-h, --help Prints a short help text and exists # 打印帮助信息
-V, --version Print the version string of firewalld # 查看firewalld的版本信息
-q, --quiet Do not print status messages # 不打印状态消息
2.状态选项 - Status Options
--state Return and print firewalld state # 返回并打印firewalld状态
--reload Reload firewall and keep state information # 重新加载防火墙并保留状态信息
--complete-reload Reload firewall and lose state information # 重新加载防火墙并丢失状态信息
--runtime-to-permanent
Create permanent from runtime configuration # 从运行时配置创建永久，保存配置
3.记录拒绝选项 - Log Denied Options
--get-log-denied Print the log denied value # 打印拒绝日志
--set-log-denied=<value> Set log denied value # 设置日志拒绝值
--get-ipset-types Print the supported ipset types # 打印支持的ipset类型
4.永久选择 - Permanent Options
--permanent Set an option permanently # 永久设置选项
Usable for options marked with [P] # 可用于标有[P]的选项
5.zone选项 - Zone Options
--get-default-zone Print default zone for connections and interfaces # 获取默认zone
--set-default-zone=<zone> Set default zone # 获取默认zone
--get-active-zones Print currently active zones # 获取当前活动zone
--get-zones Print predefined zones [P] # 获取所有预定义zone
--get-services Print predefined services [P] # 获取预定义区域
--get-icmptypes Print predefined icmptypes [P] # 打印预定义的icmp类型
--get-zone-of-interface=<interface>
Print name of the zone the interface is bound to [P] # 获取指定网卡绑定的zone
--get-zone-of-source=<source>[/<mask>]|<MAC>|ipset:<ipset>
Print name of the zone the source is bound to [P] #
--list-all-zones
List everything added for or enabled in all zones [P] # 列出在所有zond中添加或启用的所有内容
--new-zone=<zone> Add a new zone [P only] # 添加新zone
--new-zone-from-file=<filename> [--name=<zone>]
Add a new zone from file with optional name [P only] # 从文件创建新zone
--delete-zone=<zone> Delete an existing zone [P only] # 删除现有zone
--load-zone-defaults=<zone>
Load zone default settings [P only] [Z] # 加载zone默认设置
--zone=<zone> Use this zone to set or query options, else default zone
Usable for options marked with [Z]
--get-target Get the zone target [P only] [Z]
--set-target=<target> Set the zone target [P only] [Z] #
--info-zone=<zone> Print information about a zone # 打印指定zone的相关信息
--path-zone=<zone> Print file path of a zone [P only] #
6.IPSet选项 - IPSet Options
--get-ipset-types Print the supported ipset types
--new-ipset=<ipset> --type=<ipset type> [--option=<key>[=<value>]]..
Add a new ipset [P only]
--new-ipset-from-file=<filename> [--name=<ipset>]
Add a new ipset from file with optional name [P only]
--delete-ipset=<ipset>
Delete an existing ipset [P only]
--load-ipset-defaults=<ipset>
Load ipset default settings [P only]
--info-ipset=<ipset> Print information about an ipset
--path-ipset=<ipset> Print file path of an ipset [P only]
--get-ipsets Print predefined ipsets
--ipset=<ipset> --set-description=<description>
Set new description to ipset [P only]
--ipset=<ipset> --get-description
Print description for ipset [P only]
--ipset=<ipset> --set-short=<description>
Set new short description to ipset [P only]
--ipset=<ipset> --get-short
Print short description for ipset [P only]
--ipset=<ipset> --add-entry=<entry>
Add a new entry to an ipset [P]
--ipset=<ipset> --remove-entry=<entry>
Remove an entry from an ipset [P]
--ipset=<ipset> --query-entry=<entry>
Return whether ipset has an entry [P]
--ipset=<ipset> --get-entries
List entries of an ipset [P]
--ipset=<ipset> --add-entries-from-file=<entry>
Add a new entries to an ipset [P]
--ipset=<ipset> --remove-entries-from-file=<entry>
Remove entries from an ipset [P]
7.IcmpType选项 - IcmpType Options
--new-icmptype=<icmptype>
Add a new icmptype [P only] # 添加新的icmptype [仅限P]
--new-icmptype-from-file=<filename> [--name=<icmptype>]
Add a new icmptype from file with optional name [P only] # 从文件中添加一个带有可选名称的新icmptype [仅限P]
--delete-icmptype=<icmptype>
Delete an existing icmptype [P only] # 删除现有的icmptype [仅限P]
--load-icmptype-defaults=<icmptype>
Load icmptype default settings [P only] # 加载icmptype默认设置[仅限P]
--info-icmptype=<icmptype>
Print information about an icmptype # 打印有关icmptype的信息
--path-icmptype=<icmptype>
Print file path of an icmptype [P only] # 打印icmptype的文件路径[仅限P]
--icmptype=<icmptype> --set-description=<description>
Set new description to icmptype [P only] # 将新描述设置为icmptype [仅限P]
--icmptype=<icmptype> --get-description
Print description for icmptype [P only] # icmptype的打印说明[仅限P]
