Состояние сервиса
[root@localhost log]# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
Active: active (running) since Tue 2015-12-29 14:11:09 YEKT; 3 weeks 6 days ago
Main PID: 634 (firewalld)
CGroup: /system.slice/firewalld.service
└─634 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid
Dec 29 14:11:07 localhost.localdomain systemd[1]: Starting firewalld - dynamic firewall daemon...
Dec 29 14:11:09 localhost.localdomain systemd[1]: Started firewalld - dynamic firewall daemon.
Состояние сервиса
[root@localhost log]# firewall-cmd --state
running
[root@localhost log]# firewall-cmd --get-default-zone
public
[root@localhost log]# firewall-cmd --get-active-zones
public
interfaces: ens192
[root@localhost log]# firewall-cmd --list-all
public (default, active)
interfaces: ens192
sources:
services: dhcpv6-client ssh
ports:
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
[root@localhost log]# firewall-cmd --get-zones
block dmz drop external home internal public trusted work
Посмотреть правила для какой либо зоны
[root@localhost]# firewall-cmd --get-zones
block dmz drop external home internal public trusted work
[root@localhost]# firewall-cmd --zone=internal --list-all
internal
interfaces:
sources:
services: dhcpv6-client ipp-client mdns samba-client ssh
ports:
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
Изменить зону на интерфейсе в текущей сессии (временно, до перезагрузки)
sudo firewall-cmd --zone=home --change-interface=ifcfg-ens192
Добавить интерфейс в зону (постоянно)
[root@localhost /]# cat /etc/sysconfig/network-scripts/ifcfg-ens192
. . .
TYPE="Ethernet"
BOOTPROTO="dhcp"
DEFROUTE="yes"
ZONE=internal
. . .
чтобы применить изменения
systemctl restart network.service
systemctl restart firewalld.service
посмотреть сервисы привязанные к зоне
[root@localhost]# firewall-cmd --zone=internal --list-services
dhcpv6-client ipp-client mdns samba-client ssh
Пример, добавил сервис DNS, не забыть перегрузить правила
[root@localhost network-scripts]# firewall-cmd --zone=public --list-services
dhcpv6-client ssh
[root@localhost network-scripts]# firewall-cmd --zone=internal --list-services
dhcpv6-client ipp-client mdns samba-client ssh
[root@localhost network-scripts]# firewall-cmd --zone=internal --permanent --add-service=dns
success
[root@localhost network-scripts]# firewall-cmd --zone=internal --list-services
dhcpv6-client ipp-client mdns samba-client ssh
[root@localhost network-scripts]# firewall-cmd --reload
success
[root@localhost network-scripts]# firewall-cmd --zone=internal --list-services
dhcpv6-client dns ipp-client mdns samba-client ssh
[root@localhost network-scripts]#
