{"id":94487,"date":"2026-08-14T15:49:52","date_gmt":"2026-08-14T07:49:52","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/94487.html"},"modified":"2026-08-14T15:49:52","modified_gmt":"2026-08-14T07:49:52","slug":"%e5%bd%ad%e4%ba%8e%e6%99%8f%e4%b8%80%e4%b8%aa%e6%9c%88%e5%b8%a6%e4%bd%a0%e7%8e%a9%e8%bd%aclinux%e6%93%8d%e4%bd%9c%e7%b3%bb%e7%bb%9f13","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/94487.html","title":{"rendered":"\u5f6d\u4e8e\u664f\u4e00\u4e2a\u6708\u5e26\u4f60\u73a9\u8f6cLinux\u64cd\u4f5c\u7cfb\u7edf13"},"content":{"rendered":"<h2>Linux \u4ea4\u6362\u7a7a\u95f4\u7ba1\u7406<\/h2>\n<h3>\u8ba1\u7b97\u673a\u5b58\u50a8\u5668\u7684\u5c42\u6b21\u7ed3\u6784<\/h3>\n<p>\u8ba1\u7b97\u673a\u5b58\u50a8\u5668\u901f\u5ea6\u8d8a\u5feb&#xff0c;\u6210\u672c\u8f83\u9ad8\u3002 \u4e3a\u4e86\u83b7\u5f97\u597d\u7684\u6027\u80fd\/\u4ef7\u683c\u6bd4&#xff0c;\u8ba1\u7b97\u673a\u4e2d\u5404\u79cd\u5b58\u50a8\u5668\u7ec4\u6210\u4e00\u4e2a\u5c42\u72b6\u7684\u5854\u5f0f\u7ed3\u6784&#xff0c;\u53d6\u957f\u8865\u77ed&#xff0c;\u534f\u8c03\u5de5\u4f5c\u3002<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/08\/20260814074944-6a7ec898e1247.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<ul>\n<li>\n<p>CPU \u5bc4\u5b58\u5668&#xff0c;\u662f CPU \u5185\u90e8\u7528\u6765\u5b58\u653e\u6570\u636e\u7684\u4e00\u4e9b\u5c0f\u578b\u5b58\u50a8\u533a\u57df&#xff0c;\u7528\u6765\u6682\u65f6\u5b58\u653e\u53c2\u4e0e\u8fd0\u7b97\u7684\u6570\u636e\u548c\u8fd0\u7b97\u7ed3\u679c\u4ee5\u53ca\u4e00\u4e9b CPU \u8fd0\u884c\u9700\u8981\u7684\u4fe1\u606f\u3002<\/p>\n<\/li>\n<li>\n<p>CPU \u9ad8\u901f\u7f13\u5b58&#xff0c;\u4e5f\u5c31\u662fCPU Cache&#xff0c;\u662f\u4e00\u79cd\u5bb9\u91cf\u5c0f\u3001\u901f\u5ea6\u5feb\u7684\u9ad8\u7f13\u51b2\u5b58\u50a8\u5668&#xff0c;\u7531SRAM\u7ec4\u6210&#xff0c;\u76f4\u63a5\u5236\u4f5c\u5728CPU\u82af\u7247\u5185&#xff0c;\u901f\u5ea6\u51e0\u4e4e\u4e0eCPU\u4e00\u6837\u5feb\u3002\u5728\u91d1\u5b57\u5854\u5f0f\u5b58\u50a8\u4f53\u7cfb\u4e2d\u5b83\u4f4d\u4e8e\u81ea\u9876\u5411\u4e0b\u7684\u7b2c\u4e8c\u5c42&#xff0c;\u4ec5\u6b21\u4e8eCPU\u5bc4\u5b58\u5668\u3002\u5176\u5bb9\u91cf\u8fdc\u5c0f\u4e8e\u5185\u5b58&#xff0c;\u4f46\u901f\u5ea6\u5374\u53ef\u4ee5\u63a5\u8fd1\u5904\u7406\u5668\u7684\u9891\u7387\u3002<\/p>\n<\/li>\n<li>\n<p>\u4e3b\u5b58\u50a8\u5668&#xff08;Main memory&#xff09;&#xff0c;\u7b80\u79f0\u4e3b\u5b58\u6216\u5185\u5b58&#xff0c;\u5176\u4f5c\u7528\u662f\u5b58\u653e\u6307\u4ee4\u548c\u6570\u636e&#xff0c;\u5e76\u80fd\u7531\u4e2d\u592e\u5904\u7406\u5668&#xff08;CPU&#xff09;\u76f4\u63a5\u968f\u673a\u5b58\u53d6\u3002\u4e3b\u5b58\u50a8\u5668\u901f\u5ea6\u6bd4CPU\u9ad8\u901f\u7f13\u5b58\u6162&#xff0c;\u4f46\u5b58\u50a8\u5bb9\u5668\u5374\u5927\u7684\u591a\u3002<\/p>\n<p>\u4e3b\u5b58\u50a8\u5668\u7684\u901f\u5ea6\u4e00\u822c\u7528\u5b58\u53d6\u65f6\u95f4\u8861\u91cf&#xff0c;\u5373\u6bcf\u6b21\u4e0eCPU\u95f4\u6570\u636e\u5904\u7406\u8017\u8d39\u7684\u65f6\u95f4&#xff0c;\u4ee5\u7eb3\u79d2(ns)\u4e3a\u5355\u4f4d\u3002\u5927\u591a\u6570SDRAM\u5185\u5b58\u82af\u7247\u7684\u5b58\u53d6\u65f6\u95f4\u4e3a5\u30016\u30017\u30018\u621610ns\u3002<\/p>\n<p>\u4e3b\u5b58\u50a8\u5668\u7684\u5e26\u5bbd\u8ba1\u7b97\u516c\u5f0f&#xff1a;\u5e26\u5bbd&#xff1d;\u9891\u7387*\u4f4d\u5bbd&#xff0f;8\u3002<\/p>\n<p>\u4f8b\u5982&#xff1a;DDR4 \u5185\u5b58\u9891\u7387\u662f3600 MHz&#xff0c;\u572864\u4f4d\u7cfb\u7edf&#xff08;\u53cc\u901a\u9053\u4f4d\u5bbd\u4e3a128&#xff0c;\u4ee5\u6b64\u7c7b\u63a8&#xff09;&#xff0c;1B&#061;8bit,<\/p>\n<ul>\n<li>\n<p>\u5355\u901a\u9053 DDR4-3600&#xff1a;3600MHz * 64bit \/ 8&#061;28800MB\/S<\/p>\n<\/li>\n<li>\n<p>\u53cc\u901a\u9053 DDR4-3600&#xff1a;3600MHz * 64bit * 2 \/ 8&#061;57600MB\/S<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>\u8f85\u52a9\u5b58\u50a8\u5668&#xff0c;\u901f\u5ea6\u6162\u7684\u591a&#xff0c;\u4f18\u70b9\u662f\u5bb9\u91cf\u5927&#xff0c;\u53ef\u6301\u4e45\u5316\u5b58\u50a8\u3002<\/p>\n<\/li>\n<\/ul>\n<h3>\u8ba1\u7b97\u673a\u5b58\u50a8\u5668\u7684\u5de5\u4f5c\u539f\u7406<\/h3>\n<p><img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/08\/20260814074945-6a7ec8995e459.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<li>CPU\u8fd0\u884c\u7a0b\u5e8f\u65f6&#xff0c;\u5148\u4ece\u5bc4\u5b58\u5668\u4e2d\u8bfb\u53d6\u6570\u636e\u3002\u5982\u679c\u5728\u5bc4\u5b58\u5668\u4e2d\u53ef\u4ee5\u627e\u5230\u6570\u636e&#xff0c;\u5219\u76f4\u63a5\u4ece\u5bc4\u5b58\u5668\u4e2d\u8bfb\u53d6\u3002\u5982\u679c\u5728\u5bc4\u5b58\u5668\u4e2d\u627e\u4e0d\u5230\u6570\u636e&#xff0c;\u5219\u4eceCPU Cache\u4e2d\u8bfb\u53d6\u6570\u636e&#xff0c;\u5e76\u5c06\u6570\u636e\u7f13\u5b58\u5728CPU Cache\u4e2d\u3002<\/li>\n<li>\u5982\u679c\u5728CPU cache\u4e2d\u53ef\u4ee5\u627e\u5230\u6570\u636e&#xff0c;\u5219\u76f4\u63a5\u4eceCPU Cache\u4e2d\u8bfb\u53d6\u3002\u5982\u679c\u5728CPU cache\u4e2d\u627e\u4e0d\u5230\u6570\u636e&#xff0c;\u5219\u4ece\u4e3b\u5b58\u50a8\u5668&#xff08;\u5185\u5b58&#xff09;\u4e2d\u8bfb\u53d6\u6570\u636e&#xff0c;\u5c06\u6570\u636e\u7f13\u5b58\u5728\u4e3b\u5b58\u50a8\u5668\u4e2d\u3002<\/li>\n<li>\u5982\u679c\u5728\u5185\u5b58\u4e2d\u53ef\u4ee5\u627e\u5230\u6570\u636e&#xff0c;\u5219\u76f4\u63a5\u4ece\u5185\u5b58\u4e2d\u8bfb\u53d6\u3002\u5982\u679c\u5728\u5185\u5b58\u4e2d\u627e\u4e0d\u5230\u6570\u636e&#xff0c;\u5219\u4ece\u8f85\u52a9\u5b58\u50a8\u5668\u4e2d\u8bfb\u53d6\u6570\u636e&#xff0c;\u4f8b\u5982\u673a\u68b0\u78c1\u76d8\u3001\u5149\u76d8\u3001U\u76d8\u7b49&#xff0c;\u5e76\u5c06\u6570\u636e\u7f13\u5b58\u5728\u5185\u5b58\u4e2d\u3002<\/li>\n<h3>\u7269\u7406\u5185\u5b58<\/h3>\n<p>\u8ba1\u7b97\u673a\u7cfb\u7edf\u5c06\u5185\u5b58\u5212\u5206\u4e3a\u56fa\u5b9a\u5927\u5c0f\u7684\u5757&#xff0c;\u79f0\u4e3a page&#xff0c;\u6807\u51c6 page \u5927\u5c0f\u4e3a 4 KiB\u3002\u8fdb\u7a0b\u5e76\u4e0d\u76f4\u63a5\u5bf9\u7269\u7406\u5185\u5b58\u5bfb\u5740&#xff0c;\u6bcf\u4e2a\u8fdb\u7a0b\u5177\u6709\u865a\u62df\u5730\u5740\u7a7a\u95f4virtual address space\u3002\u5f53\u8fdb\u7a0b\u8bf7\u6c42\u5185\u5b58\u65f6&#xff0c;MMU \u5c06\u8fdb\u7a0b\u83b7\u5f97\u7684\u865a\u62df\u5730\u5740&#xff08;VA&#xff0c;Virtual Address &#xff09;\u6620\u5c04\u5230\u7269\u7406\u5730\u5740&#xff08;PA&#xff0c;Physical Address &#xff09;\u3002<\/p>\n<p>MMU\u662fMemory Management Unit\u7684\u7f29\u5199&#xff0c;\u5373\u5185\u5b58\u7ba1\u7406\u5355\u5143&#xff0c;\u5b83\u662fCPU\u4e2d\u7528\u6765\u7ba1\u7406\u865a\u62df\u5b58\u50a8\u5668\u3001\u7269\u7406\u5b58\u50a8\u5668\u7684\u63a7\u5236\u7ebf\u8def&#xff0c;\u8d1f\u8d23\u5c06\u865a\u62df\u5730\u5740\u6620\u5c04\u4e3a\u7269\u7406\u5730\u5740&#xff0c;\u4ee5\u53ca\u63d0\u4f9b\u786c\u4ef6\u673a\u5236\u7684\u5185\u5b58\u8bbf\u95ee\u6388\u6743\u3002<\/p>\n<p>**\u601d\u8003&#xff1a;**\u4e3a\u4ec0\u4e48CPU\u4e0d\u76f4\u63a5\u8bbf\u95ee\u7269\u7406\u5730\u5740&#xff1f;<\/p>\n<li>\u865a\u62df\u5185\u5b58\u7684\u5bb9\u91cf\u662f\u7269\u7406\u5185\u5b58\u548c\u4ea4\u6362\u7a7a\u95f4\u7684\u603b\u548c&#xff0c;\u800c\u865a\u62df\u5730\u5740\u8d1f\u8d23\u6620\u5c04\u5230\u7269\u7406\u5185\u5b58\u5730\u5740\u548c\u4ea4\u6362\u7a7a\u95f4\u5730\u5740\u3002<\/li>\n<li>\u8fdb\u7a0b\u4f7f\u7528\u5185\u5b58\u7684\u8fc7\u7a0b\u4e2d&#xff0c;\u5e0c\u671b\u5185\u5b58\u662f\u8fde\u7eed\u7684\u3002\u5982\u679c\u8fdb\u7a0b\u76f4\u63a5\u8bbf\u95ee\u7269\u7406\u5730\u5740&#xff0c;\u5219\u5185\u6838\u5f88\u96be\u4fdd\u8bc1\u8fdb\u7a0b\u83b7\u5f97\u7684\u7269\u7406\u5730\u5740\u7a7a\u95f4\u662f\u8fde\u7eed\u7684&#xff0c;\u56e0\u4e3a\u8fdb\u7a0b\u5b58\u5728\u7740\u8fd0\u884c\u548c\u9000\u51fa&#xff0c;\u5c31\u4f1a\u51fa\u73b0\u5185\u5b58\u788e\u7247\u5316\u3002\u8fdb\u7a0b\u7684\u865a\u62df\u5730\u5740\u5728\u865a\u62df\u5185\u5b58\u4e2d\u662f\u8fde\u7eed\u7684&#xff0c;\u8fbe\u5230\u4e86\u5185\u5b58\u8fde\u7eed\u7684\u76ee\u7684&#xff0c;\u800c