linux:commands:network:firewall-cmd

差分

このページの2つのバージョン間の差分を表示します。

この比較画面へのリンク

両方とも前のリビジョン 前のリビジョン
次のリビジョン		 前のリビジョン
linux:commands:network:firewall-cmd [2022/09/13 04:25] – ともやんlinux:commands:network:firewall-cmd [2022/09/20 13:35] (現在) – [サービスの許可を永続的に削除] ともやん
行 1: 行 1:
-====== firewalld(Fedora) ======+====== firewalld (Linux) ======
 firewall-cmd は firewalld パッケージに含まれている。 firewall-cmd は firewalld パッケージに含まれている。
 <WRAP color_term> <WRAP color_term>
行 7: 行 7:
 </WRAP> </WRAP>
  
-===== 定義済みゾーンの確認 =====+===== 定義済みゾーンの確認 [--get-zones, --list-all-zones] ===== 
 +Fedora 36\\
 <WRAP color_term> <WRAP color_term>
 <WRAP color_command><html><pre> <WRAP color_command><html><pre>
行 17: 行 18:
 </WRAP> </WRAP>
  
-===== デフォルトゾーンの確認 =====+<WRAP color_term> 
 +<WRAP color_command><html><pre> 
 +$ firewall-cmd --list-all-zones 
 +</pre></html></WRAP> 
 +<WRAP color_result_long><html><pre> 
 +FedoraServer 
 +  target: default 
 +  icmp-block-inversion: no 
 +  interfaces:  
 +  sources:  
 +  services: cockpit dhcpv6-client ssh 
 +  ports:  
 +  protocols:  
 +  forward: yes 
 +  masquerade: no 
 +  forward-ports:  
 +  source-ports:  
 +  icmp-blocks:  
 +  rich rules:  
 + 
 +FedoraWorkstation (active) 
 +  target: default 
 +  icmp-block-inversion: no 
 +  interfaces: wlp2s0 
 +  sources:  
 +  services: dhcpv6-client mdns samba-client ssh vnc-server 
 +  ports: 1025-65535/udp 1025-65535/tcp 
 +  protocols:  
 +  forward: no 
 +  masquerade: no 
 +  forward-ports:  
 +  source-ports:  
 +  icmp-blocks:  
 +  rich rules:  
 + 
 +block 
 +  target: %%REJECT%% 
 +  icmp-block-inversion: no 
 +  interfaces:  
 +  sources:  
 +  services:  
 +  ports:  
 +  protocols:  
 +  forward: yes 
 +  masquerade: no 
 +  forward-ports:  
 +  source-ports:  
 +  icmp-blocks:  
 +  rich rules:  
 + 
 +dmz 
 +  target: default 
 +  icmp-block-inversion: no 
 +  interfaces:  
 +  sources:  
 +  services: ssh 
 +  ports:  
 +  protocols:  
 +  forward: yes 
 +  masquerade: no 
 +  forward-ports:  
 +  source-ports:  
 +  icmp-blocks:  
 +  rich rules:  
 + 
 +drop 
 +  target: DROP 
 +  icmp-block-inversion: no 
 +  interfaces:  
 +  sources:  
 +  services:  
 +  ports:  
 +  protocols:  
 +  forward: yes 
 +  masquerade: no 
 +  forward-ports:  
 +  source-ports:  
 +  icmp-blocks:  
 +  rich rules:  
 + 
 +external 
 +  target: default 
 +  icmp-block-inversion: no 
 +  interfaces:  
 +  sources:  
 +  services: ssh 
 +  ports:  
 +  protocols:  
 +  forward: yes 
 +  masquerade: yes 
 +  forward-ports:  
 +  source-ports:  
 +  icmp-blocks:  
 +  rich rules:  
 + 
 +home 
 +  target: default 
 +  icmp-block-inversion: no 
 +  interfaces:  
 +  sources:  
 +  services: dhcpv6-client mdns samba-client ssh 
 +  ports:  
 +  protocols:  
 +  forward: yes 
 +  masquerade: no 
 +  forward-ports:  
 +  source-ports:  
 +  icmp-blocks:  
 +  rich rules:  
 + 
 +internal 
 +  target: default 
 +  icmp-block-inversion: no 
 +  interfaces:  
 +  sources:  
 +  services: dhcpv6-client mdns samba-client ssh 
 +  ports:  
 +  protocols:  
 +  forward: yes 
 +  masquerade: no 
 +  forward-ports:  
 +  source-ports:  
 +  icmp-blocks:  
 +  rich rules:  
 + 
 +libvirt 
 +  target: ACCEPT 
 +  icmp-block-inversion: no 
 +  interfaces:  
 +  sources:  
 +  services: dhcp dhcpv6 dns ssh tftp 
 +  ports:  
 +  protocols: icmp ipv6-icmp 
 +  forward: no 
 +  masquerade: no 
 +  forward-ports:  
 +  source-ports:  
 +  icmp-blocks:  
 +  rich rules:  
 + rule priority="32767" reject 
 + 
 +nm-shared 
 +  target: ACCEPT 
 +  icmp-block-inversion: no 
 +  interfaces:  
 +  sources:  
 +  services: dhcp dns ssh 
 +  ports:  
 +  protocols: icmp ipv6-icmp 
 +  forward: no 
 +  masquerade: no 
 +  forward-ports:  
 +  source-ports:  
 +  icmp-blocks:  
 +  rich rules:  
 + rule priority="32767" reject 
 + 
 +public 
 +  target: default 
 +  icmp-block-inversion: no 
 +  interfaces:  
 +  sources:  
 +  services: dhcpv6-client mdns ssh 
 +  ports:  
 +  protocols:  
 +  forward: yes 
 +  masquerade: no 
