Centos 7 Firewall

Состояние сервиса

[root@localhost log]#  systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
   Active: active (running) since Tue 2015-12-29 14:11:09 YEKT; 3 weeks 6 days ago
 Main PID: 634 (firewalld)
   CGroup: /system.slice/firewalld.service
           └─634 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid

Dec 29 14:11:07 localhost.localdomain systemd[1]: Starting firewalld - dynamic firewall daemon...
Dec 29 14:11:09 localhost.localdomain systemd[1]: Started firewalld - dynamic firewall daemon.

Состояние сервиса

[root@localhost log]# firewall-cmd --state
running

[root@localhost log]# firewall-cmd --get-default-zone
public

[root@localhost log]# firewall-cmd --get-active-zones
public
  interfaces: ens192

[root@localhost log]# firewall-cmd --list-all
public (default, active)
  interfaces: ens192
  sources:
  services: dhcpv6-client ssh
  ports:
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules:

[root@localhost log]# firewall-cmd --get-zones
block dmz drop external home internal public trusted work

Посмотреть правила для какой либо зоны

[root@localhost]# firewall-cmd --get-zones
block dmz drop external home internal public trusted work
[root@localhost]# firewall-cmd --zone=internal --list-all
internal
  interfaces:
  sources:
  services: dhcpv6-client ipp-client mdns samba-client ssh
  ports:
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules:

Изменить зону на интерфейсе в текущей сессии (временно, до перезагрузки)

sudo firewall-cmd --zone=home --change-interface=ifcfg-ens192

Добавить интерфейс в зону (постоянно)

[root@localhost /]# cat /etc/sysconfig/network-scripts/ifcfg-ens192
 . . .
TYPE="Ethernet"
BOOTPROTO="dhcp"
DEFROUTE="yes"
ZONE=internal
 . . .

чтобы применить изменения
systemctl restart network.service
systemctl restart firewalld.service
посмотреть сервисы привязанные к зоне

[root@localhost]# firewall-cmd --zone=internal --list-services
dhcpv6-client ipp-client mdns samba-client ssh

Пример, добавил сервис DNS, не забыть перегрузить правила

[root@localhost network-scripts]# firewall-cmd --zone=public --list-services
dhcpv6-client ssh
[root@localhost network-scripts]# firewall-cmd --zone=internal --list-services
dhcpv6-client ipp-client mdns samba-client ssh
[root@localhost network-scripts]# firewall-cmd --zone=internal --permanent --add-service=dns
success
[root@localhost network-scripts]# firewall-cmd --zone=internal --list-services
dhcpv6-client ipp-client mdns samba-client ssh
[root@localhost network-scripts]# firewall-cmd --reload
success
[root@localhost network-scripts]# firewall-cmd --zone=internal --list-services
dhcpv6-client dns ipp-client mdns samba-client ssh
[root@localhost network-scripts]#