MMU \u4f1a\u5c06\u8fdb\u7a0b\u7684\u865a\u62df\u5730\u5740\u6620\u5c04\u5230\u7269\u7406\u5730\u5740\u3002<\/li>\n<h3>Swap \u7a7a\u95f4<\/h3>\n<p>Swap&#xff0c;\u610f\u601d\u662f\u201c\u4ea4\u6362\u201d\u3001\u201c\u5b9e\u7269\u4ea4\u6613\u201d\u3002Linux Swap&#xff08;\u4ea4\u6362&#xff09;\u7a7a\u95f4\u662f\u53d7Linux\u5185\u6838\u5185\u5b58\u5b50\u7cfb\u7edf\u63a7\u5236\u7684\u78c1\u76d8\u533a\u57df\u3002<\/p>\n<ul>\n<li>\u529f\u80fd1&#xff1a;\u5f53\u5185\u5b58\u4f7f\u7528\u91cf\u8d85\u8fc7\u5b9a\u4e49\u7684\u9650\u5236\u65f6&#xff0c;\u5185\u6838\u5bfb\u627e\u5df2\u5206\u914d\u7ed9\u8fdb\u7a0b\u4f46\u7a7a\u95f2\u7684\u5185\u5b58\u9875&#xff0c;\u5c06\u8be5\u7a7a\u95f2\u7684\u5185\u5b58\u9875\u5199\u5165\u5230\u4ea4\u6362\u7a7a\u95f4&#xff0c;\u5e76\u5411\u5176\u4ed6\u8fdb\u7a0b\u91cd\u65b0\u5206\u914dRAM\u9875\u9762\u3002<\/li>\n<li>\u529f\u80fd2&#xff1a;\u5982\u679c\u67d0\u4e2a\u7a0b\u5e8f\u9700\u8981\u8bbf\u95ee\u78c1\u76d8\u4e0a\u7684\u9875\u9762&#xff0c;\u5219\u5185\u6838\u4f1a\u627e\u5230\u53e6\u4e00\u4e2a\u7a7a\u95f2\u7684\u5185\u5b58\u9875&#xff0c; \u5c06\u5176\u5199\u5165\u5230\u78c1\u76d8&#xff0c;\u7136\u540e\u4ece\u4ea4\u6362\u533a\u91cd\u65b0\u8c03\u7528\u6240\u9700\u7684\u9875\u9762\u3002<\/li>\n<li>\u529f\u80fd3&#xff1a;\u5982\u679c\u67d0\u4e2a\u7a0b\u5e8f\u9700\u8981\u8bbf\u95ee\u6570\u636e&#xff0c;\u8bbf\u95ee\u7684\u6570\u636e\u5b58\u653e\u5728\u4ea4\u6362\u7a7a\u95f4&#xff0c;\u5219\u8be5\u7a0b\u5e8f\u76f4\u63a5\u4ece\u4ea4\u6362\u7a7a\u95f4\u8bfb\u53d6\u6570\u636e&#xff0c;\u800c\u4e0d\u9700\u8981\u4ece\u78c1\u76d8\u539f\u59cb\u4f4d\u7f6e\u8bfb\u53d6&#xff0c;\u8fdb\u800c\u63d0\u9ad8\u901f\u5ea6\u3002<\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/08\/20260814074945-6a7ec8997cf98.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<p>\u7b80\u5355\u5730\u8bf4&#xff0c;Linux Swap \u7a7a\u95f4\u5c31\u662f\u5728\u5185\u5b58\u4e0d\u591f\u7684\u60c5\u51b5\u4e0b&#xff0c;\u64cd\u4f5c\u7cfb\u7edf\u5148\u628a\u5185\u5b58\u4e2d\u6682\u65f6\u4e0d\u7528\u7684\u6570\u636e&#xff0c;\u5b58\u5230\u786c\u76d8\u7684\u4ea4\u6362\u7a7a\u95f4&#xff0c;\u817e\u51fa\u5185\u5b58\u6765\u8ba9\u522b\u7684\u7a0b\u5e8f\u8fd0\u884c&#xff0c;\u548cWindows\u7684\u865a\u62df\u5185\u5b58&#xff08;pagefile.sys&#xff09;\u7684\u4f5c\u7528\u662f\u4e00\u6837\u7684\u3002<\/p>\n<p>**\u4ea4\u6362\u7a7a\u95f4\u53ea\u662f\u4e34\u65f6\u7684\u89e3\u51b3\u529e\u6cd5\u3002**\u867d\u7136\u4ea4\u6362\u7a7a\u95f4\u80fd\u591f\u4f5c\u4e3a&#034;\u865a\u62df&#034;\u5185\u5b58\u4f7f\u7528&#xff0c;\u4f46\u7531\u4e8e\u4ea4\u6362\u533a\u4f4d\u4e8e\u78c1\u76d8\u4e0a&#xff0c;\u5b83\u7684\u901f\u5ea6\u6bd4\u7269\u7406\u5185\u5b58\u6162\u7684\u591a&#xff0c;\u56e0\u6b64\u5982\u679c\u9700\u8981\u66f4\u5feb\u7684\u901f\u5ea6\u7684\u8bdd&#xff0c;\u6700\u597d\u7684\u529e\u6cd5\u4ecd\u7136\u662f\u52a0\u5927\u7269\u7406\u5185\u5b58\u3002<\/p>\n<h4>\u67e5\u770b\u5185\u5b58<\/h4>\n<p><span class=\"token comment\"># \u9ed8\u8ba4\u5355\u4f4d\u662fKiB&#xff0c;\u4f7f\u7528-m\u9009\u9879&#xff0c;\u4ee5MiB\u4e3a\u5355\u4f4d<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># free <\/span><br \/>\n              total        used        <span class=\"token function\">free<\/span>      shared  buff\/cache   available<br \/>\nMem:        <span class=\"token number\">4026156<\/span>      <span class=\"token number\">330460<\/span>     <span class=\"token number\">3528844<\/span>       <span class=\"token number\">12136<\/span>      <span class=\"token number\">166852<\/span>     <span class=\"token number\">3485576<\/span><br \/>\nSwap:       <span class=\"token number\">4063228<\/span>           <span class=\"token number\">0<\/span>     <span class=\"token number\">4063228<\/span><\/p>\n<p>\u8f93\u51fa\u8bf4\u660e&#xff1a;<\/p>\n<ul>\n<li>\n<p>Mem&#xff1a;<\/p>\n<ul>\n<li>\n<p>total&#xff1a;\u7269\u7406\u5185\u5b58\u7a7a\u95f4\u5927\u5c0f\u3002<\/p>\n<\/li>\n<li>\n<p>used&#xff1a;\u4f7f\u7528\u7684\u5185\u5b58 (total &#8211; free &#8211; buffers &#8211; cache)\u3002<\/p>\n<\/li>\n<li>\n<p>free&#xff1a;\u672a\u4f7f\u7528\u7684\u5185\u5b58\u7a7a\u95f4\u5927\u5c0f(\u771f\u6b63\u7684\u7a7a\u95f2&#xff0c;\u672a\u88ab\u4efb\u4f55\u7a0b\u5e8f\u5360\u7528)\u3002<\/p>\n<\/li>\n<li>\n<p>shared&#xff1a;\u591a\u4e2a\u8fdb\u7a0b\u5171\u4eab\u7684\u5185\u5b58\u7a7a\u95f4\u5927\u5c0f\u3002<\/p>\n<\/li>\n<li>\n<p>cached&#xff1a;\u4ece\u78c1\u76d8\u8bfb\u53d6\u7684\u6570\u636e\u5360\u7528\u7684\u5185\u5b58\u7a7a\u95f4\u5927\u5c0f&#xff0c;\u5f85\u4ee5\u540e\u4f7f\u7528&#xff08;\u6570\u636e\u6ca1\u6709\u88ab\u4fee\u6539&#xff09;\u3002<\/p>\n<\/li>\n<li>\n<p>buffers&#xff1a;\u88ab\u66f4\u6539\u4f46\u672a\u5199\u56de\u78c1\u76d8\u7684\u6570\u636e\u5360\u7528\u7684\u5185\u5b58\u7a7a\u95f4\u5927\u5c0f\u3002<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>Swap:<\/p>\n<ul>\n<li>\n<p>total&#xff1a;\u4ea4\u6362\u7a7a\u95f4\u5927\u5c0f\u3002<\/p>\n<\/li>\n<li>\n<p>used&#xff1a;\u4f7f\u7528\u7684\u4ea4\u6362\u7a7a\u95f4\u5927\u5c0f\u3002<\/p>\n<\/li>\n<li>\n<p>free&#xff1a;\u672a\u4f7f\u7528\u4ea4\u6362\u7a7a\u95f4\u5927\u5c0f\u3002<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h4>Swap \u7a7a\u95f4\u5927\u5c0f<\/h4>\n<p>\u7ba1\u7406\u5458\u5e94\u6839\u636e\u7cfb\u7edf\u7684\u5185\u5b58\u5de5\u4f5c\u8d1f\u8f7d\u6765\u8c03\u6574\u4ea4\u6362\u7a7a\u95f4\u5927\u5c0f\u3002 \u5e94\u7528\u4f9b\u5e94\u5546\u6709\u65f6\u4f1a\u63d0\u4f9b\u8fd9\u65b9\u9762\u7684\u5efa\u8bae\u3002\u6839\u636e\u7269\u7406\u5185\u5b58\u603b\u91cf&#xff0c;\u4e0b\u8868\u63d0\u4f9b\u4e86\u4e00\u4e9b\u6307\u5bfc\u3002<\/p>\n<table>\n<tr>\u7269\u7406\u5185\u5b58(RAM)\u4ea4\u6362\u7a7a\u95f4\u5141\u8bb8HIBERNATE\u65f6\u7684\u4ea4\u6362\u7a7a\u95f4<\/tr>\n<tbody>\n<tr>\n<td>2GiB\u6216\u4ee5\u4e0b<\/td>\n<td>\u4e24\u500d\u7684RAM<\/td>\n<td>\u4e09\u500d\u7684RAM<\/td>\n<\/tr>\n<tr>\n<td>2GiB\u548c8GiB\u4e4b\u95f4<\/td>\n<td>\u540c\u7b49\u7684RAM<\/td>\n<td>\u4e24\u500d\u7684RAM<\/td>\n<\/tr>\n<tr>\n<td>8GiB\u548c64GiB\u4e4b\u95f4<\/td>\n<td>\u81f3\u5c114GiB<\/td>\n<td>1.5\u500d\u7684RAM<\/td>\n<\/tr>\n<tr>\n<td>64GiB\u4ee5\u4e0a<\/td>\n<td>\u81f3\u5c114GiB<\/td>\n<td>\u4e0d\u5efa\u8baeHibernate<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u7b14\u8bb0\u672c\u7535\u8111\u548c\u53f0\u5f0f\u673a\u7684Hibernate\u529f\u80fd\u4f1a\u5728\u5173\u95ed\u7cfb\u7edf\u7535\u6e90\u4e4b\u524d\u4f7f\u7528\u4ea4\u6362\u7a7a\u95f4\u6765\u4fdd\u5b58RAM\u5185\u5bb9\u3002\u91cd\u65b0\u6253\u5f00\u7cfb\u7edf\u65f6&#xff0c; \u5185\u6838\u5c06\u4ece\u4ea4\u6362\u7a7a\u95f4\u6062\u590dRAM\u5185\u5bb9&#xff0c;\u65e0\u9700\u5b8c\u5168\u542f\u52a8\u3002 \u5bf9\u4e8e\u8fd9\u4e9b\u7cfb\u7edf\u800c\u8a00&#xff0c;\u4ea4\u6362\u7a7a\u95f4\u9700\u8981\u8d85\u8fc7RAM\u91cf\u3002<\/p>\n<h4>\u521b\u5efa\u4ea4\u6362\u7a7a\u95f4<\/h4>\n<p>parted\u547d\u4ee4<\/p>\n<p>\u4f5c\u7528&#xff1a;\u662f\u4e00\u4e2a\u529f\u80fd\u5f3a\u5927\u7684\u78c1\u76d8\u5206\u533a\u5de5\u5177&#xff0c;\u540c\u65f6\u652f\u6301MBR\u548cGPT\u4e24\u79cd\u533a\u5206\u8868<\/p>\n<p>\u8bed\u6cd5&#xff1a;parted [\u9009\u9879] [\u8bbe\u5907\u540d] [\u547d\u4ee4]<\/p>\n<p><span class=\"token comment\"># \u4f7f\u7528parted\u521b\u5efa\u6240\u9700\u5927\u5c0f\u7684\u5206\u533a\u5e76\u5c06\u5176\u6587\u4ef6\u7cfb\u7edf\u7c7b\u578b\u8bbe\u7f6e\u4e3alinux-swap<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># parted \/dev\/sdb mklabel gpt<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># parted \/dev\/sdb unit MiB mkpart swap01 linux-swap 1 2049<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># parted \/dev\/sdb unit MiB print<\/span><\/p>\n<p><span class=\"token comment\"># \u683c\u5f0f\u5316swap\u7a7a\u95f4<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># mkswap \/dev\/sdb1<\/span><br \/>\nSetting up swapspace version <span class=\"token number\">1<\/span>, size <span class=\"token operator\">&#061;<\/span> <span class=\"token number\">2097148<\/span> KiB<br \/>\nno label, <span class=\"token assign-left variable\">UUID<\/span><span class=\"token operator\">&#061;<\/span>2bf4e179-3648-4412-9495-3b278df4acd6<\/p>\n<h4>\u6fc0\u6d3b swap \u7a7a\u95f4<\/h4>\n<p><span class=\"token comment\"># \u6fc0\u6d3bswap\u7a7a\u95f4<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># swapon \/dev\/sdb1<\/span><\/p>\n<p><span class=\"token comment\"># \u67e5\u770bswap\u8bbe\u5907\u5217\u8868<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># swapon -s<\/span><br \/>\nFilenameTypeSizeUsedPriority<br \/>\n\/dev\/dm-1               partition<span class=\"token number\">4063228<\/span><span class=\"token number\">0<\/span>    <span class=\"token parameter variable\">-2<\/span><br \/>\n\/dev\/sdb1               partition<span class=\"token number\">2097148<\/span><span class=\"token number\">0<\/span>    <span class=\"token parameter variable\">-3<\/span><\/p>\n<p>\u9ed8\u8ba4\u60c5\u51b5\u4e0b&#xff0c;\u591a\u4e2a\u4ea4\u6362\u7a7a\u95f4\u5177\u6709\u76f8\u540c\u7684\u4f18\u5148\u7ea7\u65f6&#xff0c;\u7cfb\u7edf\u4f1a\u6309\u987a\u5e8f\u4f7f\u7528\u4ea4\u6362\u7a7a\u95f4&#xff0c;\u5373\u5185\u6838\u5148\u4f7f\u7528\u7b2c\u4e00\u4e2a\u5df2\u6fc0\u6d3b\u4ea4\u6362\u7a7a\u95f4&#xff0c;\u76f4\u81f3\u5176\u7a7a\u95f4\u5df2\u6ee1&#xff0c;\u7136\u540e\u5f00\u59cb\u4f7f\u7528\u7b2c\u4e8c\u4e2a\u4ea4\u6362\u7a7a\u95f4\u3002\u5728\u6fc0\u6d3b\u4ea4\u6362\u5206\u533a\u7684\u65f6\u5019&#xff0c;\u53ef\u4ee5\u4e3a\u6bcf\u4e2a\u4ea4\u6362\u7a7a\u95f4\u5b9a\u4e49\u4e00\u4e2a\u4f18\u5148\u7ea7&#xff0c;\u4ece\u800c\u5f3a\u5236\u6309\u8be5\u987a\u5e8f\u4f7f\u7528\u4ea4\u6362\u7a7a\u95f4\u3002<\/p>\n<p>swapon \u547d\u4ee4\u4f7f\u7528-p\u9009\u9879\u6307\u5b9a\u4f18\u5148\u7ea7&#xff0c;\u4f18\u5148\u7ea7\u4ecb\u4e8e-1\u548c32767\u4e4b\u95f4&#xff0c;\u503c\u8d8a\u5927\u4f18\u5148\u7ea7\u8d8a\u9ad8\u3002<\/p>\n<p>\u793a\u4f8b&#xff1a;<\/p>\n<p><span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># swapon -p 4 \/dev\/sdb1<\/span><\/p>\n<h4>\u53d6\u6d88 swap \u7a7a\u95f4\u6fc0\u6d3b<\/h4>\n<p><span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># swapoff \/dev\/sdb1<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># swapon -s<\/span><br \/>\nFilenameTypeSizeUsedPriority<br \/>\n\/dev\/dm-1               partition<span class=\"token number\">4063228<\/span><span class=\"token number\">0<\/span>    <span class=\"token parameter variable\">-2<\/span><\/p>\n<h4>\u6301\u4e45\u5316\u6fc0\u6d3b swap \u7a7a\u95f4<\/h4>\n<p>\u4fee\u6539\/etc\/fstab\u6587\u4ef6&#xff0c;\u6dfb\u52a0\u5982\u4e0b\u7c7b\u4f3c\u8bb0\u5f55&#xff1a;<\/p>\n<p>UUID&#061;2bf4e179-3648-4412-9495-3b278df4acd6 swap swap pri&#061;4 0 0<\/p>\n<p>\u4f7f\u7528\u547d\u4ee4swapon -a\u6fc0\u6d3b\/etc\/fstab\u4e2d\u6240\u6709\u4ea4\u6362\u8bbe\u5907\u3002<\/p>\n<p>\u4f7f\u7528\u547d\u4ee4swapoff -a\u53d6\u6d88\/etc\/fstab\u4e2d\u6240\u6709\u4ea4\u6362\u8bbe\u5907\u6fc0\u6d3b\u3002<\/p>\n<p><span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># swapon -a<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># swapon -s<\/span><br \/>\nFilenameTypeSizeUsedPriority<br \/>\n\/dev\/dm-1               partition<span class=\"token number\">4063228<\/span><span class=\"token number\">0<\/span>    <span class=\"token parameter variable\">-2<\/span><br \/>\n\/dev\/sdb1               partition<span class=\"token number\">2097148<\/span><span class=\"token number\">0<\/span>    <span class=\"token parameter variable\">-3<\/span><\/p>\n<p><span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># swapoff -a<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># swapon -s<\/span><\/p>\n<h2>Linux \u7f51\u7edc\u5b89\u5168\u52a0\u56fa<\/h2>\n<h3>\u9632\u706b\u5899\u4ecb\u7ecd<\/h3>\n<p>\u9632\u706b\u5899&#xff08; FireWall &#xff09;&#xff0c;\u5de5\u4f5c\u5728\u7f51\u7edc\u6216\u4e3b\u673a\u8fb9\u7f18&#xff0c;\u5bf9\u8fdb\u51fa\u7f51\u7edc\u6216\u4e3b\u673a\u7684\u6570\u636e\u5305\u57fa\u4e8e\u4e00\u5b9a\u7684\u89c4\u5219\u68c0\u67e5&#xff0c;\u5e76\u5728\u5339\u914d\u67d0\u89c4\u5219\u65f6\u7531\u89c4\u5219\u5b9a\u4e49\u7684\u884c\u4e3a\u8fdb\u884c\u5904\u7406\u7684\u4e00\u7ec4\u529f\u80fd\u7684\u7ec4\u4ef6\u3002\u57fa\u672c\u4e0a\u7684\u5b9e\u73b0\u90fd\u662f\u9ed8\u8ba4\u60c5\u51b5\u4e0b\u5173\u95ed\u6240\u6709\u7684\u901a\u8fc7\u578b\u8bbf\u95ee&#xff0c;\u53ea\u5f00\u653e\u5141\u8bb8\u8bbf\u95ee\u7684\u7b56\u7565&#xff0c;\u5c06\u5e0c\u671b\u5916\u7f51\u8bbf\u95ee\u7684\u4e3b\u673a\u653e\u5728 DMZ&#xff08;demilitarized zone&#xff09;\u7f51\u7edc\u4e2d\u3002<\/p>\n<h4>\u9632\u706b\u5899\u7c7b\u578b<\/h4>\n<p>\u6309\u4fdd\u62a4\u8303\u56f4\u5212\u5206&#xff1a;<\/p>\n<ul>\n<li>\u4e3b\u673a\u9632\u706b\u5899&#xff1a;\u670d\u52a1\u8303\u56f4\u4e3a\u5f53\u524d\u4e00\u53f0\u4e3b\u673a\u3002<\/li>\n<li>\u7f51\u7edc\u9632\u706b\u5899&#xff1a;\u670d\u52a1\u8303\u56f4\u4e3a\u9632\u706b\u5899\u4e00\u4fa7\u7684\u5c40\u57df\u7f51\u3002<\/li>\n<\/ul>\n<p>\u6309\u5b9e\u73b0\u65b9\u5f0f\u5212\u5206:<\/p>\n<ul>\n<li>\u786c\u4ef6\u9632\u706b\u5899&#xff1a;\u5728\u4e13\u7528\u786c\u4ef6\u7ea7\u522b\u5b9e\u73b0\u9632\u706b\u5899\u529f\u80fd&#xff0c;\u4f8b\u5982\u534e\u4e3a\u3001\u534e\u4e09\u3001\u5929\u878d\u4fe1\u7b49\u4ea7\u54c1\u3002<\/li>\n<li>\u8f6f\u4ef6\u9632\u706b\u5899&#xff1a;\u8fd0\u884c\u4e8e\u901a\u7528\u786c\u4ef6\u5e73\u53f0\u4e4b\u4e0a\u7684\u9632\u706b\u5899\u7684\u5e94\u7528\u8f6f\u4ef6&#xff0c;\u4f8b\u5982iptables&#xff0c;firewalld\u3002<\/li>\n<\/ul>\n<p>\u6309\u7f51\u7edc\u534f\u8bae\u5212\u5206&#xff1a;<\/p>\n<ul>\n<li>\u7f51\u7edc\u5c42\u9632\u706b\u5899&#xff1a;\u5de5\u4f5c\u5728OSI \u6a21\u578b\u4e0b\u56db\u5c42&#xff0c;\u53c8\u79f0\u4e3a\u5305\u8fc7\u6ee4\u9632\u706b\u5899\u3002\n<ul>\n<li>\u7f51\u7edc\u5c42\u5bf9\u6570\u636e\u5305\u8fdb\u884c\u9009\u62e9&#xff0c;\u9009\u62e9\u7684\u4f9d\u636e\u662f\u7cfb\u7edf\u5185\u8bbe\u7f6e\u7684\u8fc7\u6ee4\u903b\u8f91&#xff0c;\u88ab\u79f0\u4e3a\u8bbf\u95ee\u63a7\u5236\u5217\u8868&#xff08;ACL&#xff09;&#xff0c;\u901a\u8fc7\u68c0\u67e5\u6570\u636e\u6d41\u4e2d\u6bcf\u4e2a\u6570\u636e\u7684\u6e90\u5730\u5740&#xff0c;\u76ee\u7684\u5730\u5740&#xff0c;\u6240\u7528\u7aef\u53e3\u53f7\u548c\u534f\u8bae\u72b6\u6001\u7b49\u56e0\u7d20&#xff0c;\u6216\u4ed6\u4eec\u7684\u7ec4\u5408\u6765\u786e\u5b9a\u662f\u5426\u5141\u8bb8\u8be5\u6570\u636e\u5305\u901a\u8fc7\u3002<\/li>\n<li>\u4f18\u70b9&#xff1a;\u5bf9\u7528\u6237\u6765\u8bf4\u900f\u660e&#xff0c;\u5904\u7406\u901f\u5ea6\u5feb\u4e14\u6613\u4e8e\u7ef4\u62a4\u3002<\/li>\n<li>\u7f3a\u70b9&#xff1a;\u65e0\u6cd5\u68c0\u67e5\u5e94\u7528\u5c42\u6570\u636e&#xff0c;\u5982\u75c5\u6bd2\u7b49\u3002<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/08\/20260814074945-6a7ec899bf0e4.