 +  forward-ports:  
 +  source-ports:  
 +  icmp-blocks:  
 +  rich rules:  
 + 
 +trusted 
 +  target: ACCEPT 
 +  icmp-block-inversion: no 
 +  interfaces:  
 +  sources:  
 +  services:  
 +  ports:  
 +  protocols:  
 +  forward: yes 
 +  masquerade: no 
 +  forward-ports:  
 +  source-ports:  
 +  icmp-blocks:  
 +  rich rules:  
 + 
 +work 
 +  target: default 
 +  icmp-block-inversion: no 
 +  interfaces:  
 +  sources:  
 +  services: dhcpv6-client mdns ssh 
 +  ports:  
 +  protocols:  
 +  forward: yes 
 +  masquerade: no 
 +  forward-ports:  
 +  source-ports:  
 +  icmp-blocks:  
 +  rich rules:  
 + 
 +</pre></html></WRAP> 
 +</WRAP> 
 + 
 +Ubuntu 22.04.1 LTS\\ 
 +<WRAP color_term> 
 +<WRAP color_command><html><pre> 
 +$ firewall-cmd --get-zones 
 +</pre></html></WRAP> 
 +<WRAP color_result><html><pre> 
 +block dmz drop external home internal nm-shared public trusted work 
 +</pre></html></WRAP> 
 +</WRAP> 
 + 
 +<WRAP color_term> 
 +<WRAP color_command><html><pre> 
 +$ firewall-cmd --list-all-zones 
 +</pre></html></WRAP> 
 +<WRAP color_result_long><html><pre> 
 +block 
 +  target: %%REJECT%% 
 +  icmp-block-inversion: no 
 +  interfaces:  
 +  sources:  
 +  services:  
 +  ports:  
 +  protocols:  
 +  forward: yes 
 +  masquerade: no 
 +  forward-ports:  
 +  source-ports:  
 +  icmp-blocks:  
 +  rich rules:  
 + 
 +dmz 
 +  target: default 
 +  icmp-block-inversion: no 
 +  interfaces:  
 +  sources:  
 +  services: ssh 
 +  ports:  
 +  protocols:  
 +  forward: yes 
 +  masquerade: no 
 +  forward-ports:  
 +  source-ports:  
 +  icmp-blocks:  
 +  rich rules:  
 + 
 +drop 
 +  target: DROP 
 +  icmp-block-inversion: no 
 +  interfaces:  
 +  sources:  
 +  services:  
 +  ports:  
 +  protocols:  
 +  forward: yes 
 +  masquerade: no 
 +  forward-ports:  
 +  source-ports:  
 +  icmp-blocks:  
 +  rich rules:  
 + 
 +external 
 +  target: default 
 +  icmp-block-inversion: no 
 +  interfaces:  
 +  sources:  
 +  services: ssh 
 +  ports:  
 +  protocols:  
 +  forward: yes 
 +  masquerade: yes 
 +  forward-ports:  
 +  source-ports:  
 +  icmp-blocks:  
 +  rich rules:  
 + 
 +home 
 +  target: default 
 +  icmp-block-inversion: no 
 +  interfaces:  
 +  sources:  
 +  services: dhcpv6-client mdns samba-client ssh 
 +  ports:  
 +  protocols:  
 +  forward: yes 
 +  masquerade: no 
 +  forward-ports:  
 +  source-ports:  
 +  icmp-blocks:  
 +  rich rules:  
 + 
 +internal 
 +  target: default 
 +  icmp-block-inversion: no 
 +  interfaces:  
 +  sources:  
 +  services: dhcpv6-client mdns samba-client ssh 
 +  ports:  
 +  protocols:  
 +  forward: yes 
 +  masquerade: no 
 +  forward-ports:  
 +  source-ports:  
 +  icmp-blocks:  
 +  rich rules:  
 + 
 +nm-shared 
 +  target: ACCEPT 
 +  icmp-block-inversion: no 
 +  interfaces:  
 +  sources:  
 +  services: dhcp dns ssh 
 +  ports:  
 +  protocols: icmp ipv6-icmp 
 +  forward: no 
 +  masquerade: no 
 +  forward-ports:  
 +  source-ports:  
 +  icmp-blocks:  
 +  rich rules:  
 + rule priority="32767" reject 
 + 
 +public (active) 
 +  target: default 
 +  icmp-block-inversion: no 
 +  interfaces: enp1s0 
 +  sources:  
 +  services: dhcpv6-client ssh 
 +  ports:  
 +  protocols:  
 +  forward: yes 
 +  masquerade: no 
 +  forward-ports:  
 +  source-ports:  
 +  icmp-blocks:  
 +  rich rules:  
 + 
 +trusted 
 +  target: ACCEPT 
 +  icmp-block-inversion: no 
 +  interfaces:  
 +  sources:  
 +  services:  
 +  ports:  
 +  protocols:  
 +  forward: yes 
 +  masquerade: no 
 +  forward-ports:  
 +  source-ports:  
 +  icmp-blocks:  
 +  rich rules:  
 + 
 +work 
 +  target: default 
 +  icmp-block-inversion: no 
 +  interfaces:  
 +  sources:  
 +  services: dhcpv6-client ssh 
 +  ports:  
 +  protocols:  
 +  forward: yes 
 +  masquerade: no 
 +  forward-ports:  
 +  source-ports:  
 +  icmp-blocks:  
 +  rich rules:  
 + 
 +</pre></html></WRAP> 
 +</WRAP> 
 + 
 +===== デフォルトゾーンとアクティブゾーンの確認 =====
 <WRAP color_term> <WRAP color_term>
