差分

このページの2つのバージョン間の差分を表示します。

--- linux:commands:network:firewall-cmd [2021/11/25 23:35] – [デフォルトゾーンの確認] ともやん
+++ linux:commands:network:firewall-cmd [2022/09/20 13:35] (現在) – [サービスの許可を永続的に削除] ともやん
@@ 行 1: / 行 1: @@
-====== firewalld(Fedora) ======
+====== firewalld (Linux) ======
 firewall-cmd は firewalld パッケージに含まれている。
-<code>
+<WRAP color_term>
+<WRAP color_command><html><pre>
 $ sudo dnf install firewalld
-</code>
+</pre></html></WRAP>
+</WRAP>
-===== 定義済みゾーンの確認 =====
+===== 定義済みゾーンの確認 [--get-zones, --list-all-zones] =====
-<WRAP prewrap 100%>
+Fedora 36\\
-<code>
+<WRAP color_term>
+<WRAP color_command><html><pre>
 $ firewall-cmd --get-zones
-FedoraServer FedoraWorkstation block dmz drop external home internal public trusted work
+</pre></html></WRAP>
-</code>
+<WRAP color_result><html><pre>
+FedoraServer FedoraWorkstation block dmz drop external home internal libvirt nm-shared public trusted work
+</pre></html></WRAP>
 </WRAP>
-===== デフォルトゾーンの確認 =====
+<WRAP color_term>
-<code>
+<WRAP color_command><html><pre>
+$ firewall-cmd --list-all-zones
+</pre></html></WRAP>
+<WRAP color_result_long><html><pre>
+FedoraServer
+  target: default
+  icmp-block-inversion: no
+  interfaces:
+  sources:
+  services: cockpit dhcpv6-client ssh
+  ports:
+  protocols:
+  forward: yes
+  masquerade: no
+  forward-ports:
+  source-ports:
+  icmp-blocks:
+  rich rules:
+FedoraWorkstation (active)
+  target: default
+  icmp-block-inversion: no
+  interfaces: wlp2s0
+  sources:
+  services: dhcpv6-client mdns samba-client ssh vnc-server
+  ports: 1025-65535/udp 1025-65535/tcp
+  protocols:
+  forward: no
+  masquerade: no
+  forward-ports:
+  source-ports:
+  icmp-blocks:
+  rich rules:
+block
+  target: %%REJECT%%
+  icmp-block-inversion: no
+  interfaces:
+  sources:
+  services:
+  ports:
+  protocols:
+  forward: yes
+  masquerade: no
+  forward-ports:
+  source-ports:
+  icmp-blocks:
+  rich rules:
+dmz
+  target: default
+  icmp-block-inversion: no
+  interfaces:
+  sources:
+  services: ssh
+  ports:
+  protocols:
+  forward: yes
+  masquerade: no
+  forward-ports:
+  source-ports:
+  icmp-blocks:
+  rich rules:
+drop
+  target: DROP
+  icmp-block-inversion: no
+  interfaces:
+  sources:
+  services:
+  ports:
+  protocols:
+  forward: yes
+  masquerade: no
+  forward-ports:
+  source-ports:
+  icmp-blocks:
+  rich rules:
+external
+  target: default
+  icmp-block-inversion: no
+  interfaces:
+  sources:
+  services: ssh
+  ports:
+  protocols:
+  forward: yes
+  masquerade: yes
+  forward-ports:
+  source-ports:
+  icmp-blocks:
+  rich rules:
+home
+  target: default
+  icmp-block-inversion: no
+  interfaces:
+  sources:
+  services: dhcpv6-client mdns samba-client ssh
+  ports:
+  protocols:
+  forward: yes
+  masquerade: no
+  forward-ports:
+  source-ports:
+  icmp-blocks:
+  rich rules:
+internal
+  target: default
+  icmp-block-inversion: no
+  interfaces:
+  sources:
+  services: dhcpv6-client mdns samba-client ssh
+  ports:
+  protocols:
+  forward: yes
+  masquerade: no
+  forward-ports:
+  source-ports:
+  icmp-blocks:
+  rich rules:
+libvirt
+  target: ACCEPT
+  icmp-block-inversion: no
+  interfaces:
+  sources:
+  services: dhcp dhcpv6 dns ssh tftp
+  ports:
+  protocols: icmp ipv6-icmp
+  forward: no
+  masquerade: no
+  forward-ports:
+  source-ports:
+  icmp-blocks:
+  rich rules:
+	rule priority="32767" reject
+nm-shared
+  target: ACCEPT
+  icmp-block-inversion: no
+  interfaces:
+  sources:
+  services: dhcp dns ssh
+  ports:
+  protocols: icmp ipv6-icmp
+  forward: no
+  masquerade: no
+  forward-ports:
+  source-ports:
+  icmp-blocks:
+  rich rules:
+	rule priority="32767" reject
+public
+  target: default
+  icmp-block-inversion: no
+  interfaces:
+  sources:
+  services: dhcpv6-client mdns ssh
+  ports:
+  protocols:
+  forward: yes
+  masquerade: no
+  forward-ports:
+  source-ports:
+  icmp-blocks:
+  rich rules:
+trusted
+  target: ACCEPT
+  icmp-block-inversion: no
+  interfaces:
+  sources:
+  services:
+  ports:
+  protocols:
+  forward: yes
+  masquerade: no
+  forward-ports:
+  source-ports:
+  icmp-blocks:
+  rich rules:
+work
+  target: default
+  icmp-block-inversion: no
+  interfaces:
+  sources:
+  services: dhcpv6-client mdns ssh
+  ports:
+  protocols:
+  forward: yes
+  masquerade: no
+  forward-ports:
+  source-ports:
+  icmp-blocks:
+  rich rules:
+</pre></html></WRAP>
+</WRAP>
+Ubuntu 22.04.1 LTS\\
+<WRAP color_term>
+<WRAP color_command><html><pre>
+$ firewall-cmd --get-zones
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
+block dmz drop external home internal nm-shared public trusted work
+</pre></html></WRAP>
+</WRAP>
+<WRAP color_term>
+<WRAP color_command><html><pre>
+$ firewall-cmd --list-all-zones
+</pre></html></WRAP>
+<WRAP color_result_long><html><pre>
+block
+  target: %%REJECT%%
+  icmp-block-inversion: no
+  interfaces:
