#禁用firewalld

[root@Project-11-Task-01 ~]# systemctl stop firewalld

[root@Project-11-Task-01 ~]# systemctl disable firewalld

[root@Project-11-Task-01 ~]# systemctl mask firewalld

[root@Project-11-Task-01 ~]# systemctl status firewalld

#启用firewalld

[root@Project-11-Task-01 ~]# systemctl unmask firewalld

[root@Project-11-Task-01 ~]# systemctl start firewalld

[root@Project-11-Task-01 ~]# systemctl enable firewalld

[root@Project-11-Task-01 ~]# systemctl status firewalld

#使用firewalld的紧急模式

[root@Project-11-Task-01 ~]# firewall-cmd --panic-on

[root@Project-11-Task-01 ~]# firewall-cmd --query-panic

[root@Project-11-Task-01 ~]# firewall-cmd --panic-off

#查看firewalld的服务

[root@Project-11-Task-01 ~]# firewall-cmd --list-services

[root@Project-11-Task-01 ~]# firewall-cmd --get-services

#当前活跃规则永久保存到默认区域

[root@Project-11-Task-01 ~]# firewall-cmd --runtime-to-permanent

#记录所有通信的日志

[root@Project-11-Task-01 ~]# vi /etc/firewalld/firewalld.conf

[root@Project-11-Task-01 ~]# vi /etc/rsyslog.conf

[root@Project-11-Task-01 ~]# mkdir /var/log/firewalldlog

[root@Project-11-Task-01 ~]# systemctl reload firewalld

[root@Project-11-Task-01 ~]# systemctl restart rsyslog

#管理防火墙的区域

[root@Project-11-Task-01 ~]# firewall-cmd --get-zones

[root@Project-11-Task-01 ~]# firewall-cmd --list-all-zones

[root@Project-11-Task-01 ~]# firewall-cmd --zone=public --list-all

#配置防火墙的默认区域

[root@Project-11-Task-01 ~]# firewall-cmd --get-default-zone

[root@Project-11-Task-01 ~]# firewall-cmd --set-default-zone home

[root@Project-11-Task-01 ~]# firewall-cmd --get-default-zone

#配置Firewalld服务日志的存放路径

[root@Project-04-Task-01 firewalld]# vi /etc/rsyslog.conf

[root@Project-04-Task-01 firewalld]# mkdir /var/log/firewalld

#使用Rich Language进行防火墙规则配置

[root@Project-04-Task-01 firewalld]# firewall-cmd --zone=public --add-rich-rule '

rule family="ipv4&#​34;

source address="10.10.2.100/32&#​34;

port protocol="tcp&#​34;

port="80&#​34;

log prefix="[meToweb] &#​34;

level="emerg&#​34;

reject';

#查看当前zone的信息

[root@Project-04-Task-01 firewalld]# firewall-cmd --list-all

#监控防火墙拒绝的日志

[root@Project-04-Task-01 firewalld]# tail -f /var/log/firewalld/fwlog

#查看非法请求最多的IP地址

[root@Project-04-Task-01 firewalld]# cat fwlog | awk &#​39;{print $10}' | sort -n | uniq -c | head -n 20