 <WRAP color_command><html><pre> <WRAP color_command><html><pre>
行 27: 行 402:
 </WRAP> </WRAP>
  
-<WRAP left round tip 95%>+<WRAP color_term> 
 +<WRAP color_command><html><pre> 
 +$ firewall-cmd --get-active-zones 
 +</pre></html></WRAP> 
 +<WRAP color_result><html><pre> 
 +FedoraWorkstation 
 +  interfaces: wlp2s0 
 +</pre></html></WRAP> 
 +</WRAP> 
 + 
 +<WRAP left round tip 95% minfont_12>
 はじめに__デフォルトゾーンの確認を行っておくことは重要__です。\\ はじめに__デフォルトゾーンの確認を行っておくことは重要__です。\\
 <html><code>firewall-cmd</code></html> コマンドを <html><code>--zone</code></html> オプションを省略して実行すると、すべての操作はデフォルトゾーンに対して行われます。\\ <html><code>firewall-cmd</code></html> コマンドを <html><code>--zone</code></html> オプションを省略して実行すると、すべての操作はデフォルトゾーンに対して行われます。\\
行 114: 行 499:
 </WRAP> </WRAP>
  
-===== デフォルトゾーンの変更 ===== +===== デフォルトゾーンとアクティブゾーンの変更 ===== 
-workゾーンへ変更+デフォルトゾーンを FedoraServer へ変更\\
 <WRAP color_term> <WRAP color_term>
 <WRAP color_command><html><pre> <WRAP color_command><html><pre>
-$ sudo firewall-cmd --set-default-zone=work+$ sudo firewall-cmd --set-default-zone=FedoraServer
 </pre></html></WRAP> </pre></html></WRAP>
 <WRAP color_result><html><pre> <WRAP color_result><html><pre>
 +success
 </pre></html></WRAP> </pre></html></WRAP>
-</WRAP> 
- 
-すべてのアクセスを許可するtrustedゾーンへ変更 
-<WRAP color_term> 
 <WRAP color_command><html><pre> <WRAP color_command><html><pre>
-$ sudo firewall-cmd --set-default-zone=trusted+$ firewall-cmd --get-default-zone
 </pre></html></WRAP> </pre></html></WRAP>
 <WRAP color_result><html><pre> <WRAP color_result><html><pre>
 +FedoraServer
 </pre></html></WRAP> </pre></html></WRAP>
-</WRAP> 
-※これらの変更はすぐに反映される。 
- 
-===== アクティブゾーンの確認 ===== 
-<WRAP color_term> 
 <WRAP color_command><html><pre> <WRAP color_command><html><pre>
 $ firewall-cmd --get-active-zones $ firewall-cmd --get-active-zones
 </pre></html></WRAP> </pre></html></WRAP>
 <WRAP color_result><html><pre> <WRAP color_result><html><pre>
-FedoraServer +FedoraWorkstation 
-  interfaces: br0 ens33+  interfaces: wlp2s0
 </pre></html></WRAP> </pre></html></WRAP>
 </WRAP> </WRAP>
- +※デフォルトゾーンを変更してもアクティブゾーンが変更される訳ではない🤔\\ 
-===== アクティブゾーンの変更 =====+　これらの変更はすぐに反映される🤔\\ 
 +\\ 
 +アクティブゾーンを FedoraServer へ変更\\
 <WRAP color_term> <WRAP color_term>
 <WRAP color_command><html><pre> <WRAP color_command><html><pre>
-$ sudo firewall-cmd --zone=work --change-interface=ens33+$ sudo firewall-cmd --zone=FedoraServer --change-interface=wlp2s0
 </pre></html></WRAP> </pre></html></WRAP>
 <WRAP color_result><html><pre> <WRAP color_result><html><pre>
 +success
 +</pre></html></WRAP>
 +<WRAP color_command><html><pre>
 +$ firewall-cmd --get-active-zones
 +</pre></html></WRAP>
 +<WRAP color_result><html><pre>
 +FedoraServer
 +  interfaces: wlp2s0
 </pre></html></WRAP> </pre></html></WRAP>
 </WRAP> </WRAP>
行 157: 行 545:
 <WRAP color_term> <WRAP color_term>
 <WRAP color_command><html><pre> <WRAP color_command><html><pre>
-$ sudo firewall-cmd --list-services+$ firewall-cmd --list-services
 </pre></html></WRAP> </pre></html></WRAP>
 <WRAP color_result><html><pre> <WRAP color_result><html><pre>
行 167: 行 555:
 <WRAP color_term> <WRAP color_term>
 <WRAP color_command><html><pre> <WRAP color_command><html><pre>
-$ sudo firewall-cmd --list-ports+$ firewall-cmd --list-ports
 </pre></html></WRAP> </pre></html></WRAP>
 <WRAP color_result><html><pre> <WRAP color_result><html><pre>
行 199: 行 587:
 </pre></html></WRAP> </pre></html></WRAP>
 <WRAP color_result><html><pre> <WRAP color_result><html><pre>
 +success
 +</pre></html></WRAP>
 +</WRAP>
 +
 +複数サービスの許可を一括で永続的に削除🤤\\
 +<WRAP color_term>
 +<WRAP color_command><html><pre>
 +$ sudo firewall-cmd --permanent --remove-service={ssh,cockpit}
 +</pre></html></WRAP>
 +<WRAP color_result><html><pre>
 +success
 </pre></html></WRAP> </pre></html></WRAP>
 </WRAP> </WRAP>
行 284: 行 683:
 </service> </service>
 </code></WRAP> </code></WRAP>
 +</WRAP>
 +
 +===== ヘルプ [--help] =====
 +<WRAP color_term>
 +<WRAP color_command><html><pre>
 +$ firewall-cmd --help
 +</pre></html></WRAP>
 +<WRAP color_result_long><html><pre>
 +
 +Usage: firewall-cmd [OPTIONS...]
