zone的用途)
一查看linux當(dāng)前的所有zone[rootblog ~]$ firewall-cmd --get-zones block dmz drop external home internal nm-shared public trusted work二各個(gè)zone的區(qū)別1, 一個(gè)網(wǎng)絡(luò)區(qū)域zone定義了網(wǎng)絡(luò)連接的信任級(jí)別trusted 區(qū) 受信任區(qū)。接受所有網(wǎng)絡(luò)連接。該區(qū)綁定的規(guī)則如網(wǎng)卡、源網(wǎng)段、服務(wù)等不受防火墻阻擋所有流量均可通過(guò)。internal 區(qū) 用于內(nèi)部網(wǎng)絡(luò)。home 區(qū) 用于家庭區(qū)域。work 區(qū) 用于工作區(qū)域。internal、home、work 這 3 個(gè)區(qū)你基本上相信網(wǎng)絡(luò)上的其他計(jì)算機(jī)不會(huì)損害你的計(jì)算機(jī)。只接受選定的傳入連接。dmz 區(qū) 用于在非軍事區(qū)內(nèi)可公開(kāi)訪問(wèn)但對(duì)內(nèi)部網(wǎng)絡(luò)有限制訪問(wèn)的計(jì)算機(jī)。只接受選定的傳入連接。external 區(qū) 用于啟用偽裝的外部網(wǎng)絡(luò)特別是路由器。你不相信網(wǎng)絡(luò)上的其他計(jì)算機(jī)不會(huì)損害你的計(jì)算機(jī)。只接受選定的傳入連接。public 區(qū) 在公共場(chǎng)所使用。你不相信網(wǎng)絡(luò)上的其他計(jì)算機(jī)不會(huì)損害你的計(jì)算機(jī)。只接受選定的傳入連接。block 區(qū) 任何傳入的網(wǎng)絡(luò)連接將被拒絕IPv4和IPv6將分別發(fā)送icmp-host- forbid消息和icmp6-adm- forbid消息。只有在這個(gè)系統(tǒng)內(nèi)發(fā)起的網(wǎng)絡(luò)連接是可能的。drop 區(qū) 任何傳入的網(wǎng)絡(luò)數(shù)據(jù)包被丟棄沒(méi)有應(yīng)答。只可能傳出網(wǎng)絡(luò)連接。2, 查看各個(gè)區(qū)默認(rèn)的規(guī)則:每個(gè)zone就是一組規(guī)則的集合如何查看它們默認(rèn)的規(guī)則有哪些?默認(rèn)規(guī)則的保存路徑:/usr/lib/firewalld/zones/上面的這個(gè)路徑可以用rpm查詢firewalld安裝包得到[rootblog zones]# rpm -ql firewalld | grep zones /etc/firewalld/zones /usr/lib/firewalld/zones/block.xml /usr/lib/firewalld/zones/dmz.xml /usr/lib/firewalld/zones/drop.xml /usr/lib/firewalld/zones/external.xml /usr/lib/firewalld/zones/home.xml /usr/lib/firewalld/zones/internal.xml /usr/lib/firewalld/zones/public.xml /usr/lib/firewalld/zones/trusted.xml /usr/lib/firewalld/zones/work.xml /usr/share/man/man5/firewalld.zones.5.gz進(jìn)入目錄后可以看到默認(rèn)zone的xml配置文件:[rootblog zones]# cd /usr/lib/firewalld/zones/ [rootblog zones]# ls block.xml dmz.xml drop.xml external.xml home.xml internal.xml nm-shared.xml public.xml trusted.xml work.xml3,查看各個(gè)zone規(guī)則的不同:drop.xml[rootblog zones]# more drop.xml ?xml version1.0 encodingutf-8? zone targetDROP shortDrop/short descriptionUnsolicited incoming network packets are dropped. Incoming packets that are related to outgoing network connections are accepted. Outgoing network connections are allowed./description forward/ /zoneblock[rootblog zones]# more block.xml ?xml version1.0 encodingutf-8? zone target%%REJECT%% shortBlock/short descriptionUnsolicited incoming network packets are rejected. Incoming packets that are related to outgoing network connections are accepted. Outgoing network connections are allowed./description forward/ /zonepublic[rootblog zones]# more public.xml ?xml version1.0 encodingutf-8? zone shortPublic/short descriptionFor use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted./description service namessh/ service namedhcpv6-client/ service namecockpit/ forward/ /zonetrusted[rootblog zones]# more trusted.xml ?xml version1.0 encodingutf-8? zone targetACCEPT shortTrusted/short descriptionAll network connections are accepted./description forward/ /zonework[rootblog zones]# more work.xml ?xml version1.0 encodingutf-8? zone shortWork/short descriptionFor use in work areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted./description service