firewall防火墙批量添加规则

背景：

        ECS之前未配置防火墙，现在根据要求，需要开启防火墙。

难点：

        不清楚都开了哪些服务和端口，不能影响现有的服务。

思路：

1.         先查看目前ECS的端口和服务由哪些(ss -tuln)。
2.         然后编写富规则，批量。
3.         最后，编写脚本。
4.         彩蛋在后面\(^o^)/~

功能截图：

实现脚本：

auto_firewall.sh

#!/bin/bash

# 允许的网段列表，可以添加多个，用空格分隔
ALLOWED_NETWORKS=("10.70.170.0/24" "10.66.127.0/24")

# 检测当前监听的 TCP 和 UDP 端口，去重
TCP_PORTS=$(ss -tuln | awk '/tcp/ {print $5}' | awk -F: '{print $NF}' | sort -u)
UDP_PORTS=$(ss -tuln | awk '/udp/ {print $5}' | awk -F: '{print $NF}' | sort -u)

echo "检测到需要开放的 TCP 端口："
echo "$TCP_PORTS"
echo "检测到需要开放的 UDP 端口："
echo "$UDP_PORTS"

echo "即将为以下网段添加 firewalld 规则："
printf '%s\n' "${ALLOWED_NETWORKS[@]}"

echo "即将生成的规则如下："

# 为每个网段、每个 TCP 端口生成 rich rule
for net in "${ALLOWED_NETWORKS[@]}"; do
  for port in $TCP_PORTS; do
    rule="rule family=\"ipv4\" source address=\"$net\" port protocol=\"tcp\" port=\"$port\" accept"
    echo "firewall-cmd --permanent --add-rich-rule='$rule'"
  done
done

# 为每个网段、每个 UDP 端口生成 rich rule
for net in "${ALLOWED_NETWORKS[@]}"; do
  for port in $UDP_PORTS; do
    rule="rule family=\"ipv4\" source address=\"$net\" port protocol=\"udp\" port=\"$port\" accept"
    echo "firewall-cmd --permanent --add-rich-rule='$rule'"
  done
done

# 交互确认
read -p "确认添加以上规则吗？(y/n): " confirm
if [[ "$confirm" == "y" || "$confirm" == "Y" ]]; then
  echo "正在添加规则..."

  # 实际执行添加规则
  for net in "${ALLOWED_NETWORKS[@]}"; do
    for port in $TCP_PORTS; do
      firewall-cmd --permanent --add-rich-rule="rule family=\"ipv4\" source address=\"$net\" port protocol=\"tcp\" port=\"$port\" accept"
    done
  done

  for net in "${ALLOWED_NETWORKS[@]}"; do
    for port in $UDP_PORTS; do
      firewall-cmd --permanent --add-rich-rule="rule family=\"ipv4\" source address=\"$net\" port protocol=\"udp\" port=\"$port\" accept"
    done
  done

  firewall-cmd --reload
  echo "规则已生效！"
else
  echo "操作已取消。"
fi

彩蛋部分：

今儿开心，手动维护rule,有点麻烦，赠送维护脚本一枚。

auto_update.sh

#!/bin/bash
# 批量添加规则示例
RULES=(
    'rule family="ipv4" source address="10.78.178.0/24" port protocol="tcp" port="80" accept'
    'rule family="ipv4" source address="10.78.178.0/24" port protocol="tcp" port="3306" accept'
    'rule family="ipv4" source address="10.78.168.199/32" port protocol="tcp" port="22" accept'
)

for rule in "${RULES[@]}"; do
    sudo firewall-cmd --permanent --add-rich-rule "$rule"
done

sudo firewall-cmd --reload