 +
 +General Options
 +  -h, --help           Prints a short help text and exists
 +  -V, --version        Print the version string of firewalld
 +  -q, --quiet          Do not print status messages
 +
 +Status Options
 +  --state              Return and print firewalld state
 +  --reload             Reload firewall and keep state information
 +  --complete-reload    Reload firewall and lose state information
 +  --runtime-to-permanent
 +                       Create permanent from runtime configuration
 +  --check-config       Check permanent configuration for errors
 +
 +Log Denied Options
 +  --get-log-denied     Print the log denied value
 +  --set-log-denied=&lt;value>
 +                       Set log denied value
 +
 +Permanent Options
 +  --permanent          Set an option permanently
 +                       Usable for options marked with [P]
 +
 +Zone Options
 +  --get-default-zone   Print default zone for connections and interfaces
 +  --set-default-zone=&lt;zone>
 +                       Set default zone
 +  --get-active-zones   Print currently active zones
 +  --get-zones          Print predefined zones [P]
 +  --get-services       Print predefined services [P]
 +  --get-icmptypes      Print predefined icmptypes [P]
 +  --get-zone-of-interface=&lt;interface>
 +                       Print name of the zone the interface is bound to [P]
 +  --get-zone-of-source=&lt;source>[/&lt;mask>]|&lt;MAC>|ipset:&lt;ipset>
 +                       Print name of the zone the source is bound to [P]
 +  --list-all-zones     List everything added for or enabled in all zones [P]
 +  --new-zone=&lt;zone>    Add a new zone [P only]
 +  --new-zone-from-file=&lt;filename> [--name=&lt;zone>]
 +                       Add a new zone from file with optional name [P only]
 +  --delete-zone=&lt;zone> Delete an existing zone [P only]
 +  --load-zone-defaults=&lt;zone>
 +                       Load zone default settings [P only]
 +  --zone=&lt;zone>        Use this zone to set or query options, else default zone
 +                       Usable for options marked with [Z]
 +  --info-zone=&lt;zone>   Print information about a zone
 +  --path-zone=&lt;zone>   Print file path of a zone [P only]
 +
 +Policy Options
 +  --get-policies       Print predefined policies
 +  --get-active-policies 
 +                       Print currently active policies
 +  --list-all-policies  List everything added for or enabled in all policies
 +  --new-policy=&lt;policy> 
 +                       Add a new empty policy
 +  --new-policy-from-file=&lt;filename> [--name=&lt;policy>]
 +                       Add a new policy from file with optional name override [P only]
 +  --delete-policy=&lt;policy>
 +                       Delete an existing policy
 +  --load-policy-defaults=&lt;policy>
 +                       Load policy default settings
 +  --policy=&lt;policy>    Use this policy to set or query options
 +                       Usable for options marked with [O]
 +  --info-policy=&lt;policy>
 +                       Print information about a policy
 +  --path-policy=&lt;policy>
 +                       Print file path of a policy
 +
 +IPSet Options
 +  --get-ipset-types    Print the supported ipset types
 +  --new-ipset=&lt;ipset> --type=&lt;ipset type> [--option=&lt;key>[=&lt;value>]]..
