{"id":1276,"date":"2022-08-07T18:16:21","date_gmt":"2022-08-07T10:16:21","guid":{"rendered":"http:\/\/175.24.184.226\/?p=1276"},"modified":"2023-08-24T15:35:18","modified_gmt":"2023-08-24T07:35:18","slug":"ubuntu%e9%98%b2%e7%81%ab%e5%a2%99%e5%bc%80%e6%94%be%e7%ab%af%e5%8f%a3","status":"publish","type":"post","link":"\/?p=1276","title":{"rendered":"\u9632\u706b\u5899\u5f00\u653e\u7aef\u53e3"},"content":{"rendered":"

ubuntu\u5f00\u653e\u7aef\u53e3<\/h2>\n
\n

<\/a>\u542f\u7528<\/h3>\n
 sudo ufw enable\n<\/code><\/pre>\n
sudo ufw default deny <\/code><\/pre>\n
\u4f5c\u7528\uff1a\u5f00\u542f\u4e86\u9632\u706b\u5899\u5e76\u968f\u7cfb\u7edf\u542f\u52a8\u540c\u65f6\u5173\u95ed\u6240\u6709\u5916\u90e8\u5bf9\u672c\u673a\u7684\u8bbf\u95ee\uff08\u672c\u673a\u8bbf\u95ee\u5916\u90e8\u6b63\u5e38\uff09\u3002<\/p>\n
<\/a>\u5173\u95ed<\/h3>\n
sudo ufw disable <\/code><\/pre>\n
<\/a>\u67e5\u770b\u9632\u706b\u5899\u72b6\u6001<\/h4>\n
sudo ufw status <\/code><\/pre>\n
<\/a>\u5f00\u542f\/\u7981\u7528\u76f8\u5e94\u7aef\u53e3\u6216\u670d\u52a1\u4e3e\u4f8b<\/h4>\n
\u8fdb\u5165Ubuntu \u67e5\u770b80\u7aef\u53e3\u7684\u60c5\u51b5\uff0c\u53d1\u73b080\u7aef\u53e3\u5e76\u672a\u5f00\u542f\uff1b<\/p>\n
netstat -ntlp   |   grep 80<\/code><\/pre>\n
\u5141\u8bb8\u5916\u90e8\u8bbf\u95ee80\u7aef\u53e3<\/p>\n
sudo ufw allow 80<\/code><\/pre>\n
\u7981\u6b62\u5916\u90e8\u8bbf\u95ee80 \u7aef\u53e3<\/p>\n
sudo ufw delete allow 80 <\/code><\/pre>\n
\u5141\u8bb8\u6b64IP\u8bbf\u95ee\u6240\u6709\u7684\u672c\u673a\u7aef\u53e3<\/p>\n
sudo ufw allow from 192.168.1.1<\/code><\/pre>\n
\u7981\u6b62\u5916\u90e8\u8bbf\u95eesmtp\u670d\u52a1<\/p>\n
sudo ufw deny smtp <\/code><\/pre>\n
\u5220\u9664\u4e0a\u9762\u5efa\u7acb\u7684\u67d0\u6761\u89c4\u5219<\/p>\n
 sudo ufw delete allow smtp <\/code><\/pre>\n
\u8981\u62d2\u7edd\u6240\u6709\u7684TCP\u6d41\u91cf\u4ece10.0.0.0\/8 \u5230192.168.0.1\u5730\u5740\u768422\u7aef\u53e3<\/p>\n
sudo ufw deny proto tcp from 10.0.0.0\/8 to 192.168.0.1 port 22 <\/code><\/pre>\n
\u53ef\u4ee5\u5141\u8bb8\u6240\u6709RFC1918\u7f51\u7edc\uff08\u5c40\u57df\u7f51\/\u65e0\u7ebf\u5c40\u57df\u7f51\u7684\uff09\u8bbf\u95ee\u8fd9\u4e2a\u4e3b\u673a\uff08\/8,\/16,\/12\u662f\u4e00\u79cd\u7f51\u7edc\u5206\u7ea7\uff09\uff1a<\/p>\n
sudo ufw allow from 10.0.0.0\/8<\/code><\/pre>\n
 sudo ufw allow from 172.16.0.0\/12<\/code><\/pre>\n
 sudo ufw allow from 192.168.0.0\/16<\/code><\/pre>\n
\u63a8\u8350\u8bbe\u7f6e<\/p>\n
sudo apt-get install ufw<\/code><\/pre>\n
sudo ufw enable<\/code><\/pre>\n
sudo ufw default deny <\/code><\/pre>\n
\u8fd9\u6837\u8bbe\u7f6e\u5df2\u7ecf\u5f88\u5b89\u5168\uff0c\u5982\u679c\u6709\u7279\u6b8a\u9700\u8981\uff0c\u53ef\u4ee5\u4f7f\u7528<\/p>\n
sudo ufw allow<\/code><\/pre>\n
\u5f00\u542f\u76f8\u5e94\u670d\u52a1\u3002<\/p>\n
Centos<\/h2>\n
1\u3001\u67e5\u770b\u5df2\u5f00\u653e\u7684\u7aef\u53e3 ; firewall-cmd --list-ports<\/p>\n