--icmptype=<icmptype> --set-short=<description>
Set new short description to icmptype [P only] # 将新的简短描述设置为icmptype [仅限P]
--icmptype=<icmptype> --get-short
Print short description for icmptype [P only] # 打印icmptype的简短描述[仅限P]
--icmptype=<icmptype> --add-destination=<ipv>
Enable destination for ipv in icmptype [P only] # 在icmptype中启用ipv的目标[仅限P]
--icmptype=<icmptype> --remove-destination=<ipv>
Disable destination for ipv in icmptype [P only] # 在icmptype中禁用ipv的目标[仅限P]
--icmptype=<icmptype> --query-destination=<ipv>
Return whether destination ipv is enabled in icmptype [P only] # 返回是否在icmptype中启用了目标ipv [仅限P]
--icmptype=<icmptype> --get-destinations
List destinations in icmptype [P only] # 在icmptype中列出目的地[仅限P]
8.服务选项 - Service Options
--new-service=<service>
Add a new service [P only]
--new-service-from-file=<filename> [--name=<service>]
Add a new service from file with optional name [P only]
--delete-service=<service>
Delete an existing service [P only]
--load-service-defaults=<service>
Load icmptype default settings [P only]
--info-service=<service>
Print information about a service
--path-service=<service>
Print file path of a service [P only]
--service=<service> --set-description=<description>
Set new description to service [P only]
--service=<service> --get-description
Print description for service [P only]
--service=<service> --set-short=<description>
Set new short description to service [P only]
--service=<service> --get-short
Print short description for service [P only]
--service=<service> --add-port=<portid>[-<portid>]/<protocol>
Add a new port to service [P only]
--service=<service> --remove-port=<portid>[-<portid>]/<protocol>
Remove a port from service [P only]
--service=<service> --query-port=<portid>[-<portid>]/<protocol>
Return whether the port has been added for service [P only]
--service=<service> --get-ports
List ports of service [P only]
--service=<service> --add-protocol=<protocol>
Add a new protocol to service [P only]
--service=<service> --remove-protocol=<protocol>
Remove a protocol from service [P only]
--service=<service> --query-protocol=<protocol>
Return whether the protocol has been added for service [P only]
--service=<service> --get-protocols
List protocols of service [P only]
--service=<service> --add-source-port=<portid>[-<portid>]/<protocol>
Add a new source port to service [P only]
--service=<service> --remove-source-port=<portid>[-<portid>]/<protocol>
Remove a source port from service [P only]
--service=<service> --query-source-port=<portid>[-<portid>]/<protocol>
Return whether the source port has been added for service [P only]
--service=<service> --get-source-ports
List source ports of service [P only]
--service=<service> --add-module=<module>
Add a new module to service [P only]
--service=<service> --remove-module=<module>
Remove a module from service [P only]
--service=<service> --query-module=<module>
Return whether the module has been added for service [P only]
--service=<service> --get-modules
List modules of service [P only]
--service=<service> --set-destination=<ipv>:<address>[/<mask>]
Set destination for ipv to address in service [P only]
--service=<service> --remove-destination=<ipv>
Disable destination for ipv i service [P only]
--service=<service> --query-destination=<ipv>:<address>[/<mask>]
Return whether destination ipv is set for service [P only]
--service=<service> --get-destinations
List destinations in service [P only]
9.Options to Adapt and Query Zones：适应和查询区域的选项
--list-all List everything added for or enabled in a zone [P] [Z]
--list-services List services added for a zone [P] [Z]
--timeout=<timeval>
Enable an option for timeval time, where timeval is a number followed by one of letters 's' or 'm' or 'h'
Usable for options marked with [T]
--set-description=<description>
Set new description to zone [P only] [Z]
--get-description Print description for zone [P only] [Z]
--set-short=<description>
Set new short description to zone [P only] [Z]
--get-short Print short description for zone [P only] [Z]
--add-service=<service>
Add a service for a zone [P] [Z] [T]
--remove-service=<service>
Remove a service from a zone [P] [Z]
--query-service=<service>
Return whether service has been added for a zone [P] [Z]
--list-ports List ports added for a zone [P] [Z]
--add-port=<portid>[-<portid>]/<protocol>