 +                       Add a new ipset [P only]
 +  --new-ipset-from-file=&lt;filename> [--name=&lt;ipset>]
 +                       Add a new ipset from file with optional name [P only]
 +  --delete-ipset=&lt;ipset>
 +                       Delete an existing ipset [P only]
 +  --load-ipset-defaults=&lt;ipset>
 +                       Load ipset default settings [P only]
 +  --info-ipset=&lt;ipset> Print information about an ipset
 +  --path-ipset=&lt;ipset> Print file path of an ipset [P only]
 +  --get-ipsets         Print predefined ipsets
 +  --ipset=&lt;ipset> --set-description=&lt;description>
 +                       Set new description to ipset [P only]
 +  --ipset=&lt;ipset> --get-description
 +                       Print description for ipset [P only]
 +  --ipset=&lt;ipset> --set-short=&lt;description>
 +                       Set new short description to ipset [P only]
 +  --ipset=&lt;ipset> --get-short
 +                       Print short description for ipset [P only]
 +  --ipset=&lt;ipset> --add-entry=&lt;entry>
 +                       Add a new entry to an ipset [P]
 +  --ipset=&lt;ipset> --remove-entry=&lt;entry>
 +                       Remove an entry from an ipset [P]
 +  --ipset=&lt;ipset> --query-entry=&lt;entry>
 +                       Return whether ipset has an entry [P]
 +  --ipset=&lt;ipset> --get-entries
 +                       List entries of an ipset [P]
 +  --ipset=&lt;ipset> --add-entries-from-file=&lt;entry>
 +                       Add a new entries to an ipset [P]
 +  --ipset=&lt;ipset> --remove-entries-from-file=&lt;entry>
 +                       Remove entries from an ipset [P]
 +
 +IcmpType Options
 +  --new-icmptype=&lt;icmptype>
 +                       Add a new icmptype [P only]
 +  --new-icmptype-from-file=&lt;filename> [--name=&lt;icmptype>]
 +                       Add a new icmptype from file with optional name [P only]
 +  --delete-icmptype=&lt;icmptype>
 +                       Delete an existing icmptype [P only]
 +  --load-icmptype-defaults=&lt;icmptype>
 +                       Load icmptype default settings [P only]
 +  --info-icmptype=&lt;icmptype>
 +                       Print information about an icmptype
 +  --path-icmptype=&lt;icmptype>
 +                       Print file path of an icmptype [P only]
 +  --icmptype=&lt;icmptype> --set-description=&lt;description>
 +                       Set new description to icmptype [P only]
 +  --icmptype=&lt;icmptype> --get-description
 +                       Print description for icmptype [P only]
 +  --icmptype=&lt;icmptype> --set-short=&lt;description>
 +                       Set new short description to icmptype [P only]
 +  --icmptype=&lt;icmptype> --get-short
 +                       Print short description for icmptype [P only]
 +  --icmptype=&lt;icmptype> --add-destination=&lt;ipv>
 +                       Enable destination for ipv in icmptype [P only]
 +  --icmptype=&lt;icmptype> --remove-destination=&lt;ipv>
 +                       Disable destination for ipv in icmptype [P only]
 +  --icmptype=&lt;icmptype> --query-destination=&lt;ipv>
 +                       Return whether destination ipv is enabled in icmptype [P only]
 +  --icmptype=&lt;icmptype> --get-destinations
 +                       List destinations in icmptype [P only]
 +
 +Service Options
 +  --new-service=&lt;service>
 +                       Add a new service [P only]
 +  --new-service-from-file=&lt;filename> [--name=&lt;service>]
 +                       Add a new service from file with optional name [P only]
 +  --delete-service=&lt;service>
 +                       Delete an existing service [P only]
 +  --load-service-defaults=&lt;service>
 +                       Load icmptype default settings [P only]
 +  --info-service=&lt;service>
 +                       Print information about a service
 +  --path-service=&lt;service>
 +                       Print file path of a service [P only]
 +  --service=&lt;service> --set-description=&lt;description>
 +                       Set new description to service [P only]
 +  --service=&lt;service> --get-description
 +                       Print description for service [P only]
 +  --service=&lt;service> --set-short=&lt;description>
 +                       Set new short description to service [P only]
 +  --service=&lt;service> --get-short
 +                       Print short description for service [P only]
 +  --service=&lt;service> --add-port=&lt;portid>[-&lt;portid>]/&lt;protocol>
 +                       Add a new port to service [P only]
 +  --service=&lt;service> --remove-port=&lt;portid>[-&lt;portid>]/&lt;protocol>
 +                       Remove a port from service [P only]
 +  --service=&lt;service> --query-port=&lt;portid>[-&lt;portid>]/&lt;protocol>
 +                       Return whether the port has been added for service [P only]
 +  --service=&lt;service> --get-ports
 +                       List ports of service [P only]
 +  --service=&lt;service> --add-protocol=&lt;protocol>
 +                       Add a new protocol to service [P only]
 +  --service=&lt;service> --remove-protocol=&lt;protocol>
 +                       Remove a protocol from service [P only]
 +  --service=&lt;service> --query-protocol=&lt;protocol>
 +                       Return whether the protocol has been added for service [P only]
 +  --service=&lt;service> --get-protocols
 +                       List protocols of service [P only]
 +  --service=&lt;service> --add-source-port=&lt;portid>[-&lt;portid>]/&lt;protocol>
 +                       Add a new source port to service [P only]
 +  --service=&lt;service> --remove-source-port=&lt;portid>[-&lt;portid>]/&lt;protocol>
 +                       Remove a source port from service [P only]
 +  --service=&lt;service> --query-source-port=&lt;portid>[-&lt;portid>]/&lt;protocol>
 +                       Return whether the source port has been added for service [P only]
