firewalld 방화벽

CentOS 7 부터 방화벽으로 firewalld 를 사용한다. port 나 대역 설정 등을 주로 한다. 아마도 기존 iptables 보다 설정이 간편할 것이다.

 

• 여러 zone 생성 가능
• zone 마다 각종 service, port, ip 등 설정 가능
• 필요에 맞게 하나의 zone 을 활성화
• default zone 은 public

 

가장 많이 사용하는 구문은 포트 열고 적용하고.

 

# firewall-cmd --zone=public --add-port=8080/tcp
success
# firewall-cmd --reload
success

 

 

1. 데몬 확인 (start/stop/status)

 

# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
   Active: active (running) since Sat 2021-07-10 23:31:53 EDT; 1h 29min ago
     Docs: man:firewalld(1)
 Main PID: 687 (firewalld)
   CGroup: /system.slice/firewalld.service
           └─687 /usr/bin/python2 -Es /usr/sbin/firewalld --nofork --nopid

Jul 10 23:31:53 localhost.localdomain systemd[1]: Starting firewalld - dynamic firewall daemon...
Jul 10 23:31:53 localhost.localdomain systemd[1]: Started firewalld - dynamic firewall daemon.
Jul 10 23:31:53 localhost.localdomain firewalld[687]: WARNING: AllowZoneDrifting is enabled. This is co...ow.
Hint: Some lines were ellipsized, use -l to show in full.

 

# firewall-cmd --state
running

 

 

2. 모든 zone 이름 확인

 

# firewall-cmd --get-zones
block dmz drop external home internal public trusted work

 

 

3. 기본 zone 확인

 

# firewall-cmd --get-default-zone
public

 

 

4. 기본 zone 을 home 으로 변경

 

# firewall-cmd --set-default-zone=home
# firewall-cmd --get-default-zone
home

 

 

5. public zone 의 설정 확인

 

# firewall-cmd --zone=public --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: ens33
  sources:
  services: dhcpv6-client ssh
  ports: 1521/tcp
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

 

현재 public zone 설정을 보면 ssh services 와 1521 포트가 열린 것을 확인할 수 있다. 알려진 포트들에 대해서는 services 로 등록을 해도 되고, 다른 포트를 사용하고 싶다 하면 직접 포트를 추가해도 된다. service 에 ssh 를 추가하나, 포트 22번을 여는 거나 동일한 결과란 뜻.

 

 

6. 서비스 추가/삭제 (즉시 적용)

 

# firewall-cmd --zone=public --add-service=mysql
# firewall-cmd --zone=public --remove-service=mysql

 

 

7. port 추가/삭제 (즉시 적용)

 

# firewall-cmd --zone=public --add-port=8081/tcp
# firewall-cmd --zone=public --remove-port=8081/tcp
# firewall-cmd --zone=public --add-port=8081-8090/tcp
# firewall-cmd --zone=public --remove-port=8081-8090/tcp

 

 

8. 영구 적용 (reload 후 적용)

 

# firewall-cmd --zone=public --add-service=mysql --permanent
# firewall-cmd --reload

 

--pormanent 를 제외하면 재부팅이나 데몬 재시작 할 경우 해당 설정은 사라진다.
또한 reload 로 설정을 재적용하지 않으면 반영되지 않는다.

 

 

9. IP 추가/삭제

 

# firewall-cmd --add-source=192.168.0.2 --permanent 
# firewall-cmd --remove-source=192.168.0.2 --permanent

 

 

10. IP 대역 추가/삭제

 

# firewall-cmd --add-source=192.168.0.0/24 --permanent 
# firewall-cmd --remove-source=192.168.0.0/24 --permanent

 

 

11. IP 대역 / 특정 포트 추가/삭제

 

# firewall-cmd --add-rich-rule='rule family="ipv4" source address=192.168.0.0/24 port port="8081" protocol="tcp" accept' --permanent
# firewall-cmd --remove-rich-rule='rule family="ipv4" source address=192.168.0.0/24 port port="8081" protocol="tcp" accept' --permanent