namessh/ service namedhcpv6-client/ service namecockpit/ forward/ /zonehome[rootblog zones]# more home.xml ?xml version1.0 encodingutf-8? zone shortHome/short descriptionFor use in home areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted./description service namessh/ service namemdns/ service namesamba-client/ service namedhcpv6-client/ service namecockpit/ forward/ /zonedmz[rootblog zones]# more dmz.xml ?xml version1.0 encodingutf-8? zone shortDMZ/short descriptionFor computers in your demilitarized zone that are publicly-accessible with limited access to your internal network. Only selected incoming connections are accepted ./description service namessh/ forward/ /zoneexternal[rootblog zones]# more external.xml ?xml version1.0 encodingutf-8? zone shortExternal/short descriptionFor use on external networks. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted./descrip tion service namessh/ masquerade/ forward/ /zoneinternal[rootblog zones]# more internal.xml ?xml version1.0 encodingutf-8? zone shortInternal/short descriptionFor use on internal networks. You mostly trust the other computers on the networks to not harm your computer. Only selected incoming connections are accepted./description service namessh/ service namemdns/ service namesamba-client/ service namedhcpv6-client/ service namecockpit/ forward/ /zone三查看九個(gè)內(nèi)置zone的默認(rèn)target1, 分別查詢:說(shuō)明可以看到:多數(shù)zone的target就是default,但有三個(gè)不同的zone:trusted: target為ACCEPTdrop: target為DROPblock: target為REJECT所以在生產(chǎn)環(huán)境中不會(huì)對(duì)這三個(gè)zone添加復(fù)雜的規(guī)則只是把它們作為白名單、黑名單使用[rootblog ~]# firewall-cmd --zonetrusted --permanent --get-target ACCEPT [rootblog ~]# firewall-cmd --zonepublic --permanent --get-target default [rootblog ~]# firewall-cmd --zonedrop --permanent --get-target DROP [rootblog ~]# firewall-cmd --zoneblock --permanent --get-target REJECT [rootblog ~]# firewall-cmd --zoneexternal --permanent --get-target default [rootblog ~]# firewall-cmd --zoneinternal --permanent --get-target default [rootblog ~]# firewall-cmd --zonedmz --permanent --get-target default [rootblog ~]# firewall-cmd --zonework --permanent --get-target default [rootblog ~]# firewall-cmd --zonehome --permanent --get-target default2,列出所有zone的規(guī)則:[rootblog ~]# firewall-cmd --list-all-zones四比較public/home/external/internal/work/dmz這六個(gè)zone的區(qū)別這六個(gè)zone的target同為default它們的區(qū)別在哪里?它們的不同之處在于默認(rèn)規(guī)則的不同1work/publicwork和public兩個(gè)zone相同都允許ssh/dhcpv6-client/cockpit三種服務(wù)的訪問(wèn)ssh不用說(shuō)了,dhcpv6-client是dhcpv6的客戶端所用的端口是:546如果不是動(dòng)態(tài)的ip建議關(guān)閉此服務(wù)cockpit: 紅帽開(kāi)發(fā)的網(wǎng)頁(yè)版圖像化服務(wù)管理工具優(yōu)點(diǎn)是無(wú)需中間層且可以管理多種服務(wù)它所用的端口是:9090如果不需要從圖形界面對(duì)服務(wù)器管理建議關(guān)閉此服務(wù)2home/internalhome和internal兩個(gè)zone相同都允許 ssh/mdns/samba-client/dhcpv6-client/cockpit五種服務(wù)的訪問(wèn)ssh/dhcpv6-client/cockpit 上面已講到samba-client提供samba服務(wù)的客戶端服務(wù)它的端口是:udp協(xié)議138mdnsmDNS是一種基于多播的服務(wù)發(fā)現(xiàn)協(xié)議通過(guò)它可以使設(shè)備在局域網(wǎng)內(nèi)自動(dòng)發(fā)現(xiàn)彼此的服務(wù),它的端口是:udp協(xié)議53533,dmz/externaldmz只提供ssh服務(wù),external則額外打開(kāi)了masquerade/:它用來(lái)開(kāi)啟端口轉(zhuǎn)發(fā)或代理上網(wǎng) firewalld: 各個(gè)zone的用途