 +  --service=&lt;service> --get-source-ports
 +                       List source ports of service [P only]
 +  --service=&lt;service> --add-helper=&lt;helper>
 +                       Add a new helper to service [P only]
 +  --service=&lt;service> --remove-helper=&lt;helper>
 +                       Remove a helper from service [P only]
 +  --service=&lt;service> --query-helper=&lt;helper>
 +                       Return whether the helper has been added for service [P only]
 +  --service=&lt;service> --get-service-helpers
 +                       List helpers of service [P only]
 +  --service=&lt;service> --set-destination=&lt;ipv>:&lt;address>[/&lt;mask>]
 +                       Set destination for ipv to address in service [P only]
 +  --service=&lt;service> --remove-destination=&lt;ipv>
 +                       Disable destination for ipv i service [P only]
 +  --service=&lt;service> --query-destination=&lt;ipv>:&lt;address>[/&lt;mask>]
 +                       Return whether destination ipv is set for service [P only]
 +  --service=&lt;service> --get-destinations
 +                       List destinations in service [P only]
 +  --service=&lt;service> --add-include=&lt;service>
 +                       Add a new include to service [P only]
 +  --service=&lt;service> --remove-include=&lt;service>
 +                       Remove a include from service [P only]
 +  --service=&lt;service> --query-include=&lt;service>
 +                       Return whether the include has been added for service [P only]
 +  --service=&lt;service> --get-includes
 +                       List includes of service [P only]
 +
 +Options to Adapt and Query Zones and Policies
 +  --list-all           List everything added for or enabled [P] [Z] [O]
 +  --timeout=&lt;timeval>  Enable an option for timeval time, where timeval is
 +                       a number followed by one of letters 's' or 'm' or 'h'
 +                       Usable for options marked with [T]
 +  --set-description=&lt;description>
 +                       Set new description [P only] [Z] [O]
 +  --get-description    Print description [P only] [Z] [O]
 +  --get-target         Get the target [P only] [Z] [O]
 +  --set-target=&lt;target>
 +                       Set the target [P only] [Z] [O]
 +  --set-short=&lt;description>
 +                       Set new short description [Z] [O]
 +  --get-short          Print short description [P only] [Z] [O]
 +  --list-services      List services added [P] [Z]
 +  --add-service=&lt;service>
 +                       Add a service [P] [Z] [O] [T]
 +  --remove-service=&lt;service>
 +                       Remove a service [P] [Z] [O]
 +  --query-service=&lt;service>
 +                       Return whether service has been added [P] [Z] [O]
 +  --list-ports         List ports added [P] [Z] [O]
 +  --add-port=&lt;portid>[-&lt;portid>]/&lt;protocol>
 +                       Add the port [P] [Z] [O] [T]
 +  --remove-port=&lt;portid>[-&lt;portid>]/&lt;protocol>
 +                       Remove the port [P] [Z] [O]
 +  --query-port=&lt;portid>[-&lt;portid>]/&lt;protocol>
 +                       Return whether the port has been added [P] [Z] [O]
 +  --list-protocols     List protocols added [P] [Z] [O]
 +  --add-protocol=&lt;protocol>
 +                       Add the protocol [P] [Z] [O] [T]
 +  --remove-protocol=&lt;protocol>
 +                       Remove the protocol [P] [Z] [O]
 +  --query-protocol=&lt;protocol>
 +                       Return whether the protocol has been added [P] [Z] [O]
 +  --list-source-ports  List source ports added [P] [Z] [O]
 +  --add-source-port=&lt;portid>[-&lt;portid>]/&lt;protocol>
 +                       Add the source port [P] [Z] [O] [T]
 +  --remove-source-port=&lt;portid>[-&lt;portid>]/&lt;protocol>
 +                       Remove the source port [P] [Z] [O]
 +  --query-source-port=&lt;portid>[-&lt;portid>]/&lt;protocol>
 +                       Return whether the source port has been added [P] [Z] [O]
 +  --list-icmp-blocks   List Internet ICMP type blocks added [P] [Z] [O]
 +  --add-icmp-block=&lt;icmptype>
 +                       Add an ICMP block [P] [Z] [O] [T]
 +  --remove-icmp-block=&lt;icmptype>
 +                       Remove the ICMP block [P] [Z] [O]
 +  --query-icmp-block=&lt;icmptype>
 +                       Return whether an ICMP block has been added [P] [Z] [O]
 +  --list-forward-ports List IPv4 forward ports added [P] [Z] [O]
 +  --add-forward-port=port=&lt;portid>[-&lt;portid>]:proto=&lt;protocol>[:toport=&lt;portid>[-&lt;portid>]][:toaddr=&lt;address>[/&lt;mask>]]
 +                       Add the IPv4 forward port [P] [Z] [O] [T]
 +  --remove-forward-port=port=&lt;portid>[-&lt;portid>]:proto=&lt;protocol>[:toport=&lt;portid>[-&lt;portid>]][:toaddr=&lt;address>[/&lt;mask>]]
 +                       Remove the IPv4 forward port [P] [Z] [O]
 +  --query-forward-port=port=&lt;portid>[-&lt;portid>]:proto=&lt;protocol>[:toport=&lt;portid>[-&lt;portid>]][:toaddr=&lt;address>[/&lt;mask>]]
 +                       Return whether the IPv4 forward port has been added [P] [Z] [O]
 +  --add-masquerade     Enable IPv4 masquerade [P] [Z] [O] [T]
 +  --remove-masquerade  Disable IPv4 masquerade [P] [Z] [O]
 +  --query-masquerade   Return whether IPv4 masquerading has been enabled [P] [Z] [O]
 +  --list-rich-rules    List rich language rules added [P] [Z] [O]
 +  --add-rich-rule=&lt;rule>
 +                       Add rich language rule 'rule' [P] [Z] [O] [T]
 +  --remove-rich-rule=&lt;rule>
 +                       Remove rich language rule 'rule' [P] [Z] [O]
 +  --query-rich-rule=&lt;rule>
 +                       Return whether a rich language rule 'rule' has been
 +                       added [P] [Z] [O]
 +
 +Options to Adapt and Query Zones
 +  --add-icmp-block-inversion
 +                       Enable inversion of icmp blocks for a zone [P] [Z]
 +  --remove-icmp-block-inversion