Add the port for a zone [P] [Z] [T]
--remove-port=<portid>[-<portid>]/<protocol>
Remove the port from a zone [P] [Z]
--query-port=<portid>[-<portid>]/<protocol>
Return whether the port has been added for zone [P] [Z]
--list-protocols List protocols added for a zone [P] [Z]
--add-protocol=<protocol>
Add the protocol for a zone [P] [Z] [T]
--remove-protocol=<protocol>
Remove the protocol from a zone [P] [Z]
--query-protocol=<protocol>
Return whether the protocol has been added for zone [P] [Z]
--list-source-ports List source ports added for a zone [P] [Z]
--add-source-port=<portid>[-<portid>]/<protocol>
Add the source port for a zone [P] [Z] [T]
--remove-source-port=<portid>[-<portid>]/<protocol>
Remove the source port from a zone [P] [Z]
--query-source-port=<portid>[-<portid>]/<protocol>
Return whether the source port has been added for zone [P] [Z]
--list-icmp-blocks List Internet ICMP type blocks added for a zone [P] [Z]
--add-icmp-block=<icmptype>
Add an ICMP block for a zone [P] [Z] [T]
--remove-icmp-block=<icmptype>
Remove the ICMP block from a zone [P] [Z]
--query-icmp-block=<icmptype>
Return whether an ICMP block has been added for a zone [P] [Z]
--add-icmp-block-inversion
Enable inversion of icmp blocks for a zone [P] [Z]
--remove-icmp-block-inversion
Disable inversion of icmp blocks for a zone [P] [Z]
--query-icmp-block-inversion
Return whether inversion of icmp blocks has been enabled for a zone [P] [Z]
--list-forward-ports List IPv4 forward ports added for a zone [P] [Z]
--add-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]]
Add the IPv4 forward port for a zone [P] [Z] [T]
--remove-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]]
Remove the IPv4 forward port from a zone [P] [Z]
--query-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]]
Return whether the IPv4 forward port has been added for a zone [P] [Z]
--add-masquerade Enable IPv4 masquerade for a zone [P] [Z] [T]
--remove-masquerade Disable IPv4 masquerade for a zone [P] [Z]
--query-masquerade
Return whether IPv4 masquerading has been enabled for a zone [P] [Z]
--list-rich-rules List rich language rules added for a zone [P] [Z]
--add-rich-rule=<rule>
Add rich language rule 'rule' for a zone [P] [Z] [T]
--remove-rich-rule=<rule>
Remove rich language rule 'rule' from a zone [P] [Z]
--query-rich-rule=<rule>
Return whether a rich language rule 'rule' has been added for a zone [P] [Z]
10.Options to Handle Bindings of Interfaces：处理接口绑定的选项
--list-interfaces
List interfaces that are bound to a zone [P] [Z] # 列出绑定到区域的接口[P] [Z]
--add-interface=<interface>
Bind the <interface> to a zone [P] [Z] # 将<interface>绑定到区域[P] [Z]
--change-interface=<interface>
Change zone the <interface> is bound to [Z] # 更改区域<interface>绑定到[Z]
--query-interface=<interface>
Query whether <interface> is bound to a zone [P] [Z] # 查询<interface>是否绑定到区域[P] [Z]
--remove-interface=<interface>
Remove binding of <interface> from a zone [P] [Z] # 从区域[P] [Z]中删除<interface>的绑定
11.Options to Handle Bindings of Sources：处理来源绑定的选项
--list-sources List sources that are bound to a zone [P] [Z] # 列出绑定到区域的源[P] [Z]
--add-source=<source>[/<mask>]|<MAC>|ipset:<ipset>
Bind the source to a zone [P] [Z] # 将源绑定到区域[P] [Z]
--change-source=<source>[/<mask>]|<MAC>|ipset:<ipset>
Change zone the source is bound to [Z] # 更改区域源绑定到[Z]
--query-source=<source>[/<mask>]|<MAC>|ipset:<ipset>
Query whether the source is bound to a zone [P] [Z] # 查询源是否绑定到区域[P] [Z]
--remove-source=<source>[/<mask>]|<MAC>|ipset:<ipset>
Remove binding of the source from a zone [P] [Z] # 从区域中删除源的绑定[P] [Z]
12.Direct Options
--direct First option for all direct options # 所有直接选项的第一选择
--get-all-chains Get all chains [P] # 获取所有链[P]
--get-chains {ipv4|ipv6|eb} <table>
Get all chains added to the table [P] # 将所有链添加到表中[P]
--add-chain {ipv4|ipv6|eb} <table> <chain>
Add a new chain to the table [P] # 在表中添加一个新链[P]
--remove-chain {ipv4|ipv6|eb} <table> <chain>
Remove the chain from the table [P] # 从表中删除链[P]
--query-chain {ipv4|ipv6|eb} <table> <chain>
Return whether the chain has been added to the table [P] # 返回是否已将链添加到表中[P]
--get-all-rules
Get all rules [P] # 获取所有规则[P]
--get-rules {ipv4|ipv6|eb} <table> <chain>
Get all rules added to chain in table [P] # 将所有规则添加到表中的链[P]
--add-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>...
