CentOS 7 firewall-cmd 防火牆管理完整指南

服務管理

暫時開放/關閉服務（重啟失效）

# firewall-cmd --add-service=ftp
# firewall-cmd --remove-service=ftp

永久開放/關閉服務（需重新載入生效）

# firewall-cmd --add-service=ftp --permanent
# firewall-cmd --remove-service=ftp --permanent
success

讓永久配置立即生效

# systemctl restart firewalld

驗證規則是否生效

# iptables -L -n | grep 21
ACCEPT     tcp  --  0.0.0.0/0  0.0.0.0/0  tcp dpt:21 ctstate NEW

狀態檢查

# firewall-cmd --state
running

# systemctl stop firewalld
# firewall-cmd --state
not running

查看完整區域配置

# firewall-cmd --list-all
public (default)
  interfaces:
  sources:
  services: dhcpv6-client ftp ssh
  ports:
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules:

內建服務列表

# firewall-cmd --get-services
amanda-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns ftp high-availability http https imaps ipp ipp-client ipsec kerberos kpasswd ldap ldaps libvirt libvirt-tls mdns mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s postgresql proxy-dhcp radius rpc-bind samba samba-client smtp ssh telnet tftp tftp-client transmission-client vnc-server wbem-https

查詢服務啟用狀態

# firewall-cmd --query-service ftp
yes
# firewall-cmd --query-service ssh
yes
# firewall-cmd --query-service samba
no
# firewall-cmd --query-service http
no

自定義端口開放

# firewall-cmd --add-port=3128/tcp
# firewall-cmd --list-all
public (default)
  interfaces:
  sources:
  services: dhcpv6-client ftp ssh
  ports: 3128/tcp
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules:

關鍵提示

• --permanent 參數修改永久配置，必須執行 firewall-cmd --reload 或 systemctl restart firewalld 才生效
• 無 --permanent 參數為執行時配置，立即生效但重啟後失效
• 建議同時設置執行時與永久配置，確保當前與重啟後均生效
• 服務名稱對應 /usr/lib/firewalld/services/ 下的 XML 定義檔