http://pollochang.work/tags/firewalld/ Recent content in Firewalld on PolloChang 工作筆記 Hugo -- gohugo.io zh-TW © 2026 PolloChang Thu, 21 Nov 2024 23:05:07 +0800 http://pollochang.work/worknot/%E9%97%9C%E9%96%89centos7%E9%98%B2%E7%81%AB%E7%89%86firewalld%E6%94%B9%E7%94%A8%E5%82%B3%E7%B5%B1%E7%9A%84iptables/ Thu, 21 Nov 2024 23:05:07 +0800 http://pollochang.work/worknot/%E9%97%9C%E9%96%89centos7%E9%98%B2%E7%81%AB%E7%89%86firewalld%E6%94%B9%E7%94%A8%E5%82%B3%E7%B5%B1%E7%9A%84iptables/ <h1 class="relative group">關閉 centos7 防火牆 firewalld 改用傳統的 iptables <div id="關閉-centos7-防火牆-firewalld-改用傳統的-iptables" class="anchor"></div> <span class="absolute top-0 w-6 transition-opacity opacity-0 -start-6 not-prose group-hover:opacity-100 select-none"> <a class="text-primary-300 dark:text-neutral-700 !no-underline" href="#%e9%97%9c%e9%96%89-centos7-%e9%98%b2%e7%81%ab%e7%89%86-firewalld-%e6%94%b9%e7%94%a8%e5%82%b3%e7%b5%b1%e7%9a%84-iptables" aria-label="定位點">#</a> </span> </h1> <h2 class="relative group">這樣做的原因 <div id="這樣做的原因" class="anchor"></div> <span class="absolute top-0 w-6 transition-opacity opacity-0 -start-6 not-prose group-hover:opacity-100 select-none"> <a class="text-primary-300 dark:text-neutral-700 !no-underline" href="#%e9%80%99%e6%a8%a3%e5%81%9a%e7%9a%84%e5%8e%9f%e5%9b%a0" aria-label="定位點">#</a> </span> </h2> <p>因為firewalld 政策是對外嚴謹對內寬鬆，所以當需求是需要對內嚴謹時無法滿足需求</p> http://pollochang.work/worknot/firewalld-common-questions/ Thu, 21 Nov 2024 23:01:31 +0800 http://pollochang.work/worknot/firewalld-common-questions/ <h1 class="relative group">firewalld 問題整理 <div id="firewalld-問題整理" class="anchor"></div> <span class="absolute top-0 w-6 transition-opacity opacity-0 -start-6 not-prose group-hover:opacity-100 select-none"> <a class="text-primary-300 dark:text-neutral-700 !no-underline" href="#firewalld-%e5%95%8f%e9%a1%8c%e6%95%b4%e7%90%86" aria-label="定位點">#</a> </span> </h1> <h2 class="relative group">AllowZoneDrifting is enabled. <div id="allowzonedrifting-is-enabled" class="anchor"></div> <span class="absolute top-0 w-6 transition-opacity opacity-0 -start-6 not-prose group-hover:opacity-100 select-none"> <a class="text-primary-300 dark:text-neutral-700 !no-underline" href="#allowzonedrifting-is-enabled" aria-label="定位點">#</a> </span> </h2> <ul> <li>出現 AllowZoneDrifting is enabled.</li> </ul> <div class="highlight-wrapper"><div class="highlight"><div style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"> <table style="border-spacing:0;padding:0;margin:0;border:0;"><tr><td style="vertical-align:top;padding:0;margin:0;border:0;"> <pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f"> 1 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f"> 2 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f"> 3 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f"> 4 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f"> 5 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f"> 6 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f"> 7 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f"> 8 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f"> 9 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">10 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">11 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">12 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">13 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">14 </span></code></pre></td> <td style="vertical-align:top;padding:0;margin:0;border:0;;width:100%"> <pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#f92672">[</span>root@ex-ap test<span style="color:#f92672">]</span><span style="color:#75715e"># systemctl status firewalld</span> </span></span><span style="display:flex;"><span>● firewalld.service - firewalld - dynamic firewall daemon </span></span><span style="display:flex;"><span> Loaded: loaded <span style="color:#f92672">(</span>/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled<span style="color:#f92672">)</span> </span></span><span style="display:flex;"><span> Active: active <span style="color:#f92672">(</span>running<span style="color:#f92672">)</span> since Sun 2022-02-13 09:58:54 CST; 2s ago </span></span><span style="display:flex;"><span> Docs: man:firewalld<span style="color:#f92672">(</span>1<span