☰

Firewalld 不打印活动区域

tag-icon • tag-icon firewall firewalld
Firewalld 不打印活动区域

盒子上vagrant Ubuntu 18.04.02：

root@ubuntu-bionic:~# firewall-cmd --get-active-zones 
root@ubuntu-bionic:~# firewall-cmd --list-all
public
  target: default
  icmp-block-inversion: no
  interfaces: 
  sources: 
  services: ssh dhcpv6-client
  ports: 4444/tcp 5555/tcp
  protocols: 
  masquerade: yes
  forward-ports: port=80:proto=tcp:toport=12345:toaddr=
    port=80:proto=tcp:toport=12345:toaddr=192.168.1.6
  source-ports: 
  icmp-blocks: 
  rich rules:

为什么不firewall-cmd返回任何活动区域？

root@ubuntu-bionic:~# systemctl status firewalld.service 
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
   Active: active (running) since Sun 2019-05-05 11:22:56 UTC; 39min ago
     Docs: man:firewalld(1)
 Main PID: 791 (firewalld)
    Tasks: 2 (limit: 1152)
   CGroup: /system.slice/firewalld.service
           └─791 /usr/bin/python3 -Es /usr/sbin/firewalld --nofork --nopid

答案1

事实证明，当涉及到区域的概念时，active必须firewalld将正在使用并绑定到特定接口的源 IP 添加到特定区域（以便后者成为active）。

事情是这样的

root@ubuntu-bionic:~# ip -4 addr show enp0s8
3: enp0s8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    inet 192.168.33.10/24 brd 192.168.33.255 scope global enp0s8
       valid_lft forever preferred_lft forever

root@ubuntu-bionic:~# firewall-cmd --zone=public --add-source=192.168.33.10 --permanent
success
root@ubuntu-bionic:~# firewall-cmd --zone=public --add-source=192.168.33.10 
success
root@ubuntu-bionic:~# firewall-cmd --reload
success

现在 ...

root@ubuntu-bionic:~# firewall-cmd --get-active-zones 
public
  sources: 192.168.33.10

相关内容