2023年6月27日发(作者：)

firewalld富规则

1.富规则语法[root@web02 ~]# man nguagerule [source] [destination] service|port|protocol|icmp-block|icmp-type|masquerade|forward-port|source-port [log] [audit] [accept|reject|drop|mark]

rule [family="ipv4|ipv6"]source [not] address="address[/mask]"|mac="mac-address"|ipset="ipset"destination [not] address="address[/mask]"service name="service name" port port="port value" protocol="tcp|udp" protocol value="protocol value" forward-port port="port value" protocol="tcp|udp" to-port="port value" to-addr="address" source-port port="port value" protocol="tcp|udp"[accept|reject|drop|mark]#富语⾔规则相关命令--add-rich-rule='' #在指定的区域添加⼀条富语⾔规则--remove-rich-rule='' #在指定的区删除⼀条富语⾔规则--query-rich-rule='' #找到规则返回0，找不到返回1--list-rich-rules #列出指定区⾥的所有富语⾔规则

2.富规则实例⼀允许10.0.0.1主机能够访问http服务，允许172.16.1.0/24能访问111端⼝#允许10.0.0.1主机能够访问http服务[root@web02 ~]# firewall-cmd --add-rich-rule='rule family=ipv4 source address=10.0.0.1 service name=http accept'success#允许172.16.1.0/24能访问111端⼝[root@web02 ~]# firewall-cmd --add-rich-rule='rule family=ipv4 source address=172.16.1.0/24 port port=111 protocol=tcp accept'success

3.富规则实例⼆默认public区域对外开放所有⼈能通过ssh服务连接，但拒绝172.16.1.0/24⽹段通过ssh连接服务器[root@web02 ~]# firewall-cmd --add-service=ssh#但拒绝172.16.1.0/24⽹段通过ssh连接服务器1.⽅式⼀：[root@web02 ~]# firewall-cmd --add-rich-rule='rule family=ipv4 source address=172.16.1.0/24 service name=ssh reject'success#连接返回结果[root@web01 ~]# ssh 172.16.1.8 22ssh: connect to host 172.16.1.8 port 22: Connection refused2.⽅式⼆：[root@web02 ~]# firewall-cmd --add-rich-rule='rule family=ipv4 source address=172.16.1.0/24 service name=ssh drop'success#连接返回结果[root@web01 ~]# ssh 172.16.1.8 22ssh: connect to host 172.16.1.8 port 22: Connection timed out#drop和reject区别reject直接拒绝，返回拒绝drop是丢弃，直到超时

4.富规则实例三当⽤户来源IP地址是10.0.0.1主机，则将⽤户请求的5555端⼝转发⾄后端172.16.1.7的22端⼝[root@web02 ~]# firewall-cmd --add-rich-rule='rule family=ipv4 source address=10.0.0.1 forward-port port=5555 protocol=tcp to-port=22 to-addr=172.16.1.7'success[root@web02 ~]# firewall-cmd --add-masquerade

success

5.防⽕墙配置⽹站禁ping[root@web02 ~]# firewall-cmd --add-rich-rule='rule family=ipv4 protocol value=icmp drop'success