+  sources:
+  services:
+  ports:
+  protocols:
+  forward: yes
+  masquerade: no
+  forward-ports:
+  source-ports:
+  icmp-blocks:
+  rich rules:
+dmz
+  target: default
+  icmp-block-inversion: no
+  interfaces:
+  sources:
+  services: ssh
+  ports:
+  protocols:
+  forward: yes
+  masquerade: no
+  forward-ports:
+  source-ports:
+  icmp-blocks:
+  rich rules:
+drop
+  target: DROP
+  icmp-block-inversion: no
+  interfaces:
+  sources:
+  services:
+  ports:
+  protocols:
+  forward: yes
+  masquerade: no
+  forward-ports:
+  source-ports:
+  icmp-blocks:
+  rich rules:
+external
+  target: default
+  icmp-block-inversion: no
+  interfaces:
+  sources:
+  services: ssh
+  ports:
+  protocols:
+  forward: yes
+  masquerade: yes
+  forward-ports:
+  source-ports:
+  icmp-blocks:
+  rich rules:
+home
+  target: default
+  icmp-block-inversion: no
+  interfaces:
+  sources:
+  services: dhcpv6-client mdns samba-client ssh
+  ports:
+  protocols:
+  forward: yes
+  masquerade: no
+  forward-ports:
+  source-ports:
+  icmp-blocks:
+  rich rules:
+internal
+  target: default
+  icmp-block-inversion: no
+  interfaces:
+  sources:
+  services: dhcpv6-client mdns samba-client ssh
+  ports:
+  protocols:
+  forward: yes
+  masquerade: no
+  forward-ports:
+  source-ports:
+  icmp-blocks:
+  rich rules:
+nm-shared
+  target: ACCEPT
+  icmp-block-inversion: no
+  interfaces:
+  sources:
+  services: dhcp dns ssh
+  ports:
+  protocols: icmp ipv6-icmp
+  forward: no
+  masquerade: no
+  forward-ports:
+  source-ports:
+  icmp-blocks:
+  rich rules:
+	rule priority="32767" reject
+public (active)
+  target: default
+  icmp-block-inversion: no
+  interfaces: enp1s0
+  sources:
+  services: dhcpv6-client ssh
+  ports:
+  protocols:
+  forward: yes
+  masquerade: no
+  forward-ports:
+  source-ports:
+  icmp-blocks:
+  rich rules:
+trusted
+  target: ACCEPT
+  icmp-block-inversion: no
+  interfaces:
+  sources:
+  services:
+  ports:
+  protocols:
+  forward: yes
+  masquerade: no
+  forward-ports:
+  source-ports:
+  icmp-blocks:
+  rich rules:
+work
+  target: default
+  icmp-block-inversion: no
+  interfaces:
+  sources:
+  services: dhcpv6-client ssh
+  ports:
+  protocols:
+  forward: yes
+  masquerade: no
+  forward-ports:
+  source-ports:
+  icmp-blocks:
+  rich rules:
+</pre></html></WRAP>
+</WRAP>
+===== デフォルトゾーンとアクティブゾーンの確認 =====
+<WRAP color_term>
+<WRAP color_command><html><pre>
 $ firewall-cmd --get-default-zone
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
 FedoraWorkstation
-</code>
+</pre></html></WRAP>
+</WRAP>
+<WRAP color_term>
+<WRAP color_command><html><pre>
+$ firewall-cmd --get-active-zones
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
+FedoraWorkstation
+  interfaces: wlp2s0
+</pre></html></WRAP>
+</WRAP>
-<WRAP center round tip 95%>
+<WRAP left round tip 95% minfont_12>
-<html><div style="font-size: 80%"></html>
 はじめに__デフォルトゾーンの確認を行っておくことは重要__です。\\
-<html><code class="minfont">firewall-cmd</code></html> コマンドを <html><code class="minfont">--zone</code></html> オプションを省略して実行すると、すべての操作はデフォルトゾーンに対して行われます。\\
+<html><code>firewall-cmd</code></html> コマンドを <html><code>--zone</code></html> オプションを省略して実行すると、すべての操作はデフォルトゾーンに対して行われます。\\
-<html><code class="minfont">--zone</code></html> オプションを省略して作業の手間を少なくするには、以降の手順のように**__デフォルトゾーンの変更__**__と__**__アクティブゾーンの変更__**__をセットで行う__ことをオススメします。
+<html><code>--zone</code></html> オプションを省略して作業の手間を少なくするには、以降の手順のように**__デフォルトゾーンの変更__**__と__**__アクティブゾーンの変更__**__をセットで行う__ことをオススメします。
-<WRAP prewrap 100% mincode>
-<html><code class="minfont">--zone</code></html> オプションを省略した場合の実行例:\\
+<html><code>--zone</code></html> オプションを省略した場合の実行例:\\
-<code>
+<WRAP color_term>
+<WRAP color_command><html><pre>
 $ firewall-cmd --get-default-zone
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
 FedoraWorkstation
+</pre></html></WRAP>
+<WRAP color_command><html><pre>
 $ firewall-cmd --list-services
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
 dhcpv6-client mdns samba-client ssh
+</pre></html></WRAP>
+<WRAP color_command><html><pre>
 $ firewall-cmd --zone=FedoraWorkstation --list-services
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
 dhcpv6-client mdns samba-client ssh
+</pre></html></WRAP>
+<WRAP color_command><html><pre>
 $ firewall-cmd --zone=FedoraServer --list-services
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
 cockpit dhcpv6-client ssh
-</code></WRAP>
+</pre></html></WRAP>
+</WRAP>
-例えば、デフォルトゾーンが **FedoraWorkstation** の状態でインタフェース **enp8s0** のアクティブゾーンを **FedoraWorkstation** から **FedoraServer** へ変更した場合、<html><code class="minfont">--zone</code></html> オプションを省略して操作を行うとアクティブゾーンに未使用な **FedoraWorkstation** を操作し続けることになるので、<html><code class="minfont">firewall-cmd</code></html> コマンドは__メッセージ__を表示するようになります。\\
