显示默认定义的服务
[root@vdevops ~]# firewall-cmd --get-services RH-Satellite-6 amanda-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns freeipa-ldap freeipa-ldaps freeipa-replication ftp high-availability http https imaps ipp ipp-client ipsec iscsi-target kerberos kpasswd ldap ldaps libvirt libvirt-tls mdns mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s postgresql proxy-dhcp radius rpc-bind rsyncd samba samba-client smtp ssh telnet tftp tftp-client transmission-client vdsm vnc-server wbem-https #定义文件路径如下，如果需要添加新的定义文件，在下面目录添加相应的XML文件 [root@vdevops ~]# ls /usr/lib/firewalld/services amanda-client.xml freeipa-ldap.xml ipp.xml libvirt.xml pmcd.xml RH-Satellite-6.xml tftp-client.xml bacula-client.xml freeipa-replication.xml ipsec.xml mdns.xml pmproxy.xml rpc-bind.xml tftp.xml bacula.xml ftp.xml iscsi-target.xml mountd.xml pmwebapis.xml rsyncd.xml transmission-client.xml dhcpv6-client.xml high-availability.xml kerberos.xml ms-wbt.xml pmwebapi.xml samba-client.xml vdsm.xml dhcpv6.xml https.xml kpasswd.xml mysql.xml pop3s.xml samba.xml vnc-server.xml dhcp.xml http.xml ldaps.xml nfs.xml postgresql.xml smtp.xml wbem-https.xml dns.xml imaps.xml ldap.xml ntp.xml proxy-dhcp.xml ssh.xml freeipa-ldaps.xml ipp-client.xml libvirt-tls.xml openvpn.xml radius.xml telnet.xml
添加或删除允许的服务，重新启动系统后，更改将恢复。如果永久更改设置，请添加“--permanent”选项。
#以添加http服务为例 [root@vdevops ~]# firewall-cmd --add-service=http success [root@vdevops ~]# firewall-cmd --list-service http ssh #移除添加的http <pre name="code" class="html">[root@vdevops ~]# firewall-cmd --remove-service=http success [root@vdevops ~]# firewall-cmd --list-service ssh #添加http服务，永久生效 [root@vdevops ~]# firewall-cmd --add-service=http --permanentsuccess [root@vdevops ~]# firewall-cmd --reloadsuccess[root@vdevops ~]# firewall-cmd --list-servicehttp ssh
添加和移除端口
[root@vdevops ~]# firewall-cmd --add-port=465/tcp #添加端口 success [root@vdevops ~]# firewall-cmd --list-port 465/tcp [root@vdevops ~]# firewall-cmd --remove-port=465/tcp #移除端口 success [root@vdevops ~]# firewall-cmd --list-port [root@vdevops ~]# firewall-cmd --add-port=465/tcp --permanent #添加端口，永久生效 success [root@vdevops ~]# firewall-cmd --reload success [root@vdevops ~]# firewall-cmd --list-port 465/tcp
加或删除禁止的ICMP类型
[root@dlp ~]# firewall-cmd --add-icmp-block=echo-request #添加禁止回应请求 success [root@dlp ~]# firewall-cmd --list-icmp-blocks echo-request [root@dlp ~]# firewall-cmd --remove-icmp-block=echo-request #移除添加的参数 success [root@dlp ~]# firewall-cmd --list-icmp-blocks [root@dlp ~]# firewall-cmd --get-icmptypes #显示ICMP支持的功能 destination-unreachable echo-reply echo-request parameter-problem redirect router-advertisement router-solicitation source-quench time-exceeded
