#查看防火墙状态：
firewall-cmd --state
#启动firewall：
systemctl start firewalld.service
#设置开机自启：
systemctl enable firewalld.service
#重启防火墙：
systemctl restart firewalld.service
1. 查看默认防火墙状态（关闭后显示notrunning，开启后显示running）
firewall-cmd --state
2. 查看防火墙规则（只显示/etc/firewalld/zones/public.xml中防火墙策略）
firewall-cmd --list-all
3. 查看所有的防火墙策略（即显示/etc/firewalld/zones/下的所有策略）
firewall-cmd --list-all-zones
#对外开放65530端口
firewall-cmd --permanent --add-port=65530/tcp
firewall-cmd --permanent --add-port=80/tcp
#关闭端口
firewall-cmd --permanent --remove-port=65530/tcp
firewall-cmd --permanent --remove-port=22/tcp
firewall-cmd --permanent --remove-service=ssh #--zone=public
#添加规则
firewall-cmd --permanent --remove-service=ssh
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="192.168.1.194/32" port protocol="tcp" port="22" accept"
#reload使生效
firewall-cmd --reload
systemctl restart firewalld.service
配置内容
vi /etc/firewalld/zones/public.xml
删除是add换remove
===================================================================================================
失败!
首先开启linux转发功能
#临时开启方法:
echo "1" > /proc/sys/net/ipv4/ip_forward #该文件内容为0，表示禁止数据包转发，1表示允许，将其修改为1。
#永久开启方法
echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf
sysctl -p
CentOS7则是在 /usr/lib/sysctl.d/50-default.conf额外添加
iptables -t nat -A PREROUTING -p tcp --dport [端口] -j DNAT --to-destination [目标IP:端口]
#外网服务器上的2222端口代理到内网服务器的22端口。
iptables -t nat -A PREROUTING -p tcp --dport 2222 -j DNAT --to-destination 192.168.9.134:22
iptables -t nat -A POSTROUTING -p tcp -d [目标IP] --dport [端口] -j SNAT --to-source [本地服务器公网IP]
#修改转发数据来源为内网网卡IP。
iptables -t nat -A POSTROUTING -p tcp -d 192.168.9.134/32 --sport 22 -j SNAT --to-source 192.168.9.101
iptables -t nat -A PREROUTING -p udp --dport [端口] -j DNAT --to-destination [目标IP:端口]
iptables -t nat -A POSTROUTING -p udp -d [目标IP] --dport [端口] -j SNAT --to-source [本地服务器公网IP]
其中端口指你要开放的本地转发端口。目标IP:端口是国外vps的IP和需要转发的端口，这样就开启了tcp和udp中转，然后重启一下iptables就可以进行测试了
同样的centos7的firewalld也可以实现上述功能，直接几条命令就可以了
firewall-cmd --permanent --add-port=端口/tcp #开启本地tcp中转端口
firewall-cmd --permanent --add-port=端口/udp #开启本地udp中转端口
firewall-cmd --permanent --add-masquerade #添加伪装
firewall-cmd --permanent --add-forward-port=port=端口:proto=tcp:toport=vps端口:toaddr=x.x.x.x(vps IP) #建立tcp远程中转端口转发
firewall-cmd --permanent --add-forward-port=port=端口:proto=udp:toport=vps端口:toaddr=x.x.x.x(vps IP) #建立udp远程中转端口转发
firewall-cmd --reload #重启firewalld
-------------------------------------------------
#!/bin/sh
echo "**********CLEAR DEFAULT CHAIN**********"
iptables -F
echo "**********CLEAR CUSTOM CHAIN**********"
iptables -X
echo "**********SET CHAIN DROP**********"
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
echo "**********APPEPT PING**********"
iptables -A OUTPUT -p icmp -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT
echo "**********ACCEPT LOOPBACK**********"
iptables -A INPUT -i lo -p all -j ACCEPT
iptables -A OUTPUT -o lo -p all -j ACCEPT
echo "**********PORTS**********"
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 1520 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 1520 -j ACCEPT
iptables -A INPUT -p tcp --dport 1521 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 1521 -j ACCEPT
iptables -A INPUT -p tcp --dport 1522 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 1522 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -d 10.94.18.245 --dport 1522 -j DNAT --to-destination 10.94.15.155:1521
iptables -t nat -A POSTROUTING -p tcp -s 10.94.15.155 --sport 1521 -j SNAT --to-source 10.94.18.245:1522
echo "**********SAVE CONFIG**********"
/etc/rc.d/init.d/iptables save
echo "**********SET SERVICE ON**********"
chkconfig iptables on
echo "**********START**********"
/etc/rc.d/init.d/iptables restart
read -p "Press enter to continue..."
====================================================================================================
iptable
====================================================================================================
##################################################
#iptables new-web by zy
##################################################
#!/bin/sh
echo "********************CLEAR********************"
iptables -F
iptables -X
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
echo "********************ACCEPT********************"
iptables -A INPUT -p icmp -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp -s 10.94.15.133 --dport 22 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp -s 10.94.18.246 --dport 22 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#RELATED ACCEPT允许已经建立连接的通过,这样nginx反向代理就不会time out
echo "********************REJECT********************"
iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited
iptables -A FORWARD -j REJECT --reject-with icmp-host-prohibited
echo "********************SAVE CONFIG********************"
/etc/rc.d/init.d/iptables save
chkconfig iptables on
/etc/rc.d/init.d/iptables restart
read -p "Press enter to continue..."