一查看linux當(dāng)前的所有zone[rootblog ~]$ firewall-cmd --get-zones block dmz drop external home internal nm-shared public trusted work二各個(gè)zone的區(qū)別1, 一個(gè)網(wǎng)絡(luò)區(qū)域zone定義了網(wǎng)絡(luò)連接的信任級(jí)別trusted 區(qū) 受信任區(qū)。接受所有網(wǎng)絡(luò)連接。該區(qū)綁定的規(guī)則如網(wǎng)卡、源網(wǎng)段、服務(wù)等不受防火墻阻擋所有流量均可通過(guò)。internal 區(qū) 用于內(nèi)部網(wǎng)絡(luò)。home 區(qū) 用于家庭區(qū)域。work 區(qū) 用于工作區(qū)域。internal、home、work 這 3 個(gè)區(qū)你基本上相信網(wǎng)絡(luò)上的其他計(jì)算機(jī)不會(huì)損害你的計(jì)算機(jī)。只接受選定的傳入連接。dmz 區(qū) 用于在非軍事區(qū)內(nèi)可公開(kāi)訪問(wèn)但對(duì)內(nèi)部網(wǎng)絡(luò)有限制訪問(wèn)的計(jì)算機(jī)。只接受選定的傳入連接。external 區(qū) 用于啟用偽裝的外部網(wǎng)絡(luò)特別是路由器。你不相信網(wǎng)絡(luò)上的其他計(jì)算機(jī)不會(huì)損害你的計(jì)算機(jī)。只接受選定的傳入連接。public 區(qū) 在公共場(chǎng)所使用。你不相信網(wǎng)絡(luò)上的其他計(jì)算機(jī)不會(huì)損害你的計(jì)算機(jī)。只接受選定的傳入連接。block 區(qū) 任何傳入的網(wǎng)絡(luò)連接將被拒絕IPv4和IPv6將分別發(fā)送icmp-host- forbid消息和icmp6-adm- forbid消息。只有在這個(gè)系統(tǒng)內(nèi)發(fā)起的網(wǎng)絡(luò)連接是可能的。drop 區(qū) 任何傳入的網(wǎng)絡(luò)數(shù)據(jù)包被丟棄沒(méi)有應(yīng)答。只可能傳出網(wǎng)絡(luò)連接。2, 查看各個(gè)區(qū)默認(rèn)的規(guī)則:每個(gè)zone就是一組規(guī)則的集合如何查看它們默認(rèn)的規(guī)則有哪些?默認(rèn)規(guī)則的保存路徑:/usr/lib/firewalld/zones/上面的這個(gè)路徑可以用rpm查詢firewalld安裝包得到[rootblog zones]# rpm -ql firewalld | grep zones /etc/firewalld/zones /usr/lib/firewalld/zones/block.xml /usr/lib/firewalld/zones/dmz.xml /usr/lib/firewalld/zones/drop.xml /usr/lib/firewalld/zones/external.xml /usr/lib/firewalld/zones/home.xml /usr/lib/firewalld/zones/internal.xml /usr/lib/firewalld/zones/public.xml /usr/lib/firewalld/zones/trusted.xml /usr/lib/firewalld/zones/work.xml /usr/share/man/man5/firewalld.zones.5.gz進(jìn)入目錄后可以看到默認(rèn)zone的xml配置文件:[rootblog zones]# cd /usr/lib/firewalld/zones/ [rootblog zones]# ls block.xml dmz.xml drop.xml external.xml home.xml internal.xml nm-shared.xml public.xml trusted.xml work.xml3,查看各個(gè)zone規(guī)則的不同:drop.xml[rootblog zones]# more drop.xml ?xml version1.0 encodingutf-8? zone targetDROP shortDrop/short descriptionUnsolicited incoming network packets are dropped. Incoming packets that are related to outgoing network connections are accepted. Outgoing network connections are allowed./description forward/ /zoneblock[rootblog zones]# more block.xml ?xml version1.0 encodingutf-8? zone target%%REJECT%% shortBlock/short descriptionUnsolicited incoming network packets are rejected. Incoming packets that are related to outgoing network connections are accepted. Outgoing network connections are allowed./description forward/ /zonepublic[rootblog zones]# more public.xml ?xml version1.0 encodingutf-8? zone shortPublic/short descriptionFor use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted./description service namessh/ service namedhcpv6-client/ service namecockpit/ forward/ /zonetrusted[rootblog zones]# more trusted.xml ?xml version1.0 encodingutf-8? zone targetACCEPT shortTrusted/short descriptionAll network connections are accepted./description forward/ /zonework[rootblog zones]# more work.xml ?xml version1.0 encodingutf-8? zone shortWork/short descriptionFor use in work areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted./description