysctl -p
CentOS7則是在 /usr/lib/sysctl.d/50-default.conf額外添加
iptables -t nat -A PREROUTING -p tcp --dport [端口] -j DNAT --to-destination [目標IP:端口]
#外網服務器上的2222端口代理到內網服務器的22端口。
iptables -t nat -A PREROUTING -p tcp --dport 2222 -j DNAT --to-destination 192.168.9.134:22
iptables -t nat -A POSTROUTING -p tcp -d [目標IP] --dport [端口] -j SNAT --to-source [本地服務器公網IP]
#修改轉發數據來源爲內網網卡IP。
iptables -t nat -A POSTROUTING -p tcp -d 192.168.9.134/32 --sport 22 -j SNAT --to-source 192.168.9.101
iptables -t nat -A PREROUTING -p udp --dport [端口] -j DNAT --to-destination [目標IP:端口]
iptables -t nat -A POSTROUTING -p udp -d [目標IP] --dport [端口] -j SNAT --to-source [本地服務器公網IP]
其中端口指你要開放的本地轉發端口。目標IP:端口是國外vps的IP和需要轉發的端口，這樣就開啓了tcp和udp中轉，然後重啓一下iptables就可以進行測試了
同樣的centos7的firewalld也可以實現上述功能，直接幾條命令就可以了
firewall-cmd --permanent --add-port=端口/tcp #開啓本地tcp中轉端口
firewall-cmd --permanent --add-port=端口/udp #開啓本地udp中轉端口
firewall-cmd --permanent --add-masquerade #添加僞裝
firewall-cmd --permanent --add-forward-port=port=端口:proto=tcp:toport=vps端口:toaddr=x.x.x.x(vps IP) #建立tcp遠程中轉端口轉發
firewall-cmd --permanent --add-forward-port=port=端口:proto=udp:toport=vps端口:toaddr=x.x.x.x(vps IP) #建立udp遠程中轉端口轉發
firewall-cmd --reload #重啓firewalld
-------------------------------------------------
#!/bin/sh
echo "**********CLEAR DEFAULT CHAIN**********"
iptables -F
echo "**********CLEAR CUSTOM CHAIN**********"
iptables -X
echo "**********SET CHAIN DROP**********"
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
echo "**********APPEPT PING**********"
iptables -A OUTPUT -p icmp -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT
echo "**********ACCEPT LOOPBACK**********"
iptables -A INPUT -i lo -p all -j ACCEPT
iptables -A OUTPUT -o lo -p all -j ACCEPT
echo "**********PORTS**********"
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 1520 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 1520 -j ACCEPT
iptables -A INPUT -p tcp --dport 1521 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 1521 -j ACCEPT
iptables -A INPUT -p tcp --dport 1522 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 1522 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -d 10.94.18.245 --dport 1522 -j DNAT --to-destination 10.94.15.155:1521
iptables -t nat -A POSTROUTING -p tcp -s 10.94.15.155 --sport 1521 -j SNAT --to-source 10.94.18.245:1522
echo "**********SAVE CONFIG**********"
/etc/rc.d/init.d/iptables save
echo "**********SET SERVICE ON**********"
chkconfig iptables on
echo "**********START**********"
/etc/rc.d/init.d/iptables restart
read -p "Press enter to continue..."
====================================================================================================
iptable
====================================================================================================
##################################################
#iptables new-web by zy
##################################################
#!/bin/sh
echo "********************CLEAR********************"
iptables -F
iptables -X
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
echo "********************ACCEPT********************"
iptables -A INPUT -p icmp -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp -s 10.94.15.133 --dport 22 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp -s 10.94.18.246 --dport 22 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#RELATED ACCEPT允許已經建立連接的通過,這樣nginx反向代理就不會time out
echo "********************REJECT********************"
iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited
iptables -A FORWARD -j REJECT --reject-with icmp-host-prohibited
echo "********************SAVE CONFIG********************"
/etc/rc.d/init.d/iptables save
chkconfig iptables on
/etc/rc.d/init.d/iptables restart
read -p "Press enter to continue..."
##################################################
#iptables new-db by zy
##################################################
#!/bin/sh
echo "********************CLEAR********************"
iptables -F
iptables -X
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
echo "********************ACCEPT********************"
iptables -A INPUT -p icmp -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp -s 10.94.15.133 --dport 22 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp -s 10.94.18.246 --dport 22 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp -s 10.94.15.130 --dport 1521 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp -s 10.94.15.133 --dport 1521 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp -s 10.94.18.246 --dport 1521 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp -s 10.94.18.249 --dport 1521 -j ACCEPT
#RELATED ACCEPT允許已經建立連接的通過,這樣nginx反向代理就不會time out
echo "********************REJECT********************"
iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited
iptables -A FORWARD -j REJECT --reject-with icmp-host-prohibited
echo "********************SAVE CONFIG********************"
/etc/rc.d/init.d/iptables save
chkconfig iptables on
/etc/rc.d/init.d/iptables restart
read -p "Press enter to continue..."