##################################################
#iptables new-db by zy
##################################################
#!/bin/sh
echo "********************CLEAR********************"
iptables -F
iptables -X
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
echo "********************ACCEPT********************"
iptables -A INPUT -p icmp -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp -s 10.94.15.133 --dport 22 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp -s 10.94.18.246 --dport 22 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp -s 10.94.15.130 --dport 1521 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp -s 10.94.15.133 --dport 1521 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp -s 10.94.18.246 --dport 1521 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp -s 10.94.18.249 --dport 1521 -j ACCEPT
#RELATED ACCEPT允许已经建立连接的通过,这样nginx反向代理就不会time out
echo "********************REJECT********************"
iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited
iptables -A FORWARD -j REJECT --reject-with icmp-host-prohibited
echo "********************SAVE CONFIG********************"
/etc/rc.d/init.d/iptables save
chkconfig iptables on
/etc/rc.d/init.d/iptables restart
read -p "Press enter to continue..."
---------------------------------------------------------------------------------------------------
##################################################
# config iptables web 2019.07.01 by zy
##################################################
#!/bin/sh
echo "**********CLEAR DEFAULT CHAIN**********"
iptables -F
echo "**********CLEAR CUSTOM CHAIN**********"
iptables -X
echo "**********SET CHAIN DROP**********"
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
echo "**********APPEPT PING**********"
iptables -A OUTPUT -p icmp -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT
echo "**********ACCEPT LOOPBACK**********"
iptables -A INPUT -i lo -p all -j ACCEPT
iptables -A OUTPUT -o lo -p all -j ACCEPT
echo "**********MANAGER**********"
iptables -A INPUT -s 10.94.15.133 -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -d 10.94.15.133 -p tcp --sport 22 -j ACCEPT
iptables -A INPUT -s 10.94.18.246 -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -d 10.94.18.246 -p tcp --sport 22 -j ACCEPT
echo "**********PORTS**********"
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 80 -j ACCEPT
echo "**********WHITE IP**********"
#iptables -I OUTPUT 1 -d 172.16.201.0/24 -j ACCEPT
#iptables -I INPUT 1 -s 172.16.201.0/24 -j ACCEPT
echo "**********BLACK IP**********"
#iptables -I INPUT 1 -s 211.103.81.58 -j DROP
echo "**********SAVE CONFIG**********"
/etc/rc.d/init.d/iptables save
echo "**********SET SERVICE ON**********"
chkconfig iptables on
echo "**********START**********"
/etc/rc.d/init.d/iptables restart
read -p "Press enter to continue..."
##################################################
# config iptables 10.94.15.155 2019.07.01 by zy
##################################################
#!/bin/sh
echo "**********CLEAR DEFAULT CHAIN**********"
iptables -F
echo "**********CLEAR CUSTOM CHAIN**********"
iptables -X
echo "**********SET CHAIN DROP**********"
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
echo "**********APPEPT PING**********"
iptables -A OUTPUT -p icmp -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT
echo "**********ACCEPT LOOPBACK**********"
iptables -A INPUT -i lo -p all -j ACCEPT
iptables -A OUTPUT -o lo -p all -j ACCEPT
echo "**********MANAGER**********"
iptables -A INPUT -s 10.94.15.133 -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -d 10.94.15.133 -p tcp --sport 22 -j ACCEPT
iptables -A INPUT -s 10.94.18.246 -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -d 10.94.18.246 -p tcp --sport 22 -j ACCEPT
#wcm#backup
iptables -A INPUT -s 10.94.15.130 -p tcp --dport 1521 -j ACCEPT
iptables -A OUTPUT -d 10.94.15.130 -p tcp --sport 1521 -j ACCEPT
iptables -A INPUT -s 10.94.15.133 -p tcp --dport 1521 -j ACCEPT
iptables -A OUTPUT -d 10.94.15.133 -p tcp --sport 1521 -j ACCEPT
iptables -A INPUT -s 10.94.18.246 -p tcp --dport 1521 -j ACCEPT
iptables -A OUTPUT -d 10.94.18.246 -p tcp --sport 1521 -j ACCEPT
iptables -A INPUT -s 10.94.18.249 -p tcp --dport 1521 -j ACCEPT
iptables -A OUTPUT -d 10.94.18.249 -p tcp --sport 1521 -j ACCEPT
echo "**********PORTS**********"
#iptables -A INPUT -p tcp --dport 80 -j ACCEPT
#iptables -A OUTPUT -p tcp --sport 80 -j ACCEPT
echo "**********WHITE IP**********"
#iptables -I OUTPUT 1 -d 172.16.201.0/24 -j ACCEPT
#iptables -I INPUT 1 -s 172.16.201.0/24 -j ACCEPT
echo "**********BLACK IP**********"
#iptables -I INPUT 1 -s 211.103.81.58 -j DROP
echo "**********SAVE CONFIG**********"
/etc/rc.d/init.d/iptables save
echo "**********SET SERVICE ON**********"
chkconfig iptables on
echo "**********START**********"
/etc/rc.d/init.d/iptables restart
read -p "Press enter to continue..."