我继承了一个使用防火墙命令实现规则的系统，它有以下规则。另一个系统正在尝试连接到 snmp 端口 (UDP/161)，但无法连接（我的服务器响应 ICMP 主机管理禁止）。如果我使用 iptables 命令从 INPUT 和 FORWARD 链中删除规则“reject-with icmp-host-prohibited”，它就可以正常工作。
如何使用firewall-cmd 删除此规则？或者更好的是，如何允许 UDP/161 的流量？
[root@host]# firewall-cmd --direct --get-all-rules
ipv4 filter INPUT_direct 2 -p tcp --dport 10000 -m limit --limit 50/second --limit-burst 1 -j ACCEPT
ipv4 filter INPUT_direct 2 -p tcp --dport 10020 -m limit --limit 50/second --limit-burst 1 -j ACCEPT
ipv4 filter INPUT_direct 2 -p tcp --dport 11000 -m limit --limit 50/second --limit-burst 1 -j ACCEPT
ipv4 filter INPUT_direct 2 -p tcp --dport 11020 -m limit --limit 50/second --limit-burst 1 -j ACCEPT
ipv4 filter INPUT_direct 2 -p udp --dport 161 -j ACCEPT
ipv4 filter OUTPUT 3 -j DROP
ipv4 filter OUTPUT 0 -p icmp -j ACCEPT
ipv4 filter OUTPUT 0 -p tcp -m multiport --dport=53,22,80,443 -j ACCEPT
ipv4 filter OUTPUT 1 -p tcp -m multiport --sport=53,22,80,443 -j ACCEPT
ipv4 filter OUTPUT 0 -p tcp -m multiport --dport=1024:65535 -j ACCEPT
ipv4 filter OUTPUT 1 -p tcp -m multiport --sport=1024:65535 -j ACCEPT
ipv4 filter OUTPUT 0 -p udp -m multiport --dport=1024:65535 -j ACCEPT
ipv4 filter OUTPUT 1 -p udp -m multiport --sport=1024:65535 -j ACCEPT
ipv4 filter OUTPUT 0 -p udp --dport=161 -j ACCEPT
ipv4 filter OUTPUT 1 -p udp --sport=161 -j ACCEPT
ipv4 filter OUTPUT 0 -p udp --dport=162 -j ACCEPT
ipv4 filter OUTPUT 1 -p udp --sport=162 -j ACCEPT
ipv4 filter OUTPUT 0 -p udp --dport=705 -j ACCEPT
ipv4 filter OUTPUT 1 -p udp --sport=705 -j ACCEPT
ipv4 filter INPUT 0 -m pkttype --pkt-type multicast -i ens224 -j ACCEPT
ipv4 filter INPUT 1 -p udp -m udp -i ens224 -j ACCEPT
ipv4 nat PREROUTING 0 -p tcp --destination 172.16.187.39 --dport 10700 -j DNAT --to 172.16.187.7:10700
ipv4 filter FORWARD_direct 2 -p udp --dport 161 -j ACCEPT
它被翻译成以下 iptables 规则：
[root@host]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
INPUT_direct all -- anywhere anywhere
INPUT_ZONES_SOURCE all -- anywhere anywhere
INPUT_ZONES all -- anywhere anywhere
DROP all -- anywhere anywhere ctstate INVALID
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
FORWARD_direct all -- anywhere anywhere
FORWARD_IN_ZONES_SOURCE all -- anywhere anywhere
FORWARD_IN_ZONES all -- anywhere anywhere
FORWARD_OUT_ZONES_SOURCE all -- anywhere anywhere
FORWARD_OUT_ZONES all -- anywhere anywhere
DROP all -- anywhere anywhere ctstate INVALID
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
OUTPUT_direct all -- anywhere anywhere
Chain FORWARD_IN_ZONES (1 references)
target prot opt source destination
FWDI_ledefaultzone all -- anywhere anywhere [goto]
FWDI_ledefaultzone all -- anywhere anywhere [goto]
FWDI_ledefaultzone all -- anywhere anywhere [goto]
Chain FORWARD_IN_ZONES_SOURCE (1 references)
target prot opt source destination
Chain FORWARD_OUT_ZONES (1 references)
target prot opt source destination
FWDO_ledefaultzone all -- anywhere anywhere [goto]
FWDO_ledefaultzone all -- anywhere anywhere [goto]
FWDO_ledefaultzone all -- anywhere anywhere [goto]
Chain FORWARD_OUT_ZONES_SOURCE (1 references)
target prot opt source destination
Chain FORWARD_direct (1 references)
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp dpt:snmp
Chain FWDI_ledefaultzone (3 references)
target prot opt source destination
FWDI_ledefaultzone_log all -- anywhere anywhere
FWDI_ledefaultzone_deny all -- anywhere anywhere
FWDI_ledefaultzone_allow all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere
Chain FWDI_ledefaultzone_allow (1 references)
target prot opt source destination
Chain FWDI_ledefaultzone_deny (1 references)
target prot opt source destination
Chain FWDI_ledefaultzone_log (1 references)
target prot opt source destination
Chain FWDO_ledefaultzone (3 references)
target prot opt source destination
FWDO_ledefaultzone_log all -- anywhere anywhere
FWDO_ledefaultzone_deny all -- anywhere anywhere
FWDO_ledefaultzone_allow all -- anywhere anywhere
Chain FWDO_ledefaultzone_allow (1 references)
target prot opt source destination
Chain FWDO_ledefaultzone_deny (1 references)
target prot opt source destination
Chain FWDO_ledefaultzone_log (1 references)
target prot opt source destination
Chain INPUT_ZONES (1 references)
target prot opt source destination
IN_ledefaultzone all -- anywhere anywhere [goto]
IN_ledefaultzone all -- anywhere anywhere [goto]
IN_ledefaultzone all -- anywhere anywhere [goto]