---------------------------------------------------------------------------------------------------
##################################################
# config iptables web 2019.07.01 by zy
##################################################
#!/bin/sh
echo "**********CLEAR DEFAULT CHAIN**********"
iptables -F
echo "**********CLEAR CUSTOM CHAIN**********"
iptables -X
echo "**********SET CHAIN DROP**********"
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
echo "**********APPEPT PING**********"
iptables -A OUTPUT -p icmp -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT
echo "**********ACCEPT LOOPBACK**********"
iptables -A INPUT -i lo -p all -j ACCEPT
iptables -A OUTPUT -o lo -p all -j ACCEPT
echo "**********MANAGER**********"
iptables -A INPUT -s 10.94.15.133 -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -d 10.94.15.133 -p tcp --sport 22 -j ACCEPT
iptables -A INPUT -s 10.94.18.246 -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -d 10.94.18.246 -p tcp --sport 22 -j ACCEPT
echo "**********PORTS**********"
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 80 -j ACCEPT
echo "**********WHITE IP**********"
#iptables -I OUTPUT 1 -d 172.16.201.0/24 -j ACCEPT
#iptables -I INPUT 1 -s 172.16.201.0/24 -j ACCEPT
echo "**********BLACK IP**********"
#iptables -I INPUT 1 -s 211.103.81.58 -j DROP
echo "**********SAVE CONFIG**********"
/etc/rc.d/init.d/iptables save
echo "**********SET SERVICE ON**********"
chkconfig iptables on
echo "**********START**********"
/etc/rc.d/init.d/iptables restart
read -p "Press enter to continue..."
##################################################
# config iptables 10.94.15.155 2019.07.01 by zy
##################################################
#!/bin/sh
echo "**********CLEAR DEFAULT CHAIN**********"
iptables -F
echo "**********CLEAR CUSTOM CHAIN**********"
iptables -X
echo "**********SET CHAIN DROP**********"
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
echo "**********APPEPT PING**********"
iptables -A OUTPUT -p icmp -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT
echo "**********ACCEPT LOOPBACK**********"
iptables -A INPUT -i lo -p all -j ACCEPT
iptables -A OUTPUT -o lo -p all -j ACCEPT
echo "**********MANAGER**********"
iptables -A INPUT -s 10.94.15.133 -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -d 10.94.15.133 -p tcp --sport 22 -j ACCEPT
iptables -A INPUT -s 10.94.18.246 -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -d 10.94.18.246 -p tcp --sport 22 -j ACCEPT
#wcm#backup
iptables -A INPUT -s 10.94.15.130 -p tcp --dport 1521 -j ACCEPT
iptables -A OUTPUT -d 10.94.15.130 -p tcp --sport 1521 -j ACCEPT
iptables -A INPUT -s 10.94.15.133 -p tcp --dport 1521 -j ACCEPT
iptables -A OUTPUT -d 10.94.15.133 -p tcp --sport 1521 -j ACCEPT
iptables -A INPUT -s 10.94.18.246 -p tcp --dport 1521 -j ACCEPT
iptables -A OUTPUT -d 10.94.18.246 -p tcp --sport 1521 -j ACCEPT
iptables -A INPUT -s 10.94.18.249 -p tcp --dport 1521 -j ACCEPT
iptables -A OUTPUT -d 10.94.18.249 -p tcp --sport 1521 -j ACCEPT
echo "**********PORTS**********"
#iptables -A INPUT -p tcp --dport 80 -j ACCEPT
#iptables -A OUTPUT -p tcp --sport 80 -j ACCEPT
echo "**********WHITE IP**********"
#iptables -I OUTPUT 1 -d 172.16.201.0/24 -j ACCEPT
#iptables -I INPUT 1 -s 172.16.201.0/24 -j ACCEPT
echo "**********BLACK IP**********"
#iptables -I INPUT 1 -s 211.103.81.58 -j DROP
echo "**********SAVE CONFIG**********"
/etc/rc.d/init.d/iptables save
echo "**********SET SERVICE ON**********"
chkconfig iptables on
echo "**********START**********"
/etc/rc.d/init.d/iptables restart
read -p "Press enter to continue..."