使用root用户
查看所有的zone信息
# firewall-cmd --list-all-zones
查看默认zone是哪一个
# firewall-cmd --get-default-zone
临时修改接口p3p1所属的zone为internal，这是runtime修改，重启不保存
# firewall-cmd --zone=internal --change-zone=p3p1
如果需要重启保存接口的修改
则修改接口对应的配置文件/etc/sysconfig/network-scripts/ifcfg-p3p1
在配置文件中增加或修改一行ZONE=internal
从public zone中移除服务，重启后保存
临时修改则去掉--permanent选项
# firewall-cmd --permanent --zone=public --remove-service=ssh
这样便无法从接口p3p2上通过ssh访问了
但是可以从内网接口p3p1上通过ssh访问
再次查看所有的zone信息
# firewall-cmd --list-all-zones
block
interfaces:
services:
ports:
forward-ports:
icmp-blocks:
work
interfaces:
services: ipp-client mdns dhcpv6-client ssh
ports:
forward-ports:
icmp-blocks:
drop
interfaces:
services:
ports:
forward-ports:
icmp-blocks:
internal
interfaces: p3p1
services: ipp-client mdns dhcpv6-client ssh samba-client
ports:
forward-ports:
icmp-blocks:
external
interfaces:
services: ssh
ports:
forward-ports:
icmp-blocks:
home
interfaces:
services: ipp-client mdns dhcpv6-client ssh samba-client
ports:
forward-ports:
icmp-blocks:
dmz
interfaces:
services: ssh
ports:
forward-ports:
icmp-blocks:
public
interfaces: p3p2
services: mdns dhcpv6-client
ports:
forward-ports:
icmp-blocks:
trusted
interfaces:
services:
ports:
forward-ports:
icmp-blocks: