centos防火墙规则设置

systemctl start firewalld
systemctl enable firewalld

[root@ecs-kunpeng ~]# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
   Active: active (running) since Tue 2021-06-22 09:30:11 CST; 10min ago
     Docs: man:firewalld(1)
 Main PID: 21380 (firewalld)
    Tasks: 2 (limit: 1538)
   Memory: 33.3M
   CGroup: /system.slice/firewalld.service
           └─21380 /usr/libexec/platform-python -s /usr/sbin/firewalld --nofork --nopid

Jun 22 09:30:11 ecs-kunpeng systemd[1]: Starting firewalld - dynamic firewall daemon...
Jun 22 09:30:11 ecs-kunpeng systemd[1]: Started firewalld - dynamic firewall daemon.

[root@ecs-kunpeng ~]# firewall-cmd --list-ports
8024/tcp 33389/tcp 8080/tcp 443/tcp

[root@ecs-kunpeng ~]# firewall-cmd --state
running

[root@ecs-kunpeng ~]# firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources: 
  services: cockpit dhcpv6-client ssh
  ports: 8024/tcp 33389/tcp 8080/tcp 443/tcp
  protocols: 
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 
        rule family="ipv4" source address="49.74.123.90" port port="8024" protocol="tcp" accept
        rule family="ipv4" source address="39.144.2.184" port port="8024" protocol="tcp" accept

#允许ip192.168.0.1访问9001端口
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="192.168.0.1" port protocol="tcp" port="9001" accept"
# source address="192.168.0.1"//访问端口的公网IP地址
# port="9001" //访问客户端的端口号
#重新载入一下防火墙设置，使设置生效
firewall-cmd --reload
#查看已设置规则
firewall-cmd --zone=public --list-rich-rules

#停止客户端运行nps服务
#移除ip192.168.0.1访问9001端口
firewall-cmd --permanent --remove-rich-rule="rule family="ipv4" source address="192.168.0.1" port protocol="tcp" port="9001" accept"
#重新载入一下防火墙设置，使设置生效
firewall-cmd --reload
#查看已设置规则
firewall-cmd --zone=public --list-rich-rules
[root@ecs-kunpeng ~]# firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources: 
  services: cockpit dhcpv6-client ssh
  ports: 8024/tcp 33389/tcp 8080/tcp 443/tcp
  protocols: 
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 
        rule family="ipv4" source address="39.144.2.184" port port="8024" protocol="tcp" accept
        rule family="ipv4" source address="49.74.123.90" port port="8024" protocol="tcp" accept
        rule family="ipv4" source address="223.104.147.74" port port="8024" protocol="tcp" accept