service namessh/ service namedhcpv6-client/ service namecockpit/ forward/ /zonehome[rootblog zones]# more home.xml ?xml version1.0 encodingutf-8? zone shortHome/short descriptionFor use in home areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted./description service namessh/ service namemdns/ service namesamba-client/ service namedhcpv6-client/ service namecockpit/ forward/ /zonedmz[rootblog zones]# more dmz.xml ?xml version1.0 encodingutf-8? zone shortDMZ/short descriptionFor computers in your demilitarized zone that are publicly-accessible with limited access to your internal network. Only selected incoming connections are accepted ./description service namessh/ forward/ /zoneexternal[rootblog zones]# more external.xml ?xml version1.0 encodingutf-8? zone shortExternal/short descriptionFor use on external networks. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted./descrip tion service namessh/ masquerade/ forward/ /zoneinternal[rootblog zones]# more internal.xml ?xml version1.0 encodingutf-8? zone shortInternal/short descriptionFor use on internal networks. You mostly trust the other computers on the networks to not harm your computer. Only selected incoming connections are accepted./description service namessh/ service namemdns/ service namesamba-client/ service namedhcpv6-client/ service namecockpit/ forward/ /zone三查看九個(gè)內(nèi)置zone的默認(rèn)target1, 分別查詢:說(shuō)明可以看到:多數(shù)zone的target就是default,但有三個(gè)不同的zone:trusted: target為ACCEPTdrop: target為DROPblock: target為REJECT所以在生產(chǎn)環(huán)境中不會(huì)對(duì)這三個(gè)zone添加復(fù)雜的規(guī)則只是把它們作為白名單、黑名單使用[rootblog ~]# firewall-cmd --zonetrusted --permanent --get-target ACCEPT [rootblog ~]# firewall-cmd --zonepublic --permanent --get-target default [rootblog ~]# firewall-cmd --zonedrop --permanent --get-target DROP [rootblog ~]# firewall-cmd --zoneblock --permanent --get-target REJECT [rootblog ~]# firewall-cmd --zoneexternal --permanent --get-target default [rootblog ~]# firewall-cmd --zoneinternal --permanent --get-target default [rootblog ~]# firewall-cmd --zonedmz --permanent --get-target default [rootblog ~]# firewall-cmd --zonework --permanent --get-target default [rootblog ~]# firewall-cmd --zonehome --permanent --get-target default2,列出所有zone的規(guī)則:[rootblog ~]# firewall-cmd --list-all-zones四比較public/home/external/internal/work/dmz這六個(gè)zone的區(qū)別這六個(gè)zone的target同為default它們的區(qū)別在哪里?它們的不同之處在于默認(rèn)規(guī)則的不同1work/publicwork和public兩個(gè)zone相同都允許ssh/dhcpv6-client/cockpit三種服務(wù)的訪問(wèn)ssh不用說(shuō)了,dhcpv6-client是dhcpv6的客戶端所用的端口是:546如果不是動(dòng)態(tài)的ip建議關(guān)閉此服務(wù)cockpit: 紅帽開(kāi)發(fā)的網(wǎng)頁(yè)版圖像化服務(wù)管理工具優(yōu)點(diǎn)是無(wú)需中間層且可以管理多種服務(wù)它所用的端口是:9090如果不需要從圖形界面對(duì)服務(wù)器管理建議關(guān)閉此服務(wù)2home/internalhome和internal兩個(gè)zone相同都允許 ssh/mdns/samba-client/dhcpv6-client/cockpit五種服務(wù)的訪問(wèn)ssh/dhcpv6-client/cockpit 上面已講到samba-client提供samba服務(wù)的客戶端服務(wù)它的端口是:udp協(xié)議138mdnsmDNS是一種基于多播的服務(wù)發(fā)現(xiàn)協(xié)議通過(guò)它可以使設(shè)備在局域網(wǎng)內(nèi)自動(dòng)發(fā)現(xiàn)彼此的服務(wù),它的端口是:udp協(xié)議53533,dmz/externaldmz只提供ssh服務(wù),external則額外打開(kāi)了masquerade/:它用來(lái)開(kāi)啟端口轉(zhuǎn)發(fā)或代理上網(wǎng)