+例えば、デフォルトゾーンが **FedoraWorkstation** の状態でインタフェース **enp8s0** のアクティブゾーンを **FedoraWorkstation** から **FedoraServer** へ変更した場合、<html><code>--zone</code></html> オプションを省略して操作を行うとアクティブゾーンに未使用な **FedoraWorkstation** を操作し続けることになるので、<html><code>firewall-cmd</code></html> コマンドは__メッセージ__を表示するようになります。\\
-<WRAP prewrap 100%>
+<WRAP color_term>
-<WRAP mincode><code>
+<WRAP color_command><html><pre>
 $ firewall-cmd --get-default-zone
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
 FedoraWorkstation
+</pre></html></WRAP>
+<WRAP color_command><html><pre>
 $ firewall-cmd --get-active-zones
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
 FedoraWorkstation
   interfaces: enp8s0
 libvirt
   interfaces: virbr0
+</pre></html></WRAP>
+<WRAP color_command><html><pre>
 $ sudo firewall-cmd --zone=FedoraServer --change-interface=enp8s0
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
 success
+</pre></html></WRAP>
+<WRAP color_command><html><pre>
 $ firewall-cmd --get-active-zones
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
 FedoraServer
   interfaces: enp8s0
@@ 行 56: / 行 477: @@
   interfaces: virbr0
+</pre></html></WRAP>
+<WRAP color_command><html><pre>
 $ firewall-cmd --list-services
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
 You're performing an operation over default zone ('FedoraWorkstation'),
 but your connections/interfaces are in zone 'FedoraServer,libvirt' (see --get-active-zones)
@@ 行 62: / 行 487: @@
 dhcpv6-client mdns samba-client ssh
-</code></WRAP>
+</pre></html></WRAP>
 </WRAP>
-<WRAP prewrap 100% mincode>
+<WRAP mincode>
 メッセージ (翻訳):\\
 <code>
@@ 行 72: / 行 497: @@
 ほとんどの場合、--zone=FedoraServer オプションを使用する必要があります。
 </code></WRAP>
-<html></div></html>
 </WRAP>
-===== デフォルトゾーンの変更 =====
+===== デフォルトゾーンとアクティブゾーンの変更 =====
-workゾーンへ変更
+デフォルトゾーンを FedoraServer へ変更\\
-<code>
+<WRAP color_term>
-$ sudo firewall-cmd --set-default-zone=work
+<WRAP color_command><html><pre>
-</code>
+$ sudo firewall-cmd --set-default-zone=FedoraServer
+</pre></html></WRAP>
-すべてのアクセスを許可するtrustedゾーンへ変更
+<WRAP color_result><html><pre>
-<code>
+success
-$ sudo firewall-cmd --set-default-zone=trusted
+</pre></html></WRAP>
-</code>
+<WRAP color_command><html><pre>
-※これらの変更はすぐに反映される。
+$ firewall-cmd --get-default-zone
+</pre></html></WRAP>
-===== アクティブゾーンの確認 =====
+<WRAP color_result><html><pre>
-<code>
+FedoraServer
+</pre></html></WRAP>
+<WRAP color_command><html><pre>
 $ firewall-cmd --get-active-zones
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
+FedoraWorkstation
+  interfaces: wlp2s0
+</pre></html></WRAP>
+</WRAP>
+※デフォルトゾーンを変更してもアクティブゾーンが変更される訳ではない🤔\\
+　これらの変更はすぐに反映される🤔\\
+\\
+アクティブゾーンを FedoraServer へ変更\\
+<WRAP color_term>
+<WRAP color_command><html><pre>
+$ sudo firewall-cmd --zone=FedoraServer --change-interface=wlp2s0
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
+success
+</pre></html></WRAP>
+<WRAP color_command><html><pre>
+$ firewall-cmd --get-active-zones
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
 FedoraServer
-  interfaces: br0 ens33
+  interfaces: wlp2s0
-</code>
+</pre></html></WRAP>
+</WRAP>
-===== アクティブゾーンの変更 =====
-<code>
-$ sudo firewall-cmd --zone=work --change-interface=ens33
-</code>
 ===== 許可されているサービスの確認 =====
-<code>
+<WRAP color_term>
+<WRAP color_command><html><pre>
 $ firewall-cmd --list-services
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
 dhcpv6-client mdns samba-client ssh
-</code>
+</pre></html></WRAP>
+</WRAP>
 ===== 許可されているポートの確認 =====
-<code>
+<WRAP color_term>
+<WRAP color_command><html><pre>
 $ firewall-cmd --list-ports
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
 /tcp 3389/tcp 5901/tcp
-</code>
+</pre></html></WRAP>
+</WRAP>
 ===== 登録可能なサービスの確認 =====
-<code>
+<WRAP color_term>
+<WRAP color_command><html><pre>
 $ firewall-cmd --get-services
-</code>
+</pre></html></WRAP>
-<WRAP prewrap 100%>
+<WRAP color_result><html><pre>
-<code>
+H-Satellite-6 amanda-client amanda-k5-client amqp amqps apcupsd audit bacula bacula-client bgp bitcoin bitcoin-rpc bitcoin-testnet bitcoin-testnet-rpc ceph ceph-mon cfengine cockpit condor-collector ctdb dhcp dhcpv6 dhcpv6-client distcc dns docker-registry docker-swarm dropbox-lansync elasticsearch etcd-client etcd-server finger freeipa-ldap freeipa-ldaps freeipa-replication freeipa-trust ftp ganglia-client ganglia-master git gre high-availability http https imap imaps ipp ipp-client ipsec irc ircs iscsi-target isns jenkins kadmin kerberos kibana klogin kpasswd kprop kshell ldap ldaps libvirt libvirt-tls lightning-network llmnr managesieve matrix mdns minidlna mongodb mosh mountd mqtt mqtt-tls ms-wbt mssql murmur mysql nfs nfs3 nmea-0183 nrpe ntp nut openvpn ovirt-imageio ovirt-storageconsole ovirt-vmconsole plex pmcd pmproxy pmwebapi pmwebapis pop3 pop3s postgresql privoxy proxy-dhcp ptp pulseaudio puppetmaster quassel radius redis rpc-bind rsh rsyncd rtsp salt-master samba samba-client samba-dc sane sip sips slp smtp smtp-submission smtps snmp snmptrap spideroak-lansync squid ssh steam-streaming svdrp svn syncthing syncthing-gui synergy syslog syslog-tls telnet tftp tftp-client tinc tor-socks transmission-client upnp-client vdsm vnc-server wbem-http wbem-https wsman wsmans xdmcp xmpp-bosh xmpp-client xmpp-local xmpp-server zabbix-agent zabbix-server