 +                       Disable inversion of icmp blocks for a zone [P] [Z]
 +  --query-icmp-block-inversion
 +                       Return whether inversion of icmp blocks has been enabled
 +                       for a zone [P] [Z]
 +  --add-forward        Enable forwarding of packets between interfaces and
 +                       sources in a zone [P] [Z] [T]
 +  --remove-forward     Disable forwarding of packets between interfaces and
 +                       sources in a zone [P] [Z]
 +  --query-forward      Return whether forwarding of packets between interfaces
 +                       and sources has been enabled for a zone [P] [Z]
 +
 +Options to Adapt and Query Policies
 +  --get-priority       Get the priority [P only] [O]
 +  --set-priority=&lt;priority>
 +                       Set the priority [P only] [O]
 +  --list-ingress-zones
 +                       List ingress zones that are bound to a policy [P] [O]
 +  --add-ingress-zone=&lt;zone>
 +                       Add the ingress zone to a policy [P] [O]
 +  --remove-ingress-zone=&lt;zone>
 +                       Remove the ingress zone from a policy [P] [O]
 +  --query-ingress-zone=&lt;zone>
 +                       Query whether the ingress zone has been adedd to a
 +                       policy [P] [O]
 +  --list-egress-zones
 +                       List egress zones that are bound to a policy [P] [O]
 +  --add-egress-zone=&lt;zone>
 +                       Add the egress zone to a policy [P] [O]
 +  --remove-egress-zone=&lt;zone>
 +                       Remove the egress zone from a policy [P] [O]
 +  --query-egress-zone=&lt;zone>
 +                       Query whether the egress zone has been adedd to a
 +                       policy [P] [O]
 +
 +Options to Handle Bindings of Interfaces
 +  --list-interfaces    List interfaces that are bound to a zone [P] [Z]
 +  --add-interface=&lt;interface>
 +                       Bind the &lt;interface> to a zone [P] [Z]
 +  --change-interface=&lt;interface>
 +                       Change zone the &lt;interface> is bound to [P] [Z]
 +  --query-interface=&lt;interface>
 +                       Query whether &lt;interface> is bound to a zone [P] [Z]
 +  --remove-interface=&lt;interface>
 +                       Remove binding of &lt;interface> from a zone [P] [Z]
 +
 +Options to Handle Bindings of Sources
 +  --list-sources       List sources that are bound to a zone [P] [Z]
 +  --add-source=&lt;source>[/&lt;mask>]|&lt;MAC>|ipset:&lt;ipset>
 +                       Bind the source to a zone [P] [Z]
 +  --change-source=&lt;source>[/&lt;mask>]|&lt;MAC>|ipset:&lt;ipset>
 +                       Change zone the source is bound to [Z]
 +  --query-source=&lt;source>[/&lt;mask>]|&lt;MAC>|ipset:&lt;ipset>
 +                       Query whether the source is bound to a zone [P] [Z]
 +  --remove-source=&lt;source>[/&lt;mask>]|&lt;MAC>|ipset:&lt;ipset>
 +                       Remove binding of the source from a zone [P] [Z]
 +
 +Helper Options
 +  --new-helper=&lt;helper> --module=&lt;module> [--family=&lt;family>]
 +                       Add a new helper [P only]
 +  --new-helper-from-file=&lt;filename> [--name=&lt;helper>]
 +                       Add a new helper from file with optional name [P only]
 +  --delete-helper=&lt;helper>
 +                       Delete an existing helper [P only]
 +  --load-helper-defaults=&lt;helper>
 +                       Load helper default settings [P only]
 +  --info-helper=&lt;helper> Print information about an helper
 +  --path-helper=&lt;helper> Print file path of an helper [P only]
 +  --get-helpers         Print predefined helpers
 +  --helper=&lt;helper> --set-description=&lt;description>
 +                       Set new description to helper [P only]
 +  --helper=&lt;helper> --get-description
 +                       Print description for helper [P only]
 +  --helper=&lt;helper> --set-short=&lt;description>
 +                       Set new short description to helper [P only]
 +  --helper=&lt;helper> --get-short
 +                       Print short description for helper [P only]
 +  --helper=&lt;helper> --add-port=&lt;portid>[-&lt;portid>]/&lt;protocol>
 +                       Add a new port to helper [P only]
 +  --helper=&lt;helper> --remove-port=&lt;portid>[-&lt;portid>]/&lt;protocol>
 +                       Remove a port from helper [P only]
 +  --helper=&lt;helper> --query-port=&lt;portid>[-&lt;portid>]/&lt;protocol>
 +                       Return whether the port has been added for helper [P only]
 +  --helper=&lt;helper> --get-ports
 +                       List ports of helper [P only]
 +  --helper=&lt;helper> --set-module=&lt;module>
 +                       Set module to helper [P only]
 +  --helper=&lt;helper> --get-module
 +                       Get module from helper [P only]
 +  --helper=&lt;helper> --set-family={ipv4|ipv6|}
 +                       Set family for helper [P only]
 +  --helper=&lt;helper> --get-family
 +                       Get module from helper [P only]
 +
 +Direct Options
 +  --direct             First option for all direct options
 +  --get-all-chains
 +                       Get all chains [P]
 +  --get-chains {ipv4|ipv6|eb} &lt;table>
 +                       Get all chains added to the table [P]
 +  --add-chain {ipv4|ipv6|eb} &lt;table> &lt;chain>
 +                       Add a new chain to the table [P]
 +  --remove-chain {ipv4|ipv6|eb} &lt;table> &lt;chain>
 +                       Remove the chain from the table [P]
 +  --query-chain {ipv4|ipv6|eb} &lt;table> &lt;chain>
 +                       Return whether the chain has been added to the table [P]
 +  --get-all-rules
 +                       Get all rules [P]
 +  --get-rules {ipv4|ipv6|eb} &lt;table> &lt;chain>
 +                       Get all rules added to chain in table [P]
 +  --add-rule {ipv4|ipv6|eb} &lt;table> &lt;chain> &lt;priority> &lt;arg>...
