CentOS开放端口的方法
<p>Centos升级到7之后，内置的防火墙已经从iptables变成了firewalld。所以，端口的开启还是要从两种情况来说明的，即iptables和firewalld。更多关于CentOs防火墙的最新内容，请参考Redhat官网。</p><p> </p>
<h2>一、iptables(centos 6及以前)</h2>
<p>1.打开/关闭/重启防火墙</p>
<pre class="prettyprint"><code><span class="pun">开启防火墙(重启后永久生效)：<span class="pln">chkconfig iptables on
<span class="pun">关闭防火墙(重启后永久生效)：<span class="pln">chkconfig iptables off
<span class="pun">开启防火墙(即时生效，重启后失效)：<span class="pln">service iptables start
<span class="pun">关闭防火墙(即时生效，重启后失效)：<span class="pln">service iptables stop
<span class="pun">重启防火墙:<span class="pln">service iptables restartd</span></span></span></span></span></span></span></span></span></span></code></pre>
<p>2.查看打开的端口</p>
<pre class="prettyprint"><code><span class="str">/etc/<span class="pln">init<span class="pun">.<span class="pln">d<span class="pun">/<span class="pln">iptables status</span></span></span></span></span></span></code></pre>
<p>3.打开某个端口(以8080为例)</p>
<p>（1）开启端口</p>
<pre class="prettyprint"><code><span class="pln">iptables <span class="pun">-<span class="pln">A INPUT <span class="pun">-<span class="pln">p tcp <span class="pun">--<span class="pln">dport <span class="lit">8080<span class="pln"> <span class="pun">-<span class="pln">j ACCEPT </span></span></span></span></span></span></span></span></span></span></span></code></pre>
<p>（2）保存并重启防火墙</p>
<pre class="prettyprint"><code><span class="str">/etc/<span class="pln">rc<span class="pun">.<span class="pln">d<span class="pun">/<span class="pln">init<span class="pun">.<span class="pln">d<span class="pun">/<span class="pln">iptables save
<span class="pun">/<span class="pln">etc<span class="pun">/<span class="pln">init<span class="pun">.<span class="pln">d<span class="pun">/<span class="pln">iptables restart</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></code></pre>
<p>4.打开49152~65534之间的端口</p>
<pre class="prettyprint"><code><span class="pln">iptables <span class="pun">-<span class="pln">A INPUT <span class="pun">-<span class="pln">p tcp <span class="pun">--<span class="pln">dport <span class="lit">49152<span class="pun">:<span class="lit">65534<span class="pln"> <span class="pun">-<span class="pln">j ACCEPT</span></span></span></span></span></span></span></span></span></span></span></span></span></code></pre>
<p>同样，这里需要对设置进行保存，并重启防火墙。</p>
<p>5.其他打开方式</p>
<p>我们还可以通过修改/etc/sysconfig/iptables文件的方式开启端口，如下</p>
<pre class="prettyprint"><code><span class="pln">vi <span class="pun">/<span class="pln">etc<span class="pun">/<span class="pln">sysconfig<span class="pun">/<span class="pln">iptables</span></span></span></span></span></span></span></code></pre>
<p>然后在文件中增加一行</p>
<pre class="prettyprint"><code><span class="pun">-<span class="pln">A RH<span class="pun">-<span class="typ">Firewall<span class="pun">-<span class="lit">1<span class="pun">-<span class="pln">INPUT <span class="pun">-<span class="pln">m state <span class="pun">–<span class="pln">state NEW <span class="pun">-<span class="pln">m tcp <span class="pun">-<span class="pln">p tcp <span class="pun">–<span class="pln">dport <span class="lit">8080<span class="pln"> <span class="pun">-<span class="pln">j ACCEPT</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></code></pre>
<p>参数说明:</p>
<ul>
<li>–A 参数就看成是添加一条规则</li>
<li>–p 指定是什么协议，我们常用的tcp 协议，当然也有udp，例如53端口的DNS</li>
<li>–dport 就是目标端口，当数据从外部进入服务器为目标端口</li>
<li>–sport 数据从服务器出去，则为数据源端口使用</li>
<li>–j 就是指定是 ACCEPT -接收 或者 DROP 不接收</li>
</ul>
<h2>二、firewalld(centos7)</h2>
<p>Centos7默认安装了firewalld，如果没有安装的话，可以使用 <code>yum install firewalld firewalld-config</code>进行安装。</p>
<p>1.启动防火墙</p>
<pre class="prettyprint"><code><span class="pln">systemctl start firewalld </span></code></pre>
<p>2.禁用防火墙</p>
<pre class="prettyprint"><code><span class="pln">systemctl stop firewalld</span></code></pre>
<p>3.设置开机启动</p>
<pre class="prettyprint"><code><span class="pln">systemctl enable firewalld</span></code></pre>
<p>4.停止并禁用开机启动</p>
<pre class="prettyprint"><code><span class="pln">sytemctl disable firewalld</span></code></pre>
<p>5.重启防火墙</p>
<pre class="prettyprint"><code><span class="pln">firewall<span class="pun">-<span class="pln">cmd <span class="pun">--<span class="pln">reload</span></span></span></span></span></code></pre>
<p>6.查看状态</p>
<pre class="prettyprint"><code><span class="pln">systemctl status firewalld<span class="pun">或者<span class="pln"> firewall<span class="pun">-<span class="pln">cmd <span class="pun">--<span class="pln">state</span></span></span></span></span></span></span></code></pre>
<p>7.查看版本</p>
<pre class="prettyprint"><code><span class="pln">firewall<span class="pun">-<span class="pln">cmd <span class="pun">--<span class="pln">version</span></span></span></span></span></code></pre>
