https://bk1314.com/tag/CentOS7/ https://bk1314.com/12.html 2022-02-23T16:45:00+08:00 1.查看已开放的端口firewall-cmd --list-ports2.开放端口（开放后需要要重启防火墙才生效）firewall-cmd --zone=public --add-port=3338/tcp --permanent3.关闭端口（关闭后需要要重启防火墙才生效）firewall-cmd --zone=public --remove-port=3338/tcp --permanent4.重启防火墙firewall-cmd --reload5.开机启动防火墙systemctl enable firewalld6.开启防火墙systemctl start firewalld7.禁止防火墙开机启动systemctl disable firewalld8.停止/关闭防火墙systemctl stop firewalld9.开启系统路由模式功能# 开启系统路由模式功能 echo net.ipv4.ip_forward=1>>/etc/sysctl.conf #使内核修改生效 sysctl -p下面是转发端口/端口映射防火墙管理命令 firewall-cmd 端口转发[scode type="red"]转发之前一定要注意的[/scode]设置IP地址伪装firewall-cmd --add-masquerade --permanent1.转发规则# 格式 port=<源端口号>:proto=<匹配协议>:toport=<目的端口号>[:toaddr=<目的IP地址>] # 示例 port=888:proto=tcp:toport=22 # 将888端口的tcp流量转发至22端口 port=8080:proto=tcp:toport=80 # 将8080端口的tcp流量转发至80端口 port=8081:proto=tcp:toport=80:toaddr=192.168.10.10 # 将8081端口的tcp流量转发至192.168.10.10的80端口2.完整示例# 查看永久生效模式下，已配置的端口转发规则 firewall-cmd --permanent --list-forward-ports # 将888端口的tcp流量转发至22端口，永久生效模式 firewall-cmd --permanent --add-forward-port=port=888:proto=tcp:toport=22 # 将8081端口的tcp流量转发至192.168.10.10的80端口，永久生效模式 firewall-cmd --permanent --add-forward-port=port=8080:proto=tcp:toport=80:toaddr=192.168.10.10 # 查看当前生效的端口转发规则 firewall-cmd --list-forward-ports #查看所有规则 firewall-cmd --list-all # 删除已配置的转发规则(添加的有哪些参数删除的时候也要有还要端口,支持888-999格式) firewall-cmd --remove-forward-port=port=888:proto=tcp:toport=22 # 仅当前有效 firewall-cmd --permanent --remove-forward-port=port=888:proto=tcp:toport=22 # 永久有效 firewall-cmd --reload # 使配置的永久有效规则立即生效scode type="share"参考资料:https://blog.csdn.net/weixin_46310295/article/details/107704545https://www.cnblogs.com/nhdlb/p/11910615.htmlhttps://www.cnblogs.com/cnsevennight/p/13141421.htmlhttps://blog.csdn.net/teisite/article/details/84999582https://www.linuxprobe.com/chapter-08.html#83_Firewalldhttps://www.cnblogs.com/shawhe/p/11050088.html