Chain INPUT_ZONES_SOURCE (1 references)
target prot opt source destination
Chain INPUT_direct (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpt:ndmp limit: avg 50/sec burst 1
ACCEPT tcp -- anywhere anywhere tcp dpt:10020 limit: avg 50/sec burst 1
ACCEPT tcp -- anywhere anywhere tcp dpt:irisa limit: avg 50/sec burst 1
ACCEPT tcp -- anywhere anywhere tcp dpt:11020 limit: avg 50/sec burst 1
ACCEPT udp -- anywhere anywhere udp dpt:snmp
ACCEPT all -- anywhere anywhere PKTTYPE = multicast
ACCEPT udp -- anywhere anywhere udp
Chain IN_ledefaultzone (3 references)
target prot opt source destination
IN_ledefaultzone_log all -- anywhere anywhere
IN_ledefaultzone_deny all -- anywhere anywhere
IN_ledefaultzone_allow all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere
Chain IN_ledefaultzone_allow (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpt:20701 ctstate NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:33000 ctstate NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:7199 ctstate NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:yo-main ctstate NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:33003 ctstate NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:10742 ctstate NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:33005 ctstate NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:rmiregistry ctstate NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:10701 ctstate NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:33002 ctstate NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:11443 ctstate NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh ctstate NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:20601 ctstate NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:33004 ctstate NEW
ACCEPT udp -- anywhere anywhere udp dpt:ntp ctstate NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:10700 ctstate NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:33006 ctstate NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:10760 ctstate NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:blocks ctstate NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:20700 ctstate NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:33001 ctstate NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:amanda ctstate NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:23232 ctstate NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:10388 ctstate NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:20600 ctstate NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:10181 ctstate NEW
Chain IN_ledefaultzone_deny (1 references)
target prot opt source destination
Chain IN_ledefaultzone_log (1 references)
target prot opt source destination
Chain OUTPUT_direct (1 references)
target prot opt source destination
ACCEPT icmp -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere multiport dports domain,ssh,http,https
ACCEPT tcp -- anywhere anywhere multiport dports 1024:65535
ACCEPT udp -- anywhere anywhere multiport dports 1024:65535
ACCEPT udp -- anywhere anywhere udp dpt:snmp
ACCEPT udp -- anywhere anywhere udp dpt:snmptrap
ACCEPT udp -- anywhere anywhere udp dpt:agentx
ACCEPT tcp -- anywhere anywhere multiport sports domain,ssh,http,https
ACCEPT tcp -- anywhere anywhere multiport sports 1024:65535
ACCEPT udp -- anywhere anywhere multiport sports 1024:65535
ACCEPT udp -- anywhere anywhere udp spt:snmp
ACCEPT udp -- anywhere anywhere udp spt:snmptrap
ACCEPT udp -- anywhere anywhere udp spt:agentx
DROP all -- anywhere anywhere
答案1
您可以使用防火墙命令CLI 客户端工具添加永久规则并允许特定 UDP 端口通过防火墙守护进程适用区域。
1. 获取活动接口区域
--get-active-zones
2. 允许 UDP 端口流量通过
firewall-cmd --permanent --zone=<zone> --add-port=161/udp firewall-cmd --reload笔记：该
<zone>值将是每个命令#1 所需的值。
3. 确认
firewall-cmd --list-ports
更多资源
-
--get-active-zones打印当前活动区域以及这些区域中使用的接口和源。活动区域是与接口或源绑定的区域。输出格式为：
--permanent永久选项 --permanent 可用于永久设置选项。这些更改不会立即生效，只有在服务重新启动/重新加载或系统重新启动后才会生效。如果没有 --permanent 选项，更改将只是运行时配置的一部分。
如果您想更改运行时和永久配置，请使用带有和不带有 --permanent 选项的相同调用。
可以选择将 --permanent 选项添加到所有受支持的选项中。
[--permanent] [--zone=zone] --add-port=portid[-portid]/protocol [--timeout=timeval]添加区域的端口。如果省略区域，将使用默认区域。可以多次指定此选项。如果提供了超时，则规则将在指定的时间内处于活动状态，之后将自动删除。timeval 是一个数字（秒）或数字后跟字符 s（秒）、m（分钟）、h（小时）之一，例如 20m 或 1h。
端口可以是单个端口号，也可以是端口范围 portid-portid。协议可以是 tcp、udp、sctp 或 dccp。