-RH-Satellite-6 amanda-client amanda-k5-client amqp amqps apcupsd audit bacula bacula-client bgp bitcoin bitcoin-rpc bitcoin-testnet bitcoin-testnet-rpc ceph ceph-mon cfengine cockpit condor-collector ctdb dhcp dhcpv6 dhcpv6-client distcc dns docker-registry docker-swarm dropbox-lansync elasticsearch etcd-client etcd-server finger freeipa-ldap freeipa-ldaps freeipa-replication freeipa-trust ftp ganglia-client ganglia-master git gre high-availability http https imap imaps ipp ipp-client ipsec irc ircs iscsi-target isns jenkins kadmin kerberos kibana klogin kpasswd kprop kshell ldap ldaps libvirt libvirt-tls lightning-network llmnr managesieve matrix mdns minidlna mongodb mosh mountd mqtt mqtt-tls ms-wbt mssql murmur mysql nfs nfs3 nmea-0183 nrpe ntp nut openvpn ovirt-imageio ovirt-storageconsole ovirt-vmconsole plex pmcd pmproxy pmwebapi pmwebapis pop3 pop3s postgresql privoxy proxy-dhcp ptp pulseaudio puppetmaster quassel radius redis rpc-bind rsh rsyncd rtsp salt-master samba samba-client samba-dc sane sip sips slp smtp smtp-submission smtps snmp snmptrap spideroak-lansync squid ssh steam-streaming svdrp svn syncthing syncthing-gui synergy syslog syslog-tls telnet tftp tftp-client tinc tor-socks transmission-client upnp-client vdsm vnc-server wbem-http wbem-https wsman wsmans xdmcp xmpp-bosh xmpp-client xmpp-local xmpp-server zabbix-agent zabbix-server
+</pre></html></WRAP>
-</code>
 </WRAP>
 ===== サービスを永続的に許可 =====
-<code>
+<WRAP color_term>
+<WRAP color_command><html><pre>
 $ sudo firewall-cmd --permanent --add-service=ssh
-</code>
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
+</pre></html></WRAP>
+</WRAP>
 ===== サービスの許可を永続的に削除 =====
-<code>
+<WRAP color_term>
+<WRAP color_command><html><pre>
 $ sudo firewall-cmd --permanent --remove-service=ssh
-</code>
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
+success
+</pre></html></WRAP>
+</WRAP>
+複数サービスの許可を一括で永続的に削除🤤\\
+<WRAP color_term>
+<WRAP color_command><html><pre>
+$ sudo firewall-cmd --permanent --remove-service={ssh,cockpit}
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
+success
+</pre></html></WRAP>
+</WRAP>
 ===== 特定ポートを永続的に許可 =====
-<code>
+<WRAP color_term>
+<WRAP color_command><html><pre>
 $ sudo firewall-cmd --permanent --add-port=22022/tcp
-</code>
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
+</pre></html></WRAP>
+</WRAP>
 ==== 特定ポートの許可を永続的に削除 ====
-<code>
+<WRAP color_term>
+<WRAP color_command><html><pre>
 $ sudo firewall-cmd --permanent --remove-port=22022/tcp
-</code>
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
+</pre></html></WRAP>
+</WRAP>
 ===== アクセス許可 =====
-<code>
+<WRAP color_term>
+<WRAP color_command><html><pre>
 $ sudo firewall-cmd --permanent --add-source=192.168.1.0/24
-</code>
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
+</pre></html></WRAP>
+</WRAP>
 ===== アクセス拒否 =====
 drop ゾーンにIPアドレスを登録する。
-<code>
+<WRAP color_term>
+<WRAP color_command><html><pre>
 $ sudo firewall-cmd --permanent --add-source=192.168.1.0/24 --zone=drop
 $ sudo firewall-cmd --permanent --add-source=192.168.1.1 --zone=drop
-</code>
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
+</pre></html></WRAP>
+</WRAP>
 拒否リストの表示
-<code>
+<WRAP color_term>
+<WRAP color_command><html><pre>
 $ sudo firewall-cmd --list-sources --zone=drop
 .168.1.0/24 192.168.1.1
-</code>
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
+</pre></html></WRAP>
+</WRAP>
 拒否リストの削除
-<code>
+<WRAP color_term>
+<WRAP color_command><html><pre>
 $ sudo firewall-cmd --permanent --remove-source=192.168.1.0/24 --zone=drop
 $ sudo firewall-cmd --permanent --remove-source=192.168.1.1 --zone=drop
-</code>
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
+</pre></html></WRAP>
+</WRAP>
 ===== firewalld の状態を失わずにリロード =====
-<code>
+<WRAP color_term>
+<WRAP color_command><html><pre>
 $ sudo firewall-cmd --reload
-</code>
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
+</pre></html></WRAP>
+</WRAP>
 ===== サービスで許可されるポートを調べる =====
-　各サービスの定義ファイルを調べることにより許可されるポートがわかる。
+各サービスの定義ファイルを調べることにより許可されるポートがわかる。
-<code>
+<WRAP color_term>
+<WRAP color_command><html><pre>
 $ cat /usr/lib/firewalld/services/ldap.xml
-</code>
+</pre></html></WRAP>
+<WRAP color_result>
 <code xml>
 <?xml version="1.0" encoding="utf-8"?>
@@ 行 179: / 行 682: @@
   <port protocol="tcp" port="389"/>
 </service>
-</code>
+</code></WRAP>
+</WRAP>
+===== ヘルプ [--help] =====
+<WRAP color_term>
+<WRAP color_command><html><pre>
+$ firewall-cmd --help
+</pre></html></WRAP>
+<WRAP color_result_long><html><pre>
+Usage: firewall-cmd [OPTIONS...]