Add rule to chain in table [P] # 在表[P]中添加规则到链
--remove-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>...
Remove rule with priority from chain in table [P] # 从表[P]中的链中删除具有优先级的规则
--remove-rules {ipv4|ipv6|eb} <table> <chain>
Remove rules from chain in table [P] # 从表[P]中的链中删除规则
--query-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>...
Return whether a rule with priority has been added to chain in table [P] # 返回是否已将具有优先级的规则添加到表[P]中的链
--passthrough {ipv4|ipv6|eb} <arg>...
Pass a command through (untracked by firewalld) # 通过命令（未触发过firewalld）
--get-all-passthroughs
Get all tracked passthrough rules [P] # 获取所有跟踪的直通规则[P]
--get-passthroughs {ipv4|ipv6|eb} <arg>...
Get tracked passthrough rules [P] # 跟踪直通规则[P]
--add-passthrough {ipv4|ipv6|eb} <arg>...
Add a new tracked passthrough rule [P] # 添加新的跟踪直通规则[P]
--remove-passthrough {ipv4|ipv6|eb} <arg>...
Remove a tracked passthrough rule [P] # 删除跟踪的直通规则[P]
--query-passthrough {ipv4|ipv6|eb} <arg>...
Return whether the tracked passthrough rule has been added [P] # 返回是否添加了跟踪的直通规则[P]
--list-lockdown-whitelist-commands
List all command lines that are on the whitelist [P] # 列出白名单中的所有命令行[P]＃
--add-lockdown-whitelist-command=<command>
Add the command to the whitelist [P] # 将命令添加到白名单[P]
--remove-lockdown-whitelist-command=<command>
Remove the command from the whitelist [P] # 从白名单中删除命令[P]
--query-lockdown-whitelist-command=<command>
Query whether the command is on the whitelist [P] # 查询命令是否在白名单中[P]
--list-lockdown-whitelist-contexts
List all contexts that are on the whitelist [P] # 列出白名单中的所有上下文[P]
--add-lockdown-whitelist-context=<context>
Add the context context to the whitelist [P] # 将上下文上下文添加到白名单[P]
--remove-lockdown-whitelist-context=<context>
Remove the context from the whitelist [P] # 从白名单中删除上下文[P]
--query-lockdown-whitelist-context=<context>
Query whether the context is on the whitelist [P] # 查询上下文是否在白名单中[P]
--list-lockdown-whitelist-uids
List all user ids that are on the whitelist [P] # 列出白名单中的所有用户ID [P]
--add-lockdown-whitelist-uid=<uid>
Add the user id uid to the whitelist [P] # 将用户ID uid添加到白名单[P]
--remove-lockdown-whitelist-uid=<uid>
Remove the user id uid from the whitelist [P] # 从白名单中删除用户ID uid [P]
--query-lockdown-whitelist-uid=<uid>
Query whether the user id uid is on the whitelist [P] # 查询用户id uid是否在白名单中[P]
--list-lockdown-whitelist-users
List all user names that are on the whitelist [P] # 列出白名单中的所有用户名[P]
--add-lockdown-whitelist-user=<user>
Add the user name user to the whitelist [P] # 将用户名用户添加到白名单[P]
--remove-lockdown-whitelist-user=<user>
Remove the user name user from the whitelist [P] # 从白名单中删除用户名用户[P]
--query-lockdown-whitelist-user=<user>
Query whether the user name user is on the whitelist [P] # 从白名单中删除用户名用户[P]
本文详细介绍CentOS7和RHEL7中firewalld防火墙的使用方法，包括启动、停止、查看状态、开放端口、限制IP访问及保存配置等操作。同时，提供了firewall-cmd命令的详细解释和使用流程说明。
扫一扫
1167
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
