1 firewall

1.1 What

引用 Red Hat 官方文档中对于 firewall 的介绍，内容如下：

A firewall is a way to protect machines from any unwanted traffic from outside. It enables users to control incoming network traffic on host machines by defining a set of firewall rules. These rules are used to sort the incoming traffic and either block it or allow through.

firewalld is a firewall service daemon that provides a dynamic customizable host-based firewall with a D-Bus interface. Being dynamic, it enables creating, changing, and deleting the rules without the necessity to restart the firewall daemon each time the rules are changed.

firewalld uses the concepts of zones and services, that simplify the traffic management. Zones are predefined sets of rules. Network interfaces and sources can be assigned to a zone. The traffic allowed depends on the network your computer is connected to and the security level this network is assigned. Firewall services are predefined rules that cover all necessary settings to allow incoming traffic for a specific service and they apply within a zone.

Services use one or more ports or addresses for network communication. Firewalls filter communication based on ports. To allow network traffic for a service, its ports must be open. firewalld blocks all traffic on ports that are not explicitly set as open. Some zones, such as trusted, allow all traffic by default.

1.2 Firewall Stack

1.3 常见用法

1. 使用 systemctl 命令，可实现 firewall 的启动、停止，以及控制开机自启动的开关，命令样式如下：

systemctl start/stop/enable/disable firewalld

2 iptables

1.1 What

引用 CentOS7 的 Manual 手册中定义，内容如下：

iptables/ip6tables — administration tool for IPv4/IPv6 packet filtering and NAT.

Iptables and ip6tables are used to set up, maintain, and inspect the tables of IPv4 and IPv6 packet filter rules in the Linux kernel. Several different tables may be defined. Each table contains a number of built-in chains and may also contain user-defined chains.

Each chain is a list of rules which can match a set of packets. Each rule specifies what to do with a packet that matches. This is called a `target', which may be a jump to a user-defined chain in the same table.

1.2 常见用法

注意：为了使用 iptables/ip6tables 来替代 firewalld，首先需要禁用 firewalld，相关命令如下：

systemctl disable firewalld
systemctl stop firewalld

1. 使用 systemctl 命令，可实现 iptables/ip6tables 的启动、停止，以及控制开机自启动的开关，命令样式如下：

systemctl start/stop/enable/disable iptables

3 firewall与iptables的关系

3.1 区别

仍然引用 Red Hat 官方文档中对 firewall 与 iptables 区别的介绍，内容如下：

The essential differences between firewalld and the iptables (and ip6tables) services are:

The iptables service stores configuration in /etc/sysconfig/iptables and /etc/sysconfig/ip6tables, while firewalld stores it in various XML files in /usr/lib/firewalld/ and /etc/firewalld/. Note that the /etc/sysconfig/iptables file does not exist as firewalld is installed by default on Red Hat Enterprise Linux.

With the iptables service, every single change means flushing all the old rules and reading all the new rules from /etc/sysconfig/iptables, while with firewalld there is no recreating of all the rules. Only the differences are applied. Consequently, firewalld can change the settings during runtime without existing connections being lost.

3.2 联系

Both use iptables tool to talk to the kernel packet filter.

3.3 总结

在 RHEL 7 系统中，firewall 取代了 iptables。

其实从本文中 firewall 的架构图中能够看到，在 service 层面，两者是平级的，不过 firewall 却还是调用了 iptables 的 command，去执行内核的 netfilter（如 3.2 节描述的那样），所以有人说 firewall 是 CentOS 7 下管理 iptables 的新命令。

Linux操作系统中firewall和iptables介绍相关推荐

Linux操作系统中的make及makefile介绍
本文主要介绍 Linux 操作系统中 make 及 makefile 的相关知识. 1 What make 是一个在软件开发过程中所使用的工具程序(utility software),通过读取&quo ...
Linux操作系统下DHCP服务器配置方法介绍
Linux操作系统下DHCP服务器配置方法介绍 1.安装dhcp软件包 #rpm –ivh dhcp-3.0.1-12_EL.i386.rpm 2.配置文件dhcpd.conf 由于dhcpd.con ...
在 Linux 操作系统中安装 Java
在 Linux 操作系统中安装 Java 笔者的运行环境: CentOS Stream 8 x86_64 Java 11.0.12 进行这个教程之前,必须要先安装好一个 Linux 操作系统.这个 L ...
linux操作系统中业务程序及服务的开机启动
linux操作系统中业务程序及服务的开机启动设置 1 背景 2 目标 3 启动类型 3.1 服务启动systemctl 3.2 服务启动chkconfig 3.2.1 查看服务 3.2.2 系统自带服 ...
linux六种进程状态,Linux操作系统中进程的七种状态
Linux操作系统中进程的七种状态发布时间:2018-05-07 20:43, 浏览次数:741 , 标签: Linux 1 Linux中进程的七种状态(1)R运行状态(runing):并不意味着进 ...
Linux操作系统中Anaconda的安装
Linux操作系统中anaconda的安装 Anaconda由数据科学家为数据科学家建造,超过2000万人使用我们的技术来解决最棘手的问题. Anaconda其实就是一个开源的Python发行版本,其 ...
【转】聊聊Linux操作系统中的显示管理器及如何更换
转自:聊聊Linux操作系统中的显示管理器及如何更换 - linux-123 - 博客园聊聊Linux操作系统中的显示管理器及如何更换 | <Linux就该这么学> 什么是 Linux ...
linux日志配置含义,Linux操作系统中的日志功能详解
日志系统将我们系统运行的每一个状况信息都使用文字记录下来,这些信息有助我们观察系统运行过程中正常状态和系统运行错误时快速定位错误位置的途径等;下面学习啦小编主要概述一下Linux操作系统中的日志功能. ...
Linux操作系统中的泡泡龙游戏(转)
Linux操作系统中的泡泡龙游戏(转) 从DOS到Windows,智力游戏泡泡龙一直都是PC游戏中的经典之作.Linux中的泡泡龙Frozen Bubble(确切地说应该是泡泡企鹅)就给你一个重温美梦 ...
在linux系统中进行路由探测,如何在Linux操作系统中运行Traceroute命令？
Traceroute是Linux操作系统中的命令工具,可用于查看网络数据包的路由.Traceroute可以帮助确定网络数据包传输的质量好坏,同时对于排除缓慢的网络连接故障也很有用. 在租用关于Tra ...

Linux操作系统中firewall和iptables介绍

1 firewall

1.1 What

1.2 Firewall Stack

1.3 常见用法

2 iptables

1.1 What

1.2 常见用法

3 firewall与iptables的关系

3.1 区别

3.2 联系

3.3 总结

Linux操作系统中firewall和iptables介绍相关推荐

最新文章

热门文章