+General Options
+  -h, --help           Prints a short help text and exists
+  -V, --version        Print the version string of firewalld
+  -q, --quiet          Do not print status messages
+Status Options
+  --state              Return and print firewalld state
+  --reload             Reload firewall and keep state information
+  --complete-reload    Reload firewall and lose state information
+  --runtime-to-permanent
+                       Create permanent from runtime configuration
+  --check-config       Check permanent configuration for errors
+Log Denied Options
+  --get-log-denied     Print the log denied value
+  --set-log-denied=&lt;value>
+                       Set log denied value
+Permanent Options
+  --permanent          Set an option permanently
+                       Usable for options marked with [P]
+Zone Options
+  --get-default-zone   Print default zone for connections and interfaces
+  --set-default-zone=&lt;zone>
+                       Set default zone
+  --get-active-zones   Print currently active zones
+  --get-zones          Print predefined zones [P]
+  --get-services       Print predefined services [P]
+  --get-icmptypes      Print predefined icmptypes [P]
+  --get-zone-of-interface=&lt;interface>
+                       Print name of the zone the interface is bound to [P]
+  --get-zone-of-source=&lt;source>[/&lt;mask>]|&lt;MAC>|ipset:&lt;ipset>
+                       Print name of the zone the source is bound to [P]
+  --list-all-zones     List everything added for or enabled in all zones [P]
+  --new-zone=&lt;zone>    Add a new zone [P only]
+  --new-zone-from-file=&lt;filename> [--name=&lt;zone>]
+                       Add a new zone from file with optional name [P only]
+  --delete-zone=&lt;zone> Delete an existing zone [P only]
+  --load-zone-defaults=&lt;zone>
+                       Load zone default settings [P only]
+  --zone=&lt;zone>        Use this zone to set or query options, else default zone
+                       Usable for options marked with [Z]
+  --info-zone=&lt;zone>   Print information about a zone
+  --path-zone=&lt;zone>   Print file path of a zone [P only]
+Policy Options
+  --get-policies       Print predefined policies
+  --get-active-policies
+                       Print currently active policies
+  --list-all-policies  List everything added for or enabled in all policies
+  --new-policy=&lt;policy>
+                       Add a new empty policy
+  --new-policy-from-file=&lt;filename> [--name=&lt;policy>]
+                       Add a new policy from file with optional name override [P only]
+  --delete-policy=&lt;policy>
+                       Delete an existing policy
+  --load-policy-defaults=&lt;policy>
+                       Load policy default settings
+  --policy=&lt;policy>    Use this policy to set or query options
+                       Usable for options marked with [O]
+  --info-policy=&lt;policy>
+                       Print information about a policy
+  --path-policy=&lt;policy>
+                       Print file path of a policy
+IPSet Options
+  --get-ipset-types    Print the supported ipset types
+  --new-ipset=&lt;ipset> --type=&lt;ipset type> [--option=&lt;key>[=&lt;value>]]..
+                       Add a new ipset [P only]
+  --new-ipset-from-file=&lt;filename> [--name=&lt;ipset>]
+                       Add a new ipset from file with optional name [P only]
+  --delete-ipset=&lt;ipset>
+                       Delete an existing ipset [P only]
+  --load-ipset-defaults=&lt;ipset>
+                       Load ipset default settings [P only]
+  --info-ipset=&lt;ipset> Print information about an ipset
+  --path-ipset=&lt;ipset> Print file path of an ipset [P only]
+  --get-ipsets         Print predefined ipsets
+  --ipset=&lt;ipset> --set-description=&lt;description>
+                       Set new description to ipset [P only]
+  --ipset=&lt;ipset> --get-description
+                       Print description for ipset [P only]
+  --ipset=&lt;ipset> --set-short=&lt;description>
+                       Set new short description to ipset [P only]
+  --ipset=&lt;ipset> --get-short
+                       Print short description for ipset [P only]
+  --ipset=&lt;ipset> --add-entry=&lt;entry>
+                       Add a new entry to an ipset [P]
+  --ipset=&lt;ipset> --remove-entry=&lt;entry>
+                       Remove an entry from an ipset [P]
+  --ipset=&lt;ipset> --query-entry=&lt;entry>
+                       Return whether ipset has an entry [P]
+  --ipset=&lt;ipset> --get-entries
+                       List entries of an ipset [P]
+  --ipset=&lt;ipset> --add-entries-from-file=&lt;entry>
+                       Add a new entries to an ipset [P]
+  --ipset=&lt;ipset> --remove-entries-from-file=&lt;entry>
+                       Remove entries from an ipset [P]
+IcmpType Options
+  --new-icmptype=&lt;icmptype>
+                       Add a new icmptype [P only]
+  --new-icmptype-from-file=&lt;filename> [--name=&lt;icmptype>]
+                       Add a new icmptype from file with optional name [P only]
+  --delete-icmptype=&lt;icmptype>
+                       Delete an existing icmptype [P only]
+  --load-icmptype-defaults=&lt;icmptype>
+                       Load icmptype default settings [P only]
+  --info-icmptype=&lt;icmptype>
+                       Print information about an icmptype
+  --path-icmptype=&lt;icmptype>
+                       Print file path of an icmptype [P only]
+  --icmptype=&lt;icmptype> --set-description=&lt;description>
+                       Set new description to icmptype [P only]
+  --icmptype=&lt;icmptype> --get-description
+                       Print description for icmptype [P only]
+  --icmptype=&lt;icmptype> --set-short=&lt;description>
+                       Set new short description to icmptype [P only]
+  --icmptype=&lt;icmptype> --get-short
+                       Print short description for icmptype [P only]
+  --icmptype=&lt;icmptype> --add-destination=&lt;ipv>
+                       Enable destination for ipv in icmptype [P only]