<p>8.查看帮助</p>
<pre class="prettyprint"><code><span class="pln">firewall<span class="pun">-<span class="pln">cmd <span class="pun">--<span class="pln">help</span></span></span></span></span></code></pre>
<p>9.查看区域信息</p>
<pre class="prettyprint"><code><span class="pln">firewall<span class="pun">-<span class="pln">cmd <span class="pun">--<span class="kwd">get<span class="pun">-<span class="pln">active<span class="pun">-<span class="pln">zones</span></span></span></span></span></span></span></span></span></code></pre>
<p>10.查看指定接口所属区域信息</p>
<pre class="prettyprint"><code><span class="pln">firewall<span class="pun">-<span class="pln">cmd <span class="pun">--<span class="kwd">get<span class="pun">-<span class="pln">zone<span class="pun">-<span class="pln">of<span class="pun">-<span class="kwd">interface<span class="pun">=<span class="pln">eth0</span></span></span></span></span></span></span></span></span></span></span></span></span></code></pre>
<p>11.拒绝所有包</p>
<pre class="prettyprint"><code><span class="pln">firewall<span class="pun">-<span class="pln">cmd <span class="pun">--<span class="pln">panic<span class="pun">-<span class="pln">on</span></span></span></span></span></span></span></code></pre>
<p>12.取消拒绝状态</p>
<pre class="prettyprint"><code><span class="pln">firewall<span class="pun">-<span class="pln">cmd <span class="pun">--<span class="pln">panic<span class="pun">-<span class="pln">off</span></span></span></span></span></span></span></code></pre>
<p>13.查看是否拒绝</p>
<pre class="prettyprint"><code><span class="pln">firewall<span class="pun">-<span class="pln">cmd <span class="pun">--<span class="pln">query<span class="pun">-<span class="pln">panic</span></span></span></span></span></span></span></code></pre>
<p>14.将接口添加到区域(默认接口都在public)</p>
<pre class="prettyprint"><code><span class="pln">firewall<span class="pun">-<span class="pln">cmd <span class="pun">--<span class="pln">zone<span class="pun">=<span class="kwd">public<span class="pln"> <span class="pun">--<span class="pln">add<span class="pun">-<span class="kwd">interface<span class="pun">=<span class="pln">eth0<span class="pun">(永久生效再加上<span class="pln"> <span class="pun">--<span class="pln">permanent <span class="pun">然后<span class="pln">reload<span class="pun">防火墙)</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></code></pre>
<p>15.设置默认接口区域</p>
<pre class="prettyprint"><code><span class="pln">firewall<span class="pun">-<span class="pln">cmd <span class="pun">--<span class="kwd">set<span class="pun">-<span class="kwd">default<span class="pun">-<span class="pln">zone<span class="pun">=<span class="kwd">public<span class="pun">(立即生效，无需重启)</span></span></span></span></span></span></span></span></span></span></span></span></code></pre>
<p>16.更新防火墙规则</p>
<pre class="prettyprint"><code><span class="pln">firewall<span class="pun">-<span class="pln">cmd <span class="pun">--<span class="pln">reload<span class="pun">或<span class="pln">firewall<span class="pun">-<span class="pln">cmd <span class="pun">--<span class="pln">complete<span class="pun">-<span class="pln">reload<span class="pun">(两者的区别就是第一个无需断开连接，就是<span class="pln">firewalld<span class="pun">特性之一动态<span class="pln">
<span class="pun">添加规则，第二个需要断开连接，类似重启服务)</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></code></pre>
<p>17.查看指定区域所有打开的端口</p>
<pre class="prettyprint"><code><span class="pln">firewall<span class="pun">-<span class="pln">cmd <span class="pun">--<span class="pln">zone<span class="pun">=<span class="kwd">public<span class="pln"> <span class="pun">--<span class="pln">list<span class="pun">-<span class="pln">ports</span></span></span></span></span></span></span></span></span></span></span></span></code></pre>
<p>18.在指定区域打开端口（记得重启防火墙）</p>
<pre class="prettyprint"><code><span class="pln">firewall<span class="pun">-<span class="pln">cmd <span class="pun">--<span class="pln">zone<span class="pun">=<span class="kwd">public<span class="pln"> <span class="pun">--<span class="pln">add<span class="pun">-<span class="pln">port<span class="pun">=<span class="lit">80<span class="pun">/<span class="pln">tcp<span class="pun">(永久生效再加上<span class="pln"> <span class="pun">--<span class="pln">permanent<span class="pun">)</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></code></pre>
<blockquote>
<p>说明：<br>–zone 作用域<br>–add-port=8080/tcp 添加端口，格式为：端口/通讯协议<br>–permanent #永久生效，没有此参数重启后失效</p>
</blockquote>
<p>参考文章：</p>
<p>http://havee.me/linux/2015-01/using-firewalls-on-centos-7.html</p><br><br>
来源：https://www.cnblogs.com/inos/p/10985042.html
頁:
[1]