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<ul>\n<li>\n<p>\u5e94\u7528\u5c42\u9632\u706b\u5899\/\u4ee3\u7406\u670d\u52a1\u5668&#xff1a;\u5de5\u4f5c\u5728OSI \u6a21\u578b\u4e03\u5c42\u6216\u8005\u627f\u62c5proxy \u4ee3\u7406\u7f51\u5173\u3002<\/p>\n<li>\u5f02\u5e38\u68c0\u6d4b\u534f\u8bae&#xff1a;Web\u5e94\u7528\u9632\u706b\u5899\u4f1a\u5bf9HTTP\u7684\u8bf7\u6c42\u8fdb\u884c\u5f02\u5e38\u68c0\u6d4b&#xff0c;\u62d2\u7edd\u4e0d\u7b26\u5408HTTP\u6807\u51c6\u7684\u8bf7\u6c42\u3002\u5b83\u4e5f\u53ef\u4ee5\u53ea\u5141\u8bb8HTTP\u534f\u8bae\u7684\u90e8\u5206\u9009\u9879\u901a\u8fc7&#xff0c;\u4ece\u800c\u51cf\u5c11\u653b\u51fb\u7684\u5f71\u54cd\u8303\u56f4\u3002<\/li>\n<li>\u589e\u5f3a\u7684\u8f93\u5165\u9a8c\u8bc1&#xff1a;\u53ef\u4ee5\u6709\u6548\u9632\u6b62\u7f51\u9875\u7be1\u6539\u3001\u4fe1\u606f\u6cc4\u9732\u3001\u6728\u51af\u690d\u5165\u7b49\u6076\u610f\u7f51\u7edc\u5165\u4fb5\u884c\u4e3a\u3002\u4ece\u800c\u51cf\u5c0fWeb\u670d\u52a1\u5668\u88ab\u653b\u51fb\u7684\u53ef\u80fd\u6027\u3002<\/li>\n<li>\u53ca\u65f6\u8865\u4e01&#xff1a;\u4fee\u8865Web\u5b89\u5168\u6f0f\u6d1e&#xff0c;\u662fWeb\u5e94\u7528\u5f00\u53d1\u8005\u6700\u5934\u75db\u7684\u95ee\u9898&#xff0c;\u6ca1\u4eba\u4f1a\u77e5\u9053\u4e0b\u4e00\u79d2\u6709\u4ec0\u4e48\u6837\u7684\u6f0f\u6d1e\u51fa\u73b0&#xff0c;\u4f1a\u4e3aWeb\u5e94\u7528\u5e26\u6765\u4ec0\u4e48\u6837\u7684\u5371\u5bb3\u3002\u73b0\u5728WAF&#xff08;Web Application Firewall&#xff09;\u53ef\u4ee5\u4e3a\u6211\u4eec\u505a\u8fd9\u9879\u5de5\u4f5c\u4e86&#xff1a;\u53ea\u8981\u6709\u5168\u9762\u7684\u6f0f\u6d1e\u4fe1\u606fWAF\u80fd\u5728\u4e0d\u5230\u4e00\u4e2a\u5c0f\u65f6\u7684\u65f6\u95f4\u5185\u5c4f\u853d\u6389\u8fd9\u4e2a\u6f0f\u6d1e\u3002\u5f53\u7136&#xff0c;\u8fd9\u79cd\u5c4f\u853d\u6389\u6f0f\u6d1e\u7684\u65b9\u5f0f\u4e0d\u662f\u975e\u5e38\u5b8c\u7f8e\u7684&#xff0c;\u6ca1\u6709\u5b89\u88c5\u5bf9\u5e94\u7684\u8865\u4e01\u672c\u8eab\u5c31\u662f\u4e00 \u79cd\u5b89\u5168\u5a01\u80c1&#xff0c;\u4f46\u6211\u4eec\u5728\u6ca1\u6709\u9009\u62e9\u7684\u60c5\u51b5\u4e0b&#xff0c;\u4efb\u4f55\u4fdd\u62a4\u63aa\u65bd\u90fd\u6bd4\u6ca1\u6709\u4fdd\u62a4\u63aa\u65bd\u66f4\u597d\u3002<\/li>\n<li>\u57fa\u4e8e\u89c4\u5219\u7684\u4fdd\u62a4\u548c\u57fa\u4e8e\u5f02\u5e38\u7684\u4fdd\u62a4&#xff1a;\u57fa\u4e8e\u89c4\u5219\u7684\u4fdd\u62a4\u53ef\u4ee5\u63d0\u4f9b\u5404\u79cdWeb\u5e94\u7528\u7684\u5b89\u5168\u89c4\u5219&#xff0c;WAF&#xff08;Web Application Firewall&#xff09; \u751f\u4ea7\u5546\u4f1a\u7ef4\u62a4\u8fd9\u4e2a\u89c4\u5219\u5e93&#xff0c;\u5e76\u65f6\u65f6\u4e3a\u5176\u66f4\u65b0\u3002\u7528\u6237\u53ef\u4ee5\u6309\u7167\u8fd9\u4e9b\u89c4\u6d4b\u5bf9\u5e94\u7528\u8fdb\u884c\u5168\u65b9\u9762\u68c0\u6d4b\u3002<\/li>\n<li>**\u72b6\u6001\u7ba1\u7406\u3002**WAF\u80fd\u591f\u5224\u65ad\u7528\u6237\u662f\u5426\u662f\u7b2c\u4e00\u6b21\u8bbf\u95ee\u5e76\u4e14\u5c06\u8bf7\u6c42\u91cd\u5b9a\u5411\u5230\u9ed8\u8ba4\u767b\u5f55\u9875\u9762\u5e76\u4e14\u8bb0\u5f55\u4e8b\u4ef6\u3002\u901a\u8fc7\u68c0\u6d4b\u7528\u6237\u7684\u6574\u4e2a\u64cd\u4f5c\u884c\u4e3a\u6211\u4eec\u53ef\u4ee5\u66f4\u5bb9\u6613\u8bc6\u522b\u653b\u51fb\u3002\u72b6\u6001\u7ba1\u7406\u6a21\u5f0f\u8fd8\u80fd\u68c0\u6d4b\u51fa\u5f02\u5e38\u4e8b\u4ef6(\u6bd4\u5982\u767b\u9646\u5931\u8d25)&#xff0c;\u5e76\u7d44\u5728\u8fbe\u5230\u6781\u9650\u503c\u65f6\u8fdb\u884c\u5904\u7406\u3002\u8fd9\u5bf9\u66b4\u529b\u653b\u51fb\u7684\u8bc6\u522b\u548c\u54cd\u5e94\u662f\u5341\u5206\u6709\u5229\u7684\u3002<\/li>\n<li>**\u5176\u4ed6\u9632\u62a4\u6280\u672f\u3002**WAF\u8fd8\u6709\u4e00\u5b89\u5168\u589e\u5f3a\u7684\u529f\u80fd&#xff0c;\u53ef\u4ee5\u7528\u6765\u89e3\u51b3WEB\u7a0b\u5e8f\u5458\u8fc7\u5206\u4fe1\u4efb\u8f93\u5165\u6570\u636e\u5e26\u6765\u7684\u95ee\u9898\u3002\u6bd4\u5982:\u9690\u85cf\u8868\u5355\u57df\u4fdd\u62a4\u3001\u6297\u5165\u4fb5\u89c4\u907f\u6280\u672f\u3001 \u54cd\u5e94\u76d1\u89c6\u548c\u4fe1\u606f\u6cc4\u9732\u4fdd\u62a4\u3002<\/li>\n<ul>\n<li>\u4f18\u70b9&#xff1a;\u63d0\u4f9b\u5e94\u7528\u5c42\u4fdd\u62a4\u3002<\/li>\n<li>\u7f3a\u70b9&#xff1a;\u5904\u7406\u901f\u5ea6\u6162\u7b49<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/08\/20260814074946-6a7ec89a0c95c.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<h4>Netfilter \u5b50\u7cfb\u7edf<\/h4>\n<p>Netfilter\u5b50\u7cfb\u7edf\u662fLinux\u5185\u6838\u4e2d\u4e00\u4e2a\u5f3a\u5927\u7684\u7f51\u7edc\u8fc7\u6ee4\u5b50\u7cfb\u7edf&#xff0c;\u5bf9\u8fdb\u5165\u7cfb\u7edf\u7684\u6bcf\u4e2a\u6570\u636e\u5305&#xff0c;\u5728\u5230\u8fbe\u7528\u6237\u7a7a\u95f4\u7ec4\u4ef6\u6216\u5e94\u7528\u4e4b\u524d\u8fdb\u884c\u68c0\u67e5&#xff0c;\u901a\u8fc7\u7f16\u7a0b\u65b9\u5f0f\u6765\u4fee\u6539\u3001\u4e1f\u5f03\u6216\u8def\u7531\u6570\u636e\u5305\u3002<\/p>\n<p>Netfilter\u5b50\u7cfb\u7edf\u5de5\u4f5c\u5728\u5185\u6838\u6001&#xff0c;\u7528\u6237\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4\u914d\u7f6e\u9632\u706b\u5899\u89c4\u5219&#xff0c;\u544a\u8bc9Netfilter\u5b50\u7cfb\u7edf\u5982\u4f55\u5904\u7406\u6570\u636e\u5305&#xff1a;<\/p>\n<ul>\n<li>\n<p>iptables&#xff0c;\u7528\u4e8e\u8fc7\u6ee4 IPv4 \u534f\u8bae\u7684\u6570\u636e\u5305\u3002<\/p>\n<p>\u5982\u679c Linux \u7cfb\u7edf\u8fde\u63a5\u5230LAN\u6216\u56e0\u7279\u7f51&#xff0c; \u5219iptables\u53ef\u7528\u4e8e\u5728 Linux \u7cfb\u7edf\u4e0a\u66f4\u597d\u5730\u63a7\u5236 IP \u4fe1\u606f\u5305\u8fc7\u6ee4\u548c\u9632\u706b\u5899\u914d\u7f6e\u3002<\/p>\n<\/li>\n<li>\n<p>ip6tables&#xff0c;\u7528\u4e8e\u8fc7\u6ee4 IPv6 \u534f\u8bae\u7684\u6570\u636e\u5305&#xff0c;\u6548\u679c\u7b49\u540ciptables\u5de5\u5177\u3002<\/p>\n<\/li>\n<li>\n<p>arptables&#xff0c;\u7528\u4e8e\u8fc7\u6ee4 arp \u534f\u8bae\u7684\u6570\u636e\u5305\u3002<\/p>\n<p>arptables\u65e2\u80fd\u9632\u6b62\u522b\u7684\u673a\u5668\u5bf9\u81ea\u5df1\u8fdb\u884carp\u6b3a\u9a97&#xff0c;\u53c8\u80fd\u9632\u6b62\u672c\u673a\u75c5\u6bd2\u6216\u9519\u8bef\u7a0b\u5e8f\u5411\u5176\u4ed6\u673a\u5668\u53d1\u8d77arp\u653b\u51fb\u3002\u5982\u679c\u5584\u4e8e\u8fd0\u7528\u7684\u8bdd&#xff0c;\u4e0d\u5931\u4e3a\u4e00\u4e2a\u4f18\u79c0\u7684arp\u9632\u706b\u5899\u3002<\/p>\n<\/li>\n<li>\n<p>ebtables&#xff0c;\u7528\u4e8e\u8fc7\u6ee4\u6570\u636e\u94fe\u8def\u5c42\u6570\u636e\u5305\u3002<\/p>\n<p>ebtables \u8fc7\u6ee4\u6570\u636e\u5305\u6bd4 iptables \u66f4\u9760\u524d&#xff0c;\u83b7\u5f97\u7684\u6570\u636e\u66f4\u201c\u539f\u59cb\u201d&#xff0c;ebtables \u591a\u7528\u4e8e\u6865\u6a21\u5f0f&#xff0c;\u6bd4\u5982\u63a7\u5236 VLAN ID \u7b49\u3002<\/p>\n<\/li>\n<\/ul>\n<p><span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># ls -1 \/sbin\/*tables<\/span><br \/>\n-rwxr-xr-x  <span class=\"token number\">1<\/span> root root <span class=\"token number\">59872<\/span> <span class=\"token number\">11<\/span>\u6708  <span class=\"token number\">6<\/span> <span class=\"token number\">2016<\/span> \/sbin\/arptables<br \/>\n-rwxr-xr-x. <span class=\"token number\">1<\/span> root root  <span class=\"token number\">7016<\/span> <span class=\"token number\">4<\/span>\u6708  <span class=\"token number\">11<\/span> <span class=\"token number\">2018<\/span> \/sbin\/ebtables<br \/>\nlrwxrwxrwx. <span class=\"token number\">1<\/span> root root    <span class=\"token number\">13<\/span> <span class=\"token number\">8<\/span>\u6708   <span class=\"token number\">1<\/span> <span class=\"token number\">15<\/span>:45 \/sbin\/ip6tables &#8211;<span class=\"token operator\">&gt;<\/span> xtables-multi<br \/>\nlrwxrwxrwx. <span class=\"token number\">1<\/span> root root    <span class=\"token number\">13<\/span> <span class=\"token number\">8<\/span>\u6708   <span class=\"token number\">1<\/span> <span class=\"token number\">15<\/span>:45 \/sbin\/iptables &#8211;<span class=\"token operator\">&gt;<\/span> xtables-multi<\/p>\n<h4>Nftables \u5b50\u7cfb\u7edf<\/h4>\n<p>Nftables\u5b50\u7cfb\u7edf\u662fnetfilter\u7684\u589e\u5f3a\u7248&#xff0c;\u5176\u4ecd\u4fdd\u7559\u4e86netfilter\u7684\u67b6\u6784\u3002<\/p>\n<p>nftables\u4f18\u70b9&#xff1a;<\/p>\n<ul>\n<li>\u66f4\u5feb\u7684\u6570\u636e\u5305\u5904\u7406<\/li>\n<li>\u66f4\u5feb\u7684\u89c4\u5219\u96c6\u66f4\u65b0<\/li>\n<li>\u4f7f\u7528\u5355\u4e2a nft \u7528\u6237\u7a7a\u95f4\u5b9e\u7528\u7a0b\u5e8f&#xff0c;\u901a\u8fc7\u4e00\u4e2a\u63a5\u53e3\u6765\u7ba1\u7406\u6240\u6709\u534f\u8bae&#xff0c;\u6d88\u9664\u4e86\u4ee5\u5f80\u4e0d\u540c\u524d\u7aef\u548c\u591a\u4e2anetfilter\u63a5\u53e3\u5f15\u8d77\u7684\u4e89\u7528\u95ee\u9898\u3002<\/li>\n<\/ul>\n<h4>\u9759\u6001\u9632\u706b\u5899\u548c\u52a8\u6001\u9632\u706b\u5899<\/h4>\n<h5>\u9759\u6001\u9632\u706b\u5899<\/h5>\n<p>\u7528\u6237\u7ba1\u7406\u9632\u706b\u5899\u89c4\u5219\u65f6&#xff0c;\u4e3a\u4e86\u8ba9\u89c4\u5219\u6c38\u4e45\u4fdd\u5b58&#xff0c;\u9632\u706b\u5899\u670d\u52a1\u4f1a\u91cd\u65b0\u52a0\u8f7d\u6240\u6709\u9632\u706b\u5899\u89c4\u5219&#xff0c;\u54ea\u6015\u53ea\u4fee\u6539\u4e00\u6761\u89c4\u5219\u4e5f\u8981\u91cd\u65b0\u8bfb\u53d6\u6240\u6709\u89c4\u5219&#xff0c;\u8fd9\u79cd\u8f7d\u5165\u6a21\u5f0f\u79f0\u4e3a\u9759\u6001\u6a21\u5f0f\u3002\u9759\u6001\u6a21\u5f0f\u52a0\u8f7d\u89c4\u5219\u65f6&#xff0c;\u4f1a\u5bfc\u81f4\u7f51\u7edc\u8fde\u63a5\u4e22\u5931\u3002<\/p>\n<p>\u6211\u4eec\u79f0\u4f7f\u7528\u9759\u6001\u6a21\u5f0f\u8f7d\u5165\u89c4\u5219\u7684\u9632\u706b\u5899\u4e3a\u9759\u6001\u9632\u706b\u5899\u3002\u4f8b\u5982iptables&#xff0c;\u7528\u6237\u6267\u884c service iptables reload \u547d\u4ee4\u5c06\u53d8\u66f4\u7684\u89c4\u5219\u4fdd\u5b58\u5230\u914d\u7f6e\u6587\u4ef6\u91cc&#xff0c;\u5e76\u91cd\u65b0\u52a0\u8f7d\u6240\u6709\u9632\u706b\u5899\u89c4\u5219\u3002<\/p>\n<h5>\u52a8\u6001\u9632\u706b\u5899<\/h5>\n<p>\u7528\u6237\u7ba1\u7406\u9632\u706b\u5899\u89c4\u5219\u65f6&#xff0c;\u4e3a\u4e86\u8ba9\u89c4\u5219\u6c38\u4e45\u4fdd\u5b58&#xff0c;\u9632\u706b\u5899\u53ea\u9700\u8981\u5c06\u53d8\u66f4\u90e8\u5206\u4fdd\u5b58\u5e76\u66f4\u65b0\u5230\u8fd0\u884c\u4e2d\u7684 iptables \u5373\u53ef&#xff0c;\u800c\u4e0d\u9700\u8981\u5bf9\u6574\u4e2a\u9632\u706b\u5899\u89c4\u5219\u5217\u8868\u8fdb\u884c\u91cd\u65b0\u52a0\u8f7d&#xff0c;\u8fd9\u79cd\u8f7d\u5165\u6a21\u5f0f\u79f0\u4e3a\u52a8\u6001\u6a21\u5f0f\u3002<\/p>\n<p>\u6211\u4eec\u79f0\u4f7f\u7528\u52a8\u6001\u6a21\u5f0f\u8f7d\u5165\u89c4\u5219\u7684\u9632\u706b\u5899\u4e3a\u52a8\u6001\u9632\u706b\u5899&#xff0c;\u4f8b\u5982 firewalld\u3002<\/p>\n<h3>Firewalld \u9632\u706b\u5899<\/h3>\n<h4>Firewalld \u4ecb\u7ecd<\/h4>\n<p>Firewalld \u662f Red Hat \u516c\u53f8\u5f00\u53d1\u7684\u9632\u706b\u5899\u8f6f\u4ef6&#xff0c;\u9ed8\u8ba4\u540e\u7aef\u4e3a nftables\u3002<\/p>\n<ul>\n<li>\u5728 CentOS 7 \u4e4b\u524d\u7684\u53d1\u884c\u7248\u4e2d&#xff0c;\u9ed8\u8ba4\u4f7f\u7528 iptables \u547d\u4ee4\u6765\u7ba1\u7406\u9632\u706b\u5899\u3002<\/li>\n<li>\u5728 CentOS 7 \u4e4b\u540e\u7684\u53d1\u884c\u7248\u4e2d&#xff0c; firewalld \u53d6\u4ee3 iptables \u6210\u4e3a\u4e86\u9ed8\u8ba4\u9632\u706b\u5899\u8f6f\u4ef6\u3002<\/li>\n<li>\u7528\u6237\u53ef\u4ee5\u540c\u65f6\u4f7f\u7528 iptables \u548c firewalld \u4e24\u4e2a\u9632\u706b\u5899\u8f6f\u4ef6&#xff0c;\u4f46\u5bb9\u6613\u641e\u6df7\u89c4\u5219\u3002\u5efa\u8bae\u5c06\u4e00\u4e2a\u9632\u706b\u5899\u5173\u95ed\u6216\u9ed8\u8ba4\u5141\u8bb8\u6240\u6709\u6d41\u91cf&#xff0c;\u53ea\u4f7f\u7528\u53e6\u4e00\u4e2a\u9632\u706b\u5899\u3002<\/li>\n<li>Firewalld \u9632\u706b\u5899\u7684\u53e6\u5916\u4e00\u4e2a\u7279\u70b9\u5c31\u662f\u52a8\u6001\u52a0\u8f7d\u9632\u706b\u5899\u89c4\u5219\u3002<\/li>\n<\/ul>\n<p>Firewalld \u548c iptables \u4e4b\u95f4\u7684\u5173\u7cfb<\/p>\n<ul>\n<li>firewalld \u63d0\u4f9b\u4e86\u4e00\u4e2a daemon \u548c service&#xff0c;\u8fd8\u6709\u547d\u4ee4\u884c\u548c\u56fe\u5f62\u754c\u9762\u914d\u7f6e\u5de5\u5177&#xff0c;\u5b83\u4ec5\u4ec5\u662f\u66ff\u4ee3\u4e86 iptables service \u90e8\u5206&#xff0c;\u5176\u5e95\u5c42\u8fd8\u662f\u4f7f\u7528 iptables \u4f5c\u4e3a\u9632\u706b\u5899\u89c4\u5219\u7ba1\u7406\u5165\u53e3\u3002<\/li>\n<li>firewalld \u548c iptables \u4e00\u6837&#xff0c;\u4ed6\u4eec\u7684\u4f5c\u7528\u90fd\u662f\u7528\u4e8e\u7ef4\u62a4\u89c4\u5219&#xff0c;\u81ea\u8eab\u5e76\u4e0d\u5177\u5907\u9632\u706b\u5899\u7684\u529f\u80fd&#xff0c;\u800c\u771f\u6b63\u4f7f\u7528\u89c4\u5219\u5e72\u6d3b\u7684\u662f\u5185\u6838\u7684 netfilter&#xff0c;\u53ea\u4e0d\u8fc7 firewalld \u548c iptables \u7684\u7ed3\u6784\u4ee5\u53ca\u4f7f\u7528\u65b9\u6cd5\u4e0d\u4e00\u6837\u7f62\u4e86\u3002<\/li>\n<\/ul>\n<h4>Firewalld \u533a\u57df<\/h4>\n<p>firewalld \u9632\u706b\u5899\u4e3a\u4e86\u7b80\u5316\u7ba1\u7406&#xff0c;\u5c06\u6240\u6709\u7f51\u7edc\u6d41\u91cf\u5206\u4e3a\u591a\u4e2a\u533a\u57df(zone)&#xff0c;\u6bcf\u4e2a zone \u5c31\u662f\u4e00\u5957\u8fc7\u6ee4\u89c4\u5219\u96c6\u3002<\/p>\n<h5>Firewalld \u63d0\u4f9b\u7684\u533a\u57df<\/h5>\n<p>firewalld \u9632\u706b\u5899\u63d0\u4f9b\u4e86\u5982\u4e0bzone&#xff1a;<\/p>\n<ul>\n<li>trusted(\u4fe1\u4efb\u533a\u57df)&#xff1a;\u5141\u8bb8\u6240\u6709\u7684\u4f20\u5165\u6d41\u91cf\u3002<\/li>\n<li>public(\u516c\u5171\u533a\u57df)&#xff1a;\u5141\u8bb8\u4e0essh\u6216dhcpv6-client\u9884\u5b9a\u4e49\u670d\u52a1\u5339\u914d\u7684\u4f20\u5165\u6d41\u91cf&#xff0c;\u5176\u4f59\u5747\u62d2\u7edd\u3002\u662f\u65b0\u6dfb\u52a0\u7f51\u7edc\u63a5\u53e3\u7684\u9ed8\u8ba4\u533a\u57df\u3002<\/li>\n<li>external(\u5916\u90e8\u533a\u57df)&#xff1a;\u5141\u8bb8\u4e0essh\u9884\u5b9a\u4e49\u670d\u52a1\u5339\u914d\u7684\u4f20\u5165\u6d41\u91cf&#xff0c;\u5176\u4f59\u5747\u62d2\u7edd\u3002\u9ed8\u8ba4\u5c06\u901a\u8fc7\u6b64\u533a\u57df\u8f6c\u53d1\u7684IPv4\u4f20\u51fa\u6d41\u91cf\u5c06\u8fdb\u884c\u5730\u5740\u4f2a\u88c5&#xff0c;\u53ef\u7528\u4e8e\u4e3a\u8def\u7531\u5668\u542f\u7528\u4e86\u4f2a\u88c5\u529f\u80fd\u7684\u5916\u90e8\u7f51\u7edc\u3002<\/li>\n<li>home(\u5bb6\u5ead\u533a\u57df)&#xff1a;\u5141\u8bb8\u4e0essh\u3001mdn3\u3001samba-client\u6216dhcpv6-client\u9884\u5b9a\u4e49\u670d\u52a1\u5339\u914d\u7684\u4f20\u5165\u6d41\u91cf&#xff0c;\u5176\u4f59\u5747\u62d2\u7edd\u3002<\/li>\n<li>internal(\u5185\u90e8\u533a\u57df)&#xff1a;\u9ed8\u8ba4\u503c\u65f6\u4e0ehomel\u533a\u57df\u76f8\u540c\u3002<\/li>\n<li>work(\u5de5\u4f5c\u533a\u57df)&#xff1a;\u5141\u8bb8\u4e0e ssh\u3001dhcpv6-client\u9884\u5b9a\u4e49\u670d\u52a1\u5339\u914d\u7684\u4f20\u5165\u6d41\u91cf&#xff0c;\u5176\u4f59\u5747\u62d2\u7edd\u3002<\/li>\n<li>dmz(\u9694\u79bb\u533a\u57df\u4e5f\u79f0\u4e3a\u975e\u519b\u4e8b\u533a\u57df)&#xff1a;\u5141\u8bb8\u4e0essh \u9884\u5b9a\u4e49\u670d\u52a1\u5339\u914d\u7684\u4f20\u5165\u6d41\u91cf&#xff0c;\u5176\u4f59\u5747\u62d2\u7edd\u3002<\/li>\n<li>block(\u9650\u5236\u533a\u57df)&#xff1a;\u62d2\u7edd\u6240\u6709\u4f20\u5165\u6d41\u91cf\u3002<\/li>\n<li>drop(\u4e22\u5f03\u533a\u57df)&#xff1a;\u4e22\u5f03\u6240\u6709\u4f20\u5165\u6d41\u91cf&#xff0c;\u5e76\u4e14\u4e0d\u4ea7\u751f\u5305\u542bICMP\u7684\u9519\u8bef\u54cd\u5e94\u3002<\/li>\n<\/ul>\n<h5>\u6570\u636e\u5305\u4e0e\u533a\u57df\u5339\u914d\u89c4\u5219<\/h5>\n<p>\u6570\u636e\u5305\u4e0ezone\u5339\u914d\u89c4\u5219\u5982\u4e0b&#xff1a;<\/p>\n<li>\n<p>\u8be5\u6e90\u5730\u5740\u88ab\u5206\u914d\u7ed9\u7279\u5b9a\u533a\u57df&#xff0c; \u5219\u5e94\u7528\u8be5\u533a\u57df\u7684\u89c4\u5219\u3002<\/p>\n<\/li>\n<li>\n<p>\u5982\u679c\u6570\u636e\u5305\u672a\u5339\u914d\u6e90\u5730\u5740&#xff0c;\u5219\u5206\u914d\u7ed9\u4e0e\u4f20\u5165\u7f51\u7edc\u63a5\u53e3\u5173\u8054\u7684\u533a\u57df&#xff0c;\u5e76\u5e94\u7528\u8be5\u533a\u57df\u7684\u89c4\u5219\u3002<\/p>\n<\/li>\n<li>\n<p>\u5982\u679c\u4ee5\u4e0a\u90fd\u672a\u5339\u914d&#xff0c;firewalld\u5c06\u6570\u636e\u5305\u5206\u914d\u7ed9\u9ed8\u8ba4\u533a\u57df\u3002<\/p>\n<\/li>\n<p>\u6ce8\u610f\u4e8b\u9879&#xff1a;<\/p>\n<ul>\n<li>firewalld\u9ed8\u8ba4\u6307\u5b9apublic\u533a\u57df\u4e3a\u9ed8\u8ba4\u533a\u57df&#xff0c;\u5e76\u5c06lo \u56de\u73af\u63a5\u53e3\u6620\u5c04\u81f3 trusted \u533a\u57df\u3002<\/li>\n<li>\u5982\u679c\u6d41\u91cf\u4e0d\u4e0e\u5141\u8bb8\u7684\u7aef\u53e3\u6216\u534f\u8bae\u6216\u670d\u52a1\u5339\u914d&#xff0c;\u5219\u901a\u5e38\u4f1a\u88ab\u62d2\u7edd\u3002<\/li>\n<\/ul>\n<h4>Firewalld \u89c4\u5219<\/h4>\n<p>\u5bf9\u4e8e\u6240\u6709\u533a\u57df&#xff0c;\u533a\u57df\u5185\u89c4\u5219\u7684\u4f18\u5148\u7ea7\u662f\u76f8\u540c\u7684\u3002<\/p>\n<p>\u533a\u57df\u5185\u89c4\u5219\u5339\u914d\u4f18\u5148\u7ea7\u5982\u4e0b&#xff1a;<\/p>\n<li>\u9996\u5148\u5339\u914d\u4e3a\u8be5\u533a\u57df\u8bbe\u7f6e\u7684\u4efb\u4f55\u7aef\u53e3\u8f6c\u53d1\u548c\u4f2a\u88c5\u539f\u5219\u3002<\/li>\n<li>\u5176\u6b21\u5339\u914d\u8be5\u533a\u57df\u8bbe\u7f6e\u7684\u4efb\u4f55\u5141\u8bb8\u89c4\u5219\u3002<\/li>\n<li>\u6700\u540e\u5339\u914d\u8be5\u533a\u57df\u8bbe\u7f6e\u7684\u4efb\u4f55\u62d2\u7edd\u89c4\u5219\u3002<\/li>\n<li>\u8fd8\u53ef\u4ee5\u540c\u65f6\u4e3a\u4ee5\u4e0a3\u4e2a\u89c4\u5219\u8bbe\u7f6e\u8bb0\u5f55\u548c\u5ba1\u8ba1\u89c4\u5219&#xff0c;\u53ef\u4ee5\u540c\u65f6\u751f\u6548\u3002<\/li>\n<li>\u5bcc\u89c4\u5219\u4e2d\u7684\u89c4\u5219\u4f18\u5148\u7ea7\u9ad8\u4e8e\u533a\u57df\u4e2d\u5176\u4ed6\u89c4\u5219\u3002<\/li>\n<li>\u5982\u679c\u533a\u57df\u4e2d\u6240\u6709\u89c4\u5219\u90fd\u4e0d\u5339\u914d&#xff0c;\u90a3\u4e48\u901a\u5e38\u4f1a\u62d2\u7edd\u8be5\u5305&#xff0c;trusted \u4f8b\u5916\u3002<\/li>\n<h3>Firewalld \u914d\u7f6e<\/h3>\n<p>Firewalld \u914d\u7f6e\u65b9\u6cd5<\/p>\n<li>\u76f4\u63a5\u7f16\u8f91 \/etc\/firewalld\/ \u4e2d\u7684\u914d\u7f6e\u6587\u4ef6<\/li>\n<li>firewall-cmd \u547d\u4ee4\u884c\u5de5\u5177<\/li>\n<li>firewall-config \u56fe\u5f62\u5de5\u5177<\/li>\n<h4>Firewalld \u914d\u7f6e\u6587\u4ef6<\/h4>\n<p>Firewalld \u914d\u7f6e\u914d\u7f6e\u6587\u4ef6\u5b58\u653e\u5728&#xff1a;<\/p>\n<ul>\n<li>\/usr\/lib\/firewalld\/\u76ee\u5f55&#xff0c;Firewalld\u8f6f\u4ef6\u5305\u81ea\u5e26\u914d\u7f6e\u4f4d\u7f6e\u3002<\/li>\n<li>\/etc\/firewalld\/\u76ee\u5f55&#xff0c;\u76ee\u5f55\u7ed3\u6784\u4e0e \/usr\/lib\/firewalld\/ \u4e00\u81f4&#xff0c;\u7ba1\u7406\u5458\u81ea\u5b9a\u4e49\u914d\u7f6e\u4fdd\u5b58\u5728\u8be5\u4f4d\u7f6e\u3002<\/li>\n<\/ul>\n<p>\u63d0\u793a&#xff1a; \u6211\u4eec\u4e0d\u5efa\u8bae\u5927\u5bb6\u901a\u8fc7\u4fee\u6539 \/etc\/firewalld\/ \u76ee\u5f55\u914d\u7f6e\u9632\u706b\u5899\u3002<\/p>\n<h5>\u67e5\u770bzone\u914d\u7f6e<\/h5>\n<p><span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># cd \/usr\/lib\/firewalld\/<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 firewalld<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># ls<\/span><br \/>\nhelpers  icmptypes  ipsets  services  zones<\/p>\n<p><span class=\"token comment\"># \u67e5\u770bzone\u914d\u7f6e<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 firewalld<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># ls zones\/<\/span><br \/>\nblock.xml  drop.xml      home.xml      public.xml   work.xml<br \/>\ndmz.xml    external.xml  internal.xml  trusted.xml<\/p>\n<p><span class=\"token punctuation\">[<\/span>root&#064;centos7 firewalld<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># cat zones\/trusted.xml <\/span><br \/>\n<span class=\"token operator\">&lt;<\/span>?xml <span class=\"token assign-left variable\">version<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;1.0&#034;<\/span> <span class=\"token assign-left variable\">encoding<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;utf-8&#034;<\/span>?<span class=\"token operator\">&gt;<\/span><br \/>\n<span class=\"token operator\">&lt;<\/span>zone <span class=\"token assign-left variable\">target<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;ACCEPT&#034;<\/span><span class=\"token operator\">&gt;<\/span><br \/>\n  <span class=\"token operator\">&lt;<\/span>short<span class=\"token operator\">&gt;<\/span>Trusted<span class=\"token operator\">&lt;<\/span>\/short<span class=\"token operator\">&gt;<\/span><br \/>\n  <span class=\"token operator\">&lt;<\/span>description<span class=\"token operator\">&gt;<\/span>All network connections are accepted.<span class=\"token operator\">&lt;<\/span>\/description<span class=\"token operator\">&gt;<\/span><br \/>\n<span class=\"token operator\">&lt;<\/span>\/zone<span class=\"token operator\">&gt;<\/span><\/p>\n<p><span class=\"token punctuation\">[<\/span>root&#064;centos7 firewalld<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># cat zones\/block.xml <\/span><br \/>\n<span class=\"token operator\">&lt;<\/span>?xml <span class=\"token assign-left variable\">version<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;1.0&#034;<\/span> <span class=\"token assign-left variable\">encoding<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;utf-8&#034;<\/span>?<span class=\"token operator\">&gt;<\/span><br \/>\n<span class=\"token operator\">&lt;<\/span>zone <span class=\"token assign-left variable\">target<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;%%REJECT%%&#034;<\/span><span class=\"token operator\">&gt;<\/span><br \/>\n  <span class=\"token operator\">&lt;<\/span>short<span class=\"token operator\">&gt;<\/span>Block<span class=\"token operator\">&lt;<\/span>\/short<span class=\"token operator\">&gt;<\/span><br \/>\n  <span class=\"token operator\">&lt;<\/span>description<span class=\"token operator\">&gt;<\/span>Unsolicited incoming network packets are rejected. Incoming packets that are related to outgoing network connections are accepted. Outgoing network connections are allowed.<span class=\"token operator\">&lt;<\/span>\/description<span class=\"token operator\">&gt;<\/span><br \/>\n<span class=\"token operator\">&lt;<\/span>\/zone<span class=\"token operator\">&gt;<\/span><\/p>\n<p><span class=\"token punctuation\">[<\/span>root&#064;centos7 firewalld<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># cat zones\/drop.xml <\/span><br \/>\n<span class=\"token operator\">&lt;<\/span>?xml <span class=\"token assign-left variable\">version<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;1.0&#034;<\/span> <span class=\"token assign-left variable\">encoding<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;utf-8&#034;<\/span>?<span class=\"token operator\">&gt;<\/span><br \/>\n<span class=\"token operator\">&lt;<\/span>zone <span class=\"token assign-left variable\">target<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;DROP&#034;<\/span><span class=\"token operator\">&gt;<\/span><br \/>\n  <span class=\"token operator\">&lt;<\/span>short<span class=\"token operator\">&gt;<\/span>Drop<span class=\"token operator\">&lt;<\/span>\/short<span class=\"token operator\">&gt;<\/span><br \/>\n  <span class=\"token operator\">&lt;<\/span>description<span class=\"token operator\">&gt;<\/span>Unsolicited incoming network packets are dropped. Incoming packets that are related to outgoing network connections are accepted. Outgoing network connections are allowed.