+  --icmptype=&lt;icmptype> --remove-destination=&lt;ipv>
+                       Disable destination for ipv in icmptype [P only]
+  --icmptype=&lt;icmptype> --query-destination=&lt;ipv>
+                       Return whether destination ipv is enabled in icmptype [P only]
+  --icmptype=&lt;icmptype> --get-destinations
+                       List destinations in icmptype [P only]
+Service Options
+  --new-service=&lt;service>
+                       Add a new service [P only]
+  --new-service-from-file=&lt;filename> [--name=&lt;service>]
+                       Add a new service from file with optional name [P only]
+  --delete-service=&lt;service>
+                       Delete an existing service [P only]
+  --load-service-defaults=&lt;service>
+                       Load icmptype default settings [P only]
+  --info-service=&lt;service>
+                       Print information about a service
+  --path-service=&lt;service>
+                       Print file path of a service [P only]
+  --service=&lt;service> --set-description=&lt;description>
+                       Set new description to service [P only]
+  --service=&lt;service> --get-description
+                       Print description for service [P only]
+  --service=&lt;service> --set-short=&lt;description>
+                       Set new short description to service [P only]
+  --service=&lt;service> --get-short
+                       Print short description for service [P only]
+  --service=&lt;service> --add-port=&lt;portid>[-&lt;portid>]/&lt;protocol>
+                       Add a new port to service [P only]
+  --service=&lt;service> --remove-port=&lt;portid>[-&lt;portid>]/&lt;protocol>
+                       Remove a port from service [P only]
+  --service=&lt;service> --query-port=&lt;portid>[-&lt;portid>]/&lt;protocol>
+                       Return whether the port has been added for service [P only]
+  --service=&lt;service> --get-ports
+                       List ports of service [P only]
+  --service=&lt;service> --add-protocol=&lt;protocol>
+                       Add a new protocol to service [P only]
+  --service=&lt;service> --remove-protocol=&lt;protocol>
+                       Remove a protocol from service [P only]
+  --service=&lt;service> --query-protocol=&lt;protocol>
+                       Return whether the protocol has been added for service [P only]
+  --service=&lt;service> --get-protocols
+                       List protocols of service [P only]
+  --service=&lt;service> --add-source-port=&lt;portid>[-&lt;portid>]/&lt;protocol>
+                       Add a new source port to service [P only]
+  --service=&lt;service> --remove-source-port=&lt;portid>[-&lt;portid>]/&lt;protocol>
+                       Remove a source port from service [P only]
+  --service=&lt;service> --query-source-port=&lt;portid>[-&lt;portid>]/&lt;protocol>
+                       Return whether the source port has been added for service [P only]
+  --service=&lt;service> --get-source-ports
+                       List source ports of service [P only]
+  --service=&lt;service> --add-helper=&lt;helper>
+                       Add a new helper to service [P only]
+  --service=&lt;service> --remove-helper=&lt;helper>
+                       Remove a helper from service [P only]
+  --service=&lt;service> --query-helper=&lt;helper>
+                       Return whether the helper has been added for service [P only]
+  --service=&lt;service> --get-service-helpers
+                       List helpers of service [P only]
+  --service=&lt;service> --set-destination=&lt;ipv>:&lt;address>[/&lt;mask>]
+                       Set destination for ipv to address in service [P only]
+  --service=&lt;service> --remove-destination=&lt;ipv>
+                       Disable destination for ipv i service [P only]
+  --service=&lt;service> --query-destination=&lt;ipv>:&lt;address>[/&lt;mask>]
+                       Return whether destination ipv is set for service [P only]
+  --service=&lt;service> --get-destinations
+                       List destinations in service [P only]
+  --service=&lt;service> --add-include=&lt;service>
+                       Add a new include to service [P only]
+  --service=&lt;service> --remove-include=&lt;service>
+                       Remove a include from service [P only]
+  --service=&lt;service> --query-include=&lt;service>
+                       Return whether the include has been added for service [P only]
+  --service=&lt;service> --get-includes
+                       List includes of service [P only]
+Options to Adapt and Query Zones and Policies
+  --list-all           List everything added for or enabled [P] [Z] [O]
+  --timeout=&lt;timeval>  Enable an option for timeval time, where timeval is
+                       a number followed by one of letters 's' or 'm' or 'h'
+                       Usable for options marked with [T]
+  --set-description=&lt;description>
+                       Set new description [P only] [Z] [O]
+  --get-description    Print description [P only] [Z] [O]
+  --get-target         Get the target [P only] [Z] [O]
+  --set-target=&lt;target>
+                       Set the target [P only] [Z] [O]
+  --set-short=&lt;description>
+                       Set new short description [Z] [O]
+  --get-short          Print short description [P only] [Z] [O]
+  --list-services      List services added [P] [Z]
+  --add-service=&lt;service>
+                       Add a service [P] [Z] [O] [T]
+  --remove-service=&lt;service>
+                       Remove a service [P] [Z] [O]
+  --query-service=&lt;service>
+                       Return whether service has been added [P] [Z] [O]
+  --list-ports         List ports added [P] [Z] [O]
+  --add-port=&lt;portid>[-&lt;portid>]/&lt;protocol>
+                       Add the port [P] [Z] [O] [T]
+  --remove-port=&lt;portid>[-&lt;portid>]/&lt;protocol>
+                       Remove the port [P] [Z] [O]
+  --query-port=&lt;portid>[-&lt;portid>]/&lt;protocol>
+                       Return whether the port has been added [P] [Z] [O]
+  --list-protocols     List protocols added [P] [Z] [O]