 +                       Add rule to chain in table [P]
 +  --remove-rule {ipv4|ipv6|eb} &lt;table> &lt;chain> &lt;priority> &lt;arg>...
 +                       Remove rule with priority from chain in table [P]
 +  --remove-rules {ipv4|ipv6|eb} &lt;table> &lt;chain>
 +                       Remove rules from chain in table [P]
 +  --query-rule {ipv4|ipv6|eb} &lt;table> &lt;chain> &lt;priority> &lt;arg>...
 +                       Return whether a rule with priority has been added to
 +                       chain in table [P]
 +  --passthrough {ipv4|ipv6|eb} &lt;arg>...
 +                       Pass a command through (untracked by firewalld)
 +  --get-all-passthroughs
 +                       Get all tracked passthrough rules [P]
 +  --get-passthroughs {ipv4|ipv6|eb} &lt;arg>...
 +                       Get tracked passthrough rules [P]
 +  --add-passthrough {ipv4|ipv6|eb} &lt;arg>...
 +                       Add a new tracked passthrough rule [P]
 +  --remove-passthrough {ipv4|ipv6|eb} &lt;arg>...
 +                       Remove a tracked passthrough rule [P]
 +  --query-passthrough {ipv4|ipv6|eb} &lt;arg>...
 +                       Return whether the tracked passthrough rule has been
 +                       added [P]
 +
 +Lockdown Options
 +  --lockdown-on        Enable lockdown.
 +  --lockdown-off       Disable lockdown.
 +  --query-lockdown     Query whether lockdown is enabled
 +
 +Lockdown Whitelist Options
 +  --list-lockdown-whitelist-commands
 +                       List all command lines that are on the whitelist [P]
 +  --add-lockdown-whitelist-command=&lt;command>
 +                       Add the command to the whitelist [P]
 +  --remove-lockdown-whitelist-command=&lt;command>
 +                       Remove the command from the whitelist [P]
 +  --query-lockdown-whitelist-command=&lt;command>
 +                       Query whether the command is on the whitelist [P]
 +  --list-lockdown-whitelist-contexts
 +                       List all contexts that are on the whitelist [P]
 +  --add-lockdown-whitelist-context=&lt;context>
 +                       Add the context context to the whitelist [P]
 +  --remove-lockdown-whitelist-context=&lt;context>
 +                       Remove the context from the whitelist [P]
 +  --query-lockdown-whitelist-context=&lt;context>
 +                       Query whether the context is on the whitelist [P]
 +  --list-lockdown-whitelist-uids
 +                       List all user ids that are on the whitelist [P]
 +  --add-lockdown-whitelist-uid=&lt;uid>
 +                       Add the user id uid to the whitelist [P]
 +  --remove-lockdown-whitelist-uid=&lt;uid>
 +                       Remove the user id uid from the whitelist [P]
 +  --query-lockdown-whitelist-uid=&lt;uid>
 +                       Query whether the user id uid is on the whitelist [P]
 +  --list-lockdown-whitelist-users
 +                       List all user names that are on the whitelist [P]
 +  --add-lockdown-whitelist-user=&lt;user>
 +                       Add the user name user to the whitelist [P]
 +  --remove-lockdown-whitelist-user=&lt;user>
 +                       Remove the user name user from the whitelist [P]
 +  --query-lockdown-whitelist-user=&lt;user>
 +                       Query whether the user name user is on the whitelist [P]
 +
 +Panic Options
 +  --panic-on           Enable panic mode
 +  --panic-off          Disable panic mode
 +  --query-panic        Query whether panic mode is enabled
 +
 +</pre></html></WRAP>
 </WRAP> </WRAP>
  
  • linux/commands/network/firewall-cmd.1663010721.txt.gz
  • 最終更新: 2022/09/13 04:25
  • by ともやん