iptables规则备份和恢复、firewalld的9个zone、firewalld关于zone和service操作

保存和备份iptables规则

service iptables save //会把规则保存到/etc/sysconfig/iptables
把iptables规则备份到my.ipt文件中：
iptables-save > my.ipt 恢复刚才备份的规则：
iptables-restore < my.ipt

1.保存规则

[root@linux-128 ~]# service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[  确定  ]

它会保存到配置文件/etc/sysconfig/iptables中

[root@linux-128 ~]# cat /etc/sysconfig/iptables
# Generated by iptables-save v1.4.21 on Mon Dec  4 02:46:23 2017
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [162:11232]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Mon Dec  4 02:46:23 2017

2.备份规则

[root@linux-128 ~]# iptables-save >/tmp/myiptables.rule

查看规则

[root@linux-128 ~]# cat /tmp/myiptables.rule
# Generated by iptables-save v1.4.21 on Mon Dec  4 02:49:42 2017
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [261:20920]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Mon Dec  4 02:49:42 2017

3.恢复规则

[root@linux-128 ~]# iptables-restore </tmp/myiptables.rule

恢复规则一般使用备份规则中，注意：服务器或者重启iptables，它会自动加载配置文件中的规则

firewalld的9个zone

• 打开firewalld
• systemctl disable iptables
• systemctl stop iptables
• systemctl enable firewalld
• systemctl start firewalld
• firewalld默认有9个zone
• 默认zone为public
• firewall-cmd –get-zones //查看所有zone
• firewall-cmd –get-default-zone//查看默认zone

1. 关闭开机自动启动netfilter

[root@linux-128 ~]# systemctl disable iptables
Removed symlink /etc/systemd/system/basic.target.wants/iptables.service.

1. 关闭netfilter

[root@linux-128 ~]# systemctl stop iptables

1. 设置开机启动firewalld

[root@linux-128 ~]# systemctl enable firewalld
Created symlink from /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service to /usr/lib/systemd/system/firewalld.service.
Created symlink from /etc/systemd/system/basic.target.wants/firewalld.service to /usr/lib/systemd/system/firewalld.service.

1. 启动firewalld

[root@linux-128 ~]# systemctl start firewalld

1. 查看firewalld的默认规则

[root&