+  --add-protocol=&lt;protocol>
+                       Add the protocol [P] [Z] [O] [T]
+  --remove-protocol=&lt;protocol>
+                       Remove the protocol [P] [Z] [O]
+  --query-protocol=&lt;protocol>
+                       Return whether the protocol has been added [P] [Z] [O]
+  --list-source-ports  List source ports added [P] [Z] [O]
+  --add-source-port=&lt;portid>[-&lt;portid>]/&lt;protocol>
+                       Add the source port [P] [Z] [O] [T]
+  --remove-source-port=&lt;portid>[-&lt;portid>]/&lt;protocol>
+                       Remove the source port [P] [Z] [O]
+  --query-source-port=&lt;portid>[-&lt;portid>]/&lt;protocol>
+                       Return whether the source port has been added [P] [Z] [O]
+  --list-icmp-blocks   List Internet ICMP type blocks added [P] [Z] [O]
+  --add-icmp-block=&lt;icmptype>
+                       Add an ICMP block [P] [Z] [O] [T]
+  --remove-icmp-block=&lt;icmptype>
+                       Remove the ICMP block [P] [Z] [O]
+  --query-icmp-block=&lt;icmptype>
+                       Return whether an ICMP block has been added [P] [Z] [O]
+  --list-forward-ports List IPv4 forward ports added [P] [Z] [O]
+  --add-forward-port=port=&lt;portid>[-&lt;portid>]:proto=&lt;protocol>[:toport=&lt;portid>[-&lt;portid>]][:toaddr=&lt;address>[/&lt;mask>]]
+                       Add the IPv4 forward port [P] [Z] [O] [T]
+  --remove-forward-port=port=&lt;portid>[-&lt;portid>]:proto=&lt;protocol>[:toport=&lt;portid>[-&lt;portid>]][:toaddr=&lt;address>[/&lt;mask>]]
+                       Remove the IPv4 forward port [P] [Z] [O]
+  --query-forward-port=port=&lt;portid>[-&lt;portid>]:proto=&lt;protocol>[:toport=&lt;portid>[-&lt;portid>]][:toaddr=&lt;address>[/&lt;mask>]]
+                       Return whether the IPv4 forward port has been added [P] [Z] [O]
+  --add-masquerade     Enable IPv4 masquerade [P] [Z] [O] [T]
+  --remove-masquerade  Disable IPv4 masquerade [P] [Z] [O]
+  --query-masquerade   Return whether IPv4 masquerading has been enabled [P] [Z] [O]
+  --list-rich-rules    List rich language rules added [P] [Z] [O]
+  --add-rich-rule=&lt;rule>
+                       Add rich language rule 'rule' [P] [Z] [O] [T]
+  --remove-rich-rule=&lt;rule>
+                       Remove rich language rule 'rule' [P] [Z] [O]
+  --query-rich-rule=&lt;rule>
+                       Return whether a rich language rule 'rule' has been
+                       added [P] [Z] [O]
+Options to Adapt and Query Zones
+  --add-icmp-block-inversion
+                       Enable inversion of icmp blocks for a zone [P] [Z]
+  --remove-icmp-block-inversion
+                       Disable inversion of icmp blocks for a zone [P] [Z]
+  --query-icmp-block-inversion
+                       Return whether inversion of icmp blocks has been enabled
+                       for a zone [P] [Z]
+  --add-forward        Enable forwarding of packets between interfaces and
+                       sources in a zone [P] [Z] [T]
+  --remove-forward     Disable forwarding of packets between interfaces and
+                       sources in a zone [P] [Z]
+  --query-forward      Return whether forwarding of packets between interfaces
+                       and sources has been enabled for a zone [P] [Z]
+Options to Adapt and Query Policies
+  --get-priority       Get the priority [P only] [O]
+  --set-priority=&lt;priority>
+                       Set the priority [P only] [O]
+  --list-ingress-zones
+                       List ingress zones that are bound to a policy [P] [O]
+  --add-ingress-zone=&lt;zone>
+                       Add the ingress zone to a policy [P] [O]
+  --remove-ingress-zone=&lt;zone>
+                       Remove the ingress zone from a policy [P] [O]
+  --query-ingress-zone=&lt;zone>
+                       Query whether the ingress zone has been adedd to a
+                       policy [P] [O]
+  --list-egress-zones
+                       List egress zones that are bound to a policy [P] [O]
+  --add-egress-zone=&lt;zone>
+                       Add the egress zone to a policy [P] [O]
+  --remove-egress-zone=&lt;zone>
+                       Remove the egress zone from a policy [P] [O]
+  --query-egress-zone=&lt;zone>
+                       Query whether the egress zone has been adedd to a
+                       policy [P] [O]
+Options to Handle Bindings of Interfaces
+  --list-interfaces    List interfaces that are bound to a zone [P] [Z]
+  --add-interface=&lt;interface>
+                       Bind the &lt;interface> to a zone [P] [Z]
+  --change-interface=&lt;interface>
+                       Change zone the &lt;interface> is bound to [P] [Z]
+  --query-interface=&lt;interface>
+                       Query whether &lt;interface> is bound to a zone [P] [Z]
+  --remove-interface=&lt;interface>
+                       Remove binding of &lt;interface> from a zone [P] [Z]
+Options to Handle Bindings of Sources
+  --list-sources       List sources that are bound to a zone [P] [Z]
+  --add-source=&lt;source>[/&lt;mask>]|&lt;MAC>|ipset:&lt;ipset>
+                       Bind the source to a zone [P] [Z]
+  --change-source=&lt;source>[/&lt;mask>]|&lt;MAC>|ipset:&lt;ipset>
+                       Change zone the source is bound to [Z]
+  --query-source=&lt;source>[/&lt;mask>]|&lt;MAC>|ipset:&lt;ipset>
+                       Query whether the source is bound to a zone [P] [Z]
+  --remove-source=&lt;source>[/&lt;mask>]|&lt;MAC>|ipset:&lt;ipset>
+                       Remove binding of the source from a zone [P] [Z]
+Helper Options
+  --new-helper=&lt;helper> --module=&lt;module> [--family=&lt;family>]
+                       Add a new helper [P only]
+  --new-helper-from-file=&lt;filename> [--name=&lt;helper>]
+                       Add a new helper from file with optional name [P only]
+  --delete-helper=&lt;helper>
+                       Delete an existing helper [P only]
+  --load-helper-defaults=&lt;helper>
+                       Load helper default settings [P only]
+  --info-helper=&lt;helper> Print information about an helper