2\u3001 \u67e5\u770b\u7aef\u53e3\u662f\u5426\u88ab\u5360\u7528 \uff1b netstat -tunpl | grep "\u7aef\u53e3"<\/p>\n
3\u3001\u5f00\u653e\u5355\u4e2a\u7aef\u53e3\uff08\u5f00\u653e\u540e\u9700\u8981\u8981\u91cd\u542f\u9632\u706b\u5899\u624d\u751f\u6548\uff09 \uff1b<\/p>\n
firewall-cmd --zone=public --add-port=8080\/tcp --permanent<\/p>\n
#\uff08--permanent \u4e3a\u6c38\u4e45\u751f\u6548\uff0c\u4e0d\u52a0\u4e3a\u5355\u6b21\u6709\u6548\uff08\u91cd\u542f\u5931\u6548\uff09\uff09<\/code><\/p>\n
4\u3001\u5f00\u653e\u591a\u4e2a\u7aef\u53e3\uff08\u5f00\u653e\u540e\u9700\u8981\u8981\u91cd\u542f\u9632\u706b\u5899\u624d\u751f\u6548\uff09<\/p>\n
firewall-cmd --zone=public --add-port=20000-29999\/tcp --permanent<\/p>\n
#\uff08--permanent \u4e3a\u6c38\u4e45\u751f\u6548\uff0c\u4e0d\u52a0\u4e3a\u5355\u6b21\u6709\u6548\uff08\u91cd\u542f\u5931\u6548\uff09\uff09<\/code><\/p>\n
5\u3001\u5173\u95ed\u7aef\u53e3\uff08\u5173\u95ed\u540e\u9700\u8981\u8981\u91cd\u542f\u9632\u706b\u5899\u624d\u751f\u6548\uff09<\/p>\n
firewall-cmd --zone=public --remove-port=8080\/tcp --permanent<\/p>\n
6\u3001\u67e5\u770b\u7aef\u53e3\u662f\u5426\u6253\u5f00 \uff1b firewall-cmd --zone= public --query-port=80\/tcp<\/p>\n
7\u3001\u67e5\u770b\u9632\u706b\u5899\u72b6\u6001 \uff1b systemctl status firewalld<\/p>\n
8\u3001\u5f00\u542f\u9632\u706b\u5899 \uff1b systemctl start firewalld<\/p>\n
9\u3001\u505c\u6b62\u9632\u706b\u5899 \uff1b systemctl stop firewalld<\/p>\n
10\u3001\u91cd\u542f\u9632\u706b\u5899 \uff1b systemctl restart firewalld<\/p>\n
11\u3001\u8bbe\u7f6e\u5f00\u673a\u542f\u52a8\u9632\u706b\u5899 \uff1b systemctl enable firewalld<\/p>\n
12\u3001\u67e5\u770b\u9632\u706b\u5899\u8bbe\u7f6e\u5f00\u673a\u81ea\u542f\u662f\u5426\u6210\u529f \uff1b systemctl is-enabled firewalld;echo $?<\/p>\n
13\u3001 \u7981\u6b62\u9632\u706b\u5899\u5f00\u673a\u542f\u52a8 \uff1b systemctl disable firewalld<\/p>\n","protected":false},"excerpt":{"rendered":"
ubuntu\u5f00\u653e\u7aef\u53e3 \u542f\u7528 sudo ufw enable sudo ufw default deny \u4f5c\u7528\uff1a\u5f00\u542f\u4e86\u9632\u706b\u5899\u5e76\u968f\u7cfb\u7edf\u542f\u52a8\u540c   \u2026 …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0},"categories":[14],"tags":[],"_links":{"self":[{"href":"\/index.php?rest_route=\/wp\/v2\/posts\/1276"}],"collection":[{"href":"\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1276"}],"version-history":[{"count":3,"href":"\/index.php?rest_route=\/wp\/v2\/posts\/1276\/revisions"}],"predecessor-version":[{"id":8849,"href":"\/index.php?rest_route=\/wp\/v2\/posts\/1276\/revisions\/8849"}],"wp:attachment":[{"href":"\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1276"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1276"},{"taxonomy":"post_tag","embeddable":true,"href":"\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1276"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}