# 核心概念
Zone（区域）：预定义的安全级别
Service（服务）：预定义的端口和协议
Port（端口）：开放的TCP/UDP端口

# 启动firewalld服务
$ sudo systemctl start firewalld

# 设置开机自启
$ sudo systemctl enable firewalld

# 查看服务状态
$ sudo systemctl status firewalld
● firewalld.service – firewalld – dynamic firewall daemon
Loade更多学习教程公众号风哥教程itpux_comd: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
Active: active (running) since Mon 2026-04-06 10:00:00 CST; 1h ago
Main PID: 1234 (firewalld)
Tasks: 2 (limit: 4915)
Memory: 28.5M
CGroup: /system.slice/firewalld.service
└─1234 /usr/libexec/platform-python -s /usr/sbin/firewalld –nofork –nopid

# 停止firewalld服务
$ sudo systemctl stop firewalld

# 禁用开机自启
$ sudo systemctl disable firewalld

# 重启firewalld服务
$ sudo systemctl restart firewalld

# 查看firewalld状态
$ sudo firewall-cmd –state
running

# 查看所有区域
$ sudo firewall-cmd –get-zones
block dmz drop external home internal public trusted work

# 查看当前激活的区域
$ sudo firewall-cmd –get-active-zones
public
interfaces: ens33

# 查看区域详细信息
$ sudo firewall-cmd –zone=public –list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: ens33
sources:
services: cockpit dhcpv6-client ssh
ports:
protocols:
forward: no
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:

# 1. 查看当前配置
$ sudo firewall-cmd –list-all

# 2. 开放HTTP和HTTPS端口
$ sudo firewall-cmd –permanent –add-service=http
$ sudo firewall-cmd –permanent –add-service=https

# 3. 重载配置
$ sudo firewall-cmd –reload

# 4. 验证配置
$ sudo firewall-cmd –list-services
cockpit dhcpv6-client http https ssh