style="color:#f92672">)</span> </span></span><span style="display:flex;"><span> Main PID: <span style="color:#ae81ff">7200</span> <span style="color:#f92672">(</span>firewalld<span style="color:#f92672">)</span> </span></span><span style="display:flex;"><span> Tasks: <span style="color:#ae81ff">2</span> </span></span><span style="display:flex;"><span> CGroup: /system.slice/firewalld.service </span></span><span style="display:flex;"><span> └─7200 /usr/bin/python2 -Es /usr/sbin/firewalld --nofork --nopid </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span>Feb <span style="color:#ae81ff">13</span> 09:58:53 ex-ap systemd<span style="color:#f92672">[</span>1<span style="color:#f92672">]</span>: Starting firewalld - dynamic firewall daemon... </span></span><span style="display:flex;"><span>Feb <span style="color:#ae81ff">13</span> 09:58:54 ex-ap systemd<span style="color:#f92672">[</span>1<span style="color:#f92672">]</span>: Started firewalld - dynamic firewall daemon. </span></span><span style="display:flex;"><span>Feb <span style="color:#ae81ff">13</span> 09:58:54 ex-ap firewalld<span style="color:#f92672">[</span>7200<span style="color:#f92672">]</span>: WARNING: AllowZoneDrifting is enabled. This is considered an insecure configuration option. It wil... it now. </span></span><span style="display:flex;"><span>Hint: Some lines were ellipsized, use -l to show in full.</span></span></code></pre></td></tr></table> </div> </div></div> <ul> <li>解決方式</li> </ul> <p>修改 /etc/firewalld/firewalld.conf 中的 <code>AllowZoneDrifting</code> 參數改為 <code>no</code></p> http://pollochang.work/worknot/firewalld/ Thu, 21 Nov 2024 23:00:29 +0800 http://pollochang.work/worknot/firewalld/ <p>以下是 firewalld 學習筆記</p> <h2 class="relative group">firewall 網路來源優先 <div id="firewall-網路來源優先" class="anchor"></div> <span class="absolute top-0 w-6 transition-opacity opacity-0 -start-6 not-prose group-hover:opacity-100 select-none"> <a class="text-primary-300 dark:text-neutral-700 !no-underline" href="#firewall-%e7%b6%b2%e8%b7%af%e4%be%86%e6%ba%90%e5%84%aa%e5%85%88" aria-label="定位點">#</a> </span> </h2> <ol> <li>有設定 IP source 優先</li> <li>有設定 網卡 優先</li> <li>預設區域</li> </ol> <h2 class="relative group">區域簡介 <div id="區域簡介" class="anchor"></div> <span class="absolute top-0 w-6 transition-opacity opacity-0 -start-6 not-prose group-hover:opacity-100 select-none"> <a class="text-primary-300 dark:text-neutral-700 !no-underline" href="#%e5%8d%80%e5%9f%9f%e7%b0%a1%e4%bb%8b" aria-label="定位點">#</a> </span> </h2> <p>firewalld 的區域（zone）可用來設定網路連線、介面等所處的運作環境，對內使用的區域其防火牆規則會較為寬鬆，反之若是對外的區域其規則會較為嚴謹。</p> http://pollochang.work/worknot/firewalld-forward-port/ Thu, 21 Nov 2024 22:59:15 +0800 http://pollochang.work/worknot/firewalld-forward-port/ <div class="highlight-wrapper"><div class="highlight"><div style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"> <table style="border-spacing:0;padding:0;margin:0;border:0;"><tr><td style="vertical-align:top;padding:0;margin:0;border:0;"> <pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">1 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">2 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">3 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">4 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">5 </span></code></pre></td> <td style="vertical-align:top;padding:0;margin:0;border:0;;width:100%"> <pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#75715e"># firewall-cmd --add-forward-port=port=port-number:proto=tcp|udp|sctp|dccp:toport=port-number</span> </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span>sudo firewall-cmd --query-masquerade <span style="color:#75715e"># 查詢有IP 偽裝</span> </span></span><span style="display:flex;"><span>sudo firewall-cmd --permanent --zone<span style="color:#f92672">=</span>public --add-masquerade </span></span><span style="display:flex;"><span>sudo firewall-cmd --permanent --zone<span style="color:#f92672">=</span>public --add-forward-port<span style="color:#f92672">=</span>port<span style="color:#f92672">=</span>33822:proto<span style="color:#f92672">=</span>tcp:toport<span style="color:#f92672">=</span>22:toaddr<span style="color:#f92672">=</span>203.74.221.35</span></span></code></pre></td></tr></table> </div> </div></div>