+  --path-helper=&lt;helper> Print file path of an helper [P only]
+  --get-helpers         Print predefined helpers
+  --helper=&lt;helper> --set-description=&lt;description>
+                       Set new description to helper [P only]
+  --helper=&lt;helper> --get-description
+                       Print description for helper [P only]
+  --helper=&lt;helper> --set-short=&lt;description>
+                       Set new short description to helper [P only]
+  --helper=&lt;helper> --get-short
+                       Print short description for helper [P only]
+  --helper=&lt;helper> --add-port=&lt;portid>[-&lt;portid>]/&lt;protocol>
+                       Add a new port to helper [P only]
+  --helper=&lt;helper> --remove-port=&lt;portid>[-&lt;portid>]/&lt;protocol>
+                       Remove a port from helper [P only]
+  --helper=&lt;helper> --query-port=&lt;portid>[-&lt;portid>]/&lt;protocol>
+                       Return whether the port has been added for helper [P only]
+  --helper=&lt;helper> --get-ports
+                       List ports of helper [P only]
+  --helper=&lt;helper> --set-module=&lt;module>
+                       Set module to helper [P only]
+  --helper=&lt;helper> --get-module
+                       Get module from helper [P only]
+  --helper=&lt;helper> --set-family={ipv4|ipv6|}
+                       Set family for helper [P only]
+  --helper=&lt;helper> --get-family
+                       Get module from helper [P only]
+Direct Options
+  --direct             First option for all direct options
+  --get-all-chains
+                       Get all chains [P]
+  --get-chains {ipv4|ipv6|eb} &lt;table>
+                       Get all chains added to the table [P]
+  --add-chain {ipv4|ipv6|eb} &lt;table> &lt;chain>
+                       Add a new chain to the table [P]
+  --remove-chain {ipv4|ipv6|eb} &lt;table> &lt;chain>
+                       Remove the chain from the table [P]
+  --query-chain {ipv4|ipv6|eb} &lt;table> &lt;chain>
+                       Return whether the chain has been added to the table [P]
+  --get-all-rules
+                       Get all rules [P]
+  --get-rules {ipv4|ipv6|eb} &lt;table> &lt;chain>
+                       Get all rules added to chain in table [P]
+  --add-rule {ipv4|ipv6|eb} &lt;table> &lt;chain> &lt;priority> &lt;arg>...
+                       Add rule to chain in table [P]
+  --remove-rule {ipv4|ipv6|eb} &lt;table> &lt;chain> &lt;priority> &lt;arg>...
+                       Remove rule with priority from chain in table [P]
+  --remove-rules {ipv4|ipv6|eb} &lt;table> &lt;chain>
+                       Remove rules from chain in table [P]
+  --query-rule {ipv4|ipv6|eb} &lt;table> &lt;chain> &lt;priority> &lt;arg>...
+                       Return whether a rule with priority has been added to
+                       chain in table [P]
+  --passthrough {ipv4|ipv6|eb} &lt;arg>...
+                       Pass a command through (untracked by firewalld)
+  --get-all-passthroughs
+                       Get all tracked passthrough rules [P]
+  --get-passthroughs {ipv4|ipv6|eb} &lt;arg>...
+                       Get tracked passthrough rules [P]
+  --add-passthrough {ipv4|ipv6|eb} &lt;arg>...
+                       Add a new tracked passthrough rule [P]
+  --remove-passthrough {ipv4|ipv6|eb} &lt;arg>...
+                       Remove a tracked passthrough rule [P]
+  --query-passthrough {ipv4|ipv6|eb} &lt;arg>...
+                       Return whether the tracked passthrough rule has been
+                       added [P]
+Lockdown Options
+  --lockdown-on        Enable lockdown.
+  --lockdown-off       Disable lockdown.
+  --query-lockdown     Query whether lockdown is enabled
+Lockdown Whitelist Options
+  --list-lockdown-whitelist-commands
+                       List all command lines that are on the whitelist [P]
+  --add-lockdown-whitelist-command=&lt;command>
+                       Add the command to the whitelist [P]
+  --remove-lockdown-whitelist-command=&lt;command>
+                       Remove the command from the whitelist [P]
+  --query-lockdown-whitelist-command=&lt;command>
+                       Query whether the command is on the whitelist [P]
+  --list-lockdown-whitelist-contexts
+                       List all contexts that are on the whitelist [P]
+  --add-lockdown-whitelist-context=&lt;context>
+                       Add the context context to the whitelist [P]
+  --remove-lockdown-whitelist-context=&lt;context>
+                       Remove the context from the whitelist [P]
+  --query-lockdown-whitelist-context=&lt;context>
+                       Query whether the context is on the whitelist [P]
+  --list-lockdown-whitelist-uids
+                       List all user ids that are on the whitelist [P]
+  --add-lockdown-whitelist-uid=&lt;uid>
+                       Add the user id uid to the whitelist [P]
+  --remove-lockdown-whitelist-uid=&lt;uid>
+                       Remove the user id uid from the whitelist [P]
+  --query-lockdown-whitelist-uid=&lt;uid>
+                       Query whether the user id uid is on the whitelist [P]
+  --list-lockdown-whitelist-users
+                       List all user names that are on the whitelist [P]
+  --add-lockdown-whitelist-user=&lt;user>
+                       Add the user name user to the whitelist [P]
+  --remove-lockdown-whitelist-user=&lt;user>
+                       Remove the user name user from the whitelist [P]
+  --query-lockdown-whitelist-user=&lt;user>
+                       Query whether the user name user is on the whitelist [P]
+Panic Options
+  --panic-on           Enable panic mode
+  --panic-off          Disable panic mode
+  --query-panic        Query whether panic mode is enabled
+</pre></html></WRAP>
+</WRAP>
+===== 参考文献 =====
+==== 付録 ====
+[[tw>tomoyan596/status/1463880721571872781|firewall-cmdこんないいヤツでした？😅You're performing an operation over default zone ('FedoraWorkstation'),but your connections/interfaces are in zone 'FedoraServer,libvirt' (see --get-active-zones)You most likely need to use --zone=FedoraServer option. / Twitter]]\\