简单的配置，参考学习：
–permanent 当设定永久状态时 在命令开头或者结尾处加入此参数,否则重载或重启防火墙后设置失效！
开放端口：
firewall-cmd –zone=public –add-port=80/tcp –permanent
firewall-cmd –zone=public –add-port=22/tcp –permanent
常见端口
http:80
ssh:22
redis:6379 7000 7001 7002
mysql:3306
mongdb:5672
es:9300
rebbitmq:5672
consul:8500
可以一次指定多个：
firewall-cmd –zone=public –permanent –add-port=111/tcp –add-port=139/tcp –add-port=445/tcp
firewall-cmd –reload
查看所有打开的端口：
firewall-cmd –list-port
firewall-cmd –zone=public –list-ports
开启伪装：
firewall-cmd [–zone=zone] –add-masquerade
firewall-cmd –remove-masquerade
firewall-cmd –query-masquerade
添加区域接口：
firewall-cmd [–zone=zone] –add-interface=
firewall-cmd –zone=public –add-interface=eth0
列出全部启用的区域的特性
firewall-cmd –list-all-zones
输出区域 全部启用的特性。如果省略区域，将显示默认区域的信息
firewall-cmd –zone=public –list-all
启用某个服务：
firewall-cmd –add-service=http
firewall-cmd –add-service=vnc-server
firewall-cmd –zone=public –add-service=nfs –add-service=samba –add-service=samba-client –permanent
firewall-cmd –remove-service=service 移除服务
查询：firewall-cmd –list-service
NAT地址转换：
firewall-cmd [–zone=] –add-forward-port=port=[-]:proto= { :toport=[-] | :toaddr=
IP端口转发：
firewall-cmd –add-forward-port=222:proto=tcp:toport=333:toaddr=192.168.1.100
本地转发：
firewall-cmd –add-forward-port=port=9898:proto=tcp:toport=8088:toaddr=
success
查询：
firewall-cmd –list-forward-port
firewall-cmd –list-port
firewall-cmd –list-all
移除：
firewall-cmd –remove-forward-port=port=222:proto=tcp:toport=333:toaddr=
firewall-cmd –remove-forward-port=222:proto=tcp:toport=333:toaddr=192.168.1.100
图形化配置工具：# firewall-config
自定义规则：
/sbin/iptables -t filter -I INPUT_direct 2 -s 192.168.1.1 -p tcp –dport=22 -j DROP
usage: –direct –add-rule { ipv4 | ipv6 | eb }
firewall-cmd –permanent –direct –add-rule ipv4 filter INPUT 1 -s 192.168.1.0/24 -p tcp –dport=22 -j ACCEPT
firewall-cmd –permanent –direct –add-rule ipv4 filter INPUT 2 -p tcp –dport=22 -j DROP
firewall-cmd –reload
firewall-cmd –direct –get-all-rules
ipv4 filter INPUT 1 -s 192.168.1.0/24 -p tcp –dport=22 -j ACCEPT
ipv4 filter INPUT 2 -p tcp –dport=22 -j DROP