<span class=\"token operator\">&lt;<\/span>\/description<span class=\"token operator\">&gt;<\/span><br \/>\n<span class=\"token operator\">&lt;<\/span>\/zone<span class=\"token operator\">&gt;<\/span><\/p>\n<h5>\u67e5\u770b\u670d\u52a1\u914d\u7f6e<\/h5>\n<p><span class=\"token punctuation\">[<\/span>root&#064;centos7 firewalld<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># ls -1 services<\/span><br \/>\namanda-client.xml<br \/>\n<span class=\"token punctuation\">..<\/span><span class=\"token punctuation\">..<\/span><span class=\"token punctuation\">..<\/span><\/p>\n<p><span class=\"token punctuation\">[<\/span>root&#064;centos7 firewalld<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># cat services\/http.xml <\/span><br \/>\n<span class=\"token operator\">&lt;<\/span>?xml <span class=\"token assign-left variable\">version<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;1.0&#034;<\/span> <span class=\"token assign-left variable\">encoding<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;utf-8&#034;<\/span>?<span class=\"token operator\">&gt;<\/span><br \/>\n<span class=\"token operator\">&lt;<\/span>service<span class=\"token operator\">&gt;<\/span><br \/>\n  <span class=\"token operator\">&lt;<\/span>short<span class=\"token operator\">&gt;<\/span>WWW <span class=\"token punctuation\">(<\/span>HTTP<span class=\"token punctuation\">)<\/span><span class=\"token operator\">&lt;<\/span>\/short<span class=\"token operator\">&gt;<\/span><br \/>\n  <span class=\"token operator\">&lt;<\/span>description<span class=\"token operator\">&gt;<\/span>HTTP is the protocol used to serve Web pages. If you plan to <span class=\"token function\">make<\/span> your Web server publicly available, <span class=\"token builtin class-name\">enable<\/span> this option. This option is not required <span class=\"token keyword\">for<\/span> viewing pages locally or developing Web pages.<span class=\"token operator\">&lt;<\/span>\/description<span class=\"token operator\">&gt;<\/span><br \/>\n  <span class=\"token operator\">&lt;<\/span>port <span class=\"token assign-left variable\">protocol<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;tcp&#034;<\/span> <span class=\"token assign-left variable\">port<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;80&#034;<\/span>\/<span class=\"token operator\">&gt;<\/span><br \/>\n<span class=\"token operator\">&lt;<\/span>\/service<span class=\"token operator\">&gt;<\/span><\/p>\n<p><span class=\"token punctuation\">[<\/span>root&#064;centos7 firewalld<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># cat services\/https.xml <\/span><br \/>\n<span class=\"token operator\">&lt;<\/span>?xml <span class=\"token assign-left variable\">version<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;1.0&#034;<\/span> <span class=\"token assign-left variable\">encoding<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;utf-8&#034;<\/span>?<span class=\"token operator\">&gt;<\/span><br \/>\n<span class=\"token operator\">&lt;<\/span>service<span class=\"token operator\">&gt;<\/span><br \/>\n  <span class=\"token operator\">&lt;<\/span>short<span class=\"token operator\">&gt;<\/span>Secure WWW <span class=\"token punctuation\">(<\/span>HTTPS<span class=\"token punctuation\">)<\/span><span class=\"token operator\">&lt;<\/span>\/short<span class=\"token operator\">&gt;<\/span><br \/>\n  <span class=\"token operator\">&lt;<\/span>description<span class=\"token operator\">&gt;<\/span>HTTPS is a modified HTTP used to serve Web pages when security is important. Examples are sites that require logins like stores or web mail. This option is not required <span class=\"token keyword\">for<\/span> viewing pages locally or developing Web pages. You need the httpd package installed <span class=\"token keyword\">for<\/span> this option to be useful.<span class=\"token operator\">&lt;<\/span>\/description<span class=\"token operator\">&gt;<\/span><br \/>\n  <span class=\"token operator\">&lt;<\/span>port <span class=\"token assign-left variable\">protocol<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;tcp&#034;<\/span> <span class=\"token assign-left variable\">port<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;443&#034;<\/span>\/<span class=\"token operator\">&gt;<\/span><br \/>\n<span class=\"token operator\">&lt;<\/span>\/service<span class=\"token operator\">&gt;<\/span><\/p>\n<h4>firewall-cmd \u547d\u4ee4\u884c\u5de5\u5177<\/h4>\n<h5>\u4e24\u4e2a\u57fa\u672c\u6982\u5ff5<\/h5>\n<p>\u914d\u7f6e\u9632\u706b\u5899\u5fc5\u987b\u77e5\u9053\u4e24\u4e2a\u57fa\u672c\u6982\u5ff5&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u9632\u706b\u5899\u7684\u914d\u7f6e\u6709\u4e24\u4e2a\u72b6\u6001&#xff1a;<\/p>\n<ul>\n<li>runtime&#xff08;\u8fd0\u884c\u65f6&#xff09;&#xff0c;\u547d\u4ee4\u884c\u6267\u884c\u662f\u7684\u9ed8\u8ba4\u72b6\u6001&#xff0c;\u8be5\u72b6\u6001\u4e0b\u7684\u914d\u7f6e\u7acb\u523b\u751f\u6548\u3002<\/li>\n<li>permanent&#xff08;\u6c38\u4e45&#xff09;&#xff0c;\u901a\u8fc7\u9009\u9879 &#8211;permanent \u6307\u5b9a&#xff0c;\u8be5\u72b6\u6001\u4e0b\u7684\u914d\u7f6e\u4e0d\u4f1a\u7acb\u523b\u751f\u6548&#xff0c;\u800c\u662f\u5199\u5165\u914d\u7f6e\u6587\u4ef6&#xff0c;\u9700\u8981\u901a\u8fc7\u9009\u9879 &#8211;reload \u91cd\u65b0reload\u624d\u4f1a\u751f\u6548&#xff0c;\u91cd\u65b0reload\u5c06\u5bfc\u81f4\u8fd0\u884c\u65f6\u72b6\u6001\u4e0b\u672a\u4fdd\u5b58\u7684\u914d\u7f6e\u4e22\u5931&#xff0c;\u4f46\u4f1a\u4fdd\u7559\u5f53\u524d\u8fde\u63a5\u72b6\u6001\u3002\u5982\u679c\u4f7f\u7528\u9009\u9879 &#8211;complete-reload \u91cd\u65b0reload\u6c38\u4e45\u914d\u7f6e&#xff0c;\u5c06\u5bfc\u81f4\u5f53\u524d\u8fde\u63a5\u72b6\u6001\u4e5f\u4e22\u5931\u3002<\/li>\n<\/ul>\n<p>\u5efa\u8bae\u914d\u7f6e\u9632\u706b\u5899\u4e00\u6b21\u6027\u5199\u4e24\u6761\u89c4\u5219&#xff1a;<\/p>\n<p>\u7b2c\u4e00\u6761\u4f7f\u7528\u9009\u9879 &#8211;permanent\u6c38\u4e45\u751f\u6548&#xff1b;<\/p>\n<p>\u7b2c\u4e8c\u6761\u4e0d\u4f7f\u7528\u9009\u9879 &#8211;permanent \u7acb\u523b\u751f\u6548\u3002<\/p>\n<\/li>\n<li>\n<p>\u914d\u7f6e\u9632\u706b\u5899\u7684\u89c4\u5219\u5fc5\u987b\u4e00\u4e2a\u533a\u57df\u5185&#xff08;\u76f4\u63a5\u89c4\u5219\u9664\u5916&#xff09;&#xff0c;\u5982\u679c\u4e0d\u4f7f\u7528\u9009\u9879 &#8211;zone \u660e\u786e\u6307\u660e\u533a\u57df&#xff0c;\u5219\u4f7f\u7528\u9ed8\u8ba4\u533a\u57df\u3002\u9ed8\u8ba4\u533a\u57df\u662fpublic\u3002<\/p>\n<\/li>\n<\/ul>\n<h5>zone \u7ba1\u7406<\/h5>\n<p><span class=\"token comment\"># \u67e5\u770bzone\u6e05\u5355<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;get-zones <\/span><br \/>\nblock dmz drop external home internal public trusted work<\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u6fc0\u6d3b\u7684zone\u6e05\u5355&#xff0c;\u4e5f\u5c31\u662f\u5206\u914d\u4e86interface\u548csource\u7684zone<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;get-active-zones <\/span><br \/>\npublic<br \/>\n  interfaces: ens32<\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u9ed8\u8ba4zone<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;get-default-zone <\/span><br \/>\npublic<\/p>\n<p><span class=\"token comment\"># \u8bbe\u7f6e\u9ed8\u8ba4zone&#xff0c;\u4f8b\u5982\u8bbe\u7f6e\u4e3atrusted&#xff0c;\u8be5\u64cd\u4f5c\u540c\u65f6\u8bbe\u7f6e\u6c38\u4e45\u6001\u9ed8\u8ba4zone<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;set-default-zone&#061;trusted <\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;get-default-zone <\/span><br \/>\ntrusted<\/p>\n<p><span class=\"token comment\"># \u518d\u6b21\u8bbe\u7f6e\u56de\u6765<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;set-default-zone&#061;public <\/span><\/p>\n<p><span class=\"token comment\">######################## \u4ee5\u4e0b\u5173\u4e8e zone\u7684\u547d\u4ee4-\u8bf7\u81ea\u5b66 ########################<\/span><br \/>\n<span class=\"token comment\"># \u5982\u679c\u6709\u9700\u8981\u8fd8\u53ef\u4ee5\u521b\u5efa\u65b0zone&#xff0c;\u5fc5\u987b\u914d\u5408&#8211;permanent<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;permanent &#8211;new-zone&#061;myweb<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;permanent &#8211;get-zones <\/span><br \/>\nblock dmz drop external home internal myweb public trusted work<br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;get-zones <\/span><br \/>\nblock dmz drop external home internal public trusted work<\/p>\n<p><span class=\"token comment\"># \u4f7f\u7528&#8211;reload\u9009\u9879\u91cd\u65b0\u52a0\u8f7d\u6240\u6709\u9632\u706b\u5899\u89c4\u5219&#xff0c;\u518d\u6b21\u67e5\u770bzone\u6e05\u5355<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;reload<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;get-zones <\/span><br \/>\nblock dmz drop external home internal myweb public trusted work<\/p>\n<p><span class=\"token comment\"># \u67e5\u770bzone target<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;permanent &#8211;zone&#061;myweb &#8211;get-target<\/span><br \/>\ndefault<\/p>\n<p><span class=\"token comment\"># \u8bbe\u7f6ezone target&#xff0c;\u53ef\u7528target\u503c\u4e3a&#xff1a;<\/span><br \/>\n<span class=\"token comment\">#    default&#xff0c;\u9ed8\u8ba4\u503c&#xff0c;\u4e5f\u5c31\u662f\u62d2\u7edd\u6570\u636e\u5305\u8fdb\u5165\u7528\u6237\u7a7a\u95f4\u3002<\/span><br \/>\n<span class=\"token comment\">#    ACCEPT&#xff0c;\u5141\u8bb8\u6570\u636e\u5305\u8fdb\u5165\u7528\u6237\u7a7a\u95f4\u3002<\/span><br \/>\n<span class=\"token comment\">#    DROP&#xff0c;\u4e22\u5f03\u6570\u636e\u5305&#xff0c;\u4e0d\u5bf9\u5ba2\u6237\u7aef\u505a\u51fa\u4efb\u4f55\u54cd\u5e94\u3002<\/span><br \/>\n<span class=\"token comment\">#    REJECT&#xff0c;\u62d2\u7edd\u6570\u636e\u5305\u8fdb\u5165\u7528\u6237\u7a7a\u95f4\u3002<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;permanent &#8211;zone&#061;myweb &#8211;set-target&#061;REJECT<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;permanent &#8211;zone&#061;myweb &#8211;get-target<\/span><br \/>\nREJECT<\/p>\n<p><span class=\"token comment\"># zone\u4e0d\u9700\u8981\u7684\u65f6\u5019&#xff0c;\u4e5f\u53ef\u4ee5\u5220\u9664&#xff0c;\u5fc5\u987b\u914d\u5408&#8211;permanent<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;permanent &#8211;delete-zone&#061;myweb<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;permanent &#8211;get-zones<\/span><br \/>\nblock dmz drop external home internal public trusted work<br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;reload <\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;get-zones<\/span><br \/>\nblock dmz drop external home internal public trusted work<br \/>\n<span class=\"token comment\">######################## \u4ee5\u4e0b\u5173\u4e8e zone\u7684\u547d\u4ee4-\u8bf7\u81ea\u5b66 ########################<\/span><\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u6240\u6709zone\u4e2d\u7684\u89c4\u5219<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;list-all-zones <\/span><br \/>\nblock<br \/>\n  target: %%REJECT%%<br \/>\n  icmp-block-inversion: no<br \/>\n  interfaces:<br \/>\n  sources:<br \/>\n  services:<br \/>\n  ports:<br \/>\n  protocols:<br \/>\n  masquerade: no<br \/>\n  forward-ports:<br \/>\n  source-ports:<br \/>\n  icmp-blocks:<br \/>\n  rich rules: <\/p>\n<p>dmz<br \/>\n  target: default<br \/>\n<span class=\"token punctuation\">..<\/span><span class=\"token punctuation\">..<\/span><span class=\"token punctuation\">..<\/span><\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u9ed8\u8ba4zone\u4e2d\u7684\u89c4\u5219<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;list-all<\/span><br \/>\npublic <span class=\"token punctuation\">(<\/span>active<span class=\"token punctuation\">)<\/span><br \/>\n  target: default<br \/>\n  icmp-block-inversion: no<br \/>\n  interfaces: ens32<br \/>\n  sources:<br \/>\n  services: cockpit dhcpv6-client <span class=\"token function\">ssh<\/span><br \/>\n  ports:<br \/>\n  protocols:<br \/>\n  masquerade: no<br \/>\n  forward-ports:<br \/>\n  source-ports:<br \/>\n  icmp-blocks:<br \/>\n  rich rules: <\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u7279\u5b9azone\u4e2d\u7684\u89c4\u5219<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;list-all &#8211;zone&#061;home<\/span><br \/>\nhome<br \/>\n  target: default<br \/>\n  icmp-block-inversion: no<br \/>\n  interfaces:<br \/>\n  sources:<br \/>\n  services: dhcpv6-client mdns samba-client <span class=\"token function\">ssh<\/span><br \/>\n  ports:<br \/>\n  protocols:<br \/>\n  masquerade: no<br \/>\n  forward-ports:<br \/>\n  source-ports:<br \/>\n  icmp-blocks:<br \/>\n  rich rules: <\/p>\n<h5>source \u7ba1\u7406<\/h5>\n<p><span class=\"token comment\"># \u6765\u6e90\u4e8e\u7279\u5b9asource\u7684\u6570\u636e\u5305\u4ea4\u7ed9\u7279\u5b9azone\u5904\u7406<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;add-source&#061;10.1.1.0\/24 &#8211;zone&#061;home <\/span><\/p>\n<p><span class=\"token comment\"># \u67e5\u770bsource\u6e05\u5355<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;list-sources &#8211;zone&#061;home<\/span><br \/>\n<span class=\"token number\">10.1<\/span>.1.0\/24<\/p>\n<p><span class=\"token comment\"># \u67e5\u770bsource\u5c5e\u4e8e\u54ea\u4e2azone<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;get-zone-of-source&#061;10.1.1.0\/24<\/span><br \/>\nhome<\/p>\n<p><span class=\"token comment\"># \u67e5\u770bsource\u662f\u5426\u6dfb\u52a0<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;query-source&#061;10.1.1.0\/24 &#8211;zone&#061;home <\/span><br \/>\n<span class=\"token function\">yes<\/span><\/p>\n<p><span class=\"token comment\"># \u53d8\u66f4source\u5230\u5176\u4ed6zone<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;change-source&#061;10.1.1.0\/24 &#8211;zone&#061;public<\/span><\/p>\n<p><span class=\"token comment\"># \u5220\u9664zone\u4e2dsource<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;remove-source&#061;10.1.1.0\/24 &#8211;zone&#061;public<\/span><\/p>\n<h5>interface \u7ba1\u7406&#xff08;\u81ea\u5b66&#xff09;<\/h5>\n<p><span class=\"token comment\"># \u67e5\u770bzone\u4e2dinterface<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;list-interfaces<\/span><br \/>\nens32<\/p>\n<p><span class=\"token comment\"># \u67e5\u770binterface\u5c5e\u4e8e\u54ea\u4e2azone<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;get-zone-of-interface&#061;ens32 <\/span><br \/>\npublic<\/p>\n<p><span class=\"token comment\"># \u67e5\u770binterface\u662f\u5426\u6dfb\u52a0<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;query-interface&#061;ens32 <\/span><br \/>\n<span class=\"token function\">yes<\/span><\/p>\n<p><span class=\"token comment\"># \u5c06interface\u53d8\u66f4\u5230\u5176\u4ed6zone<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;change-interface&#061;ens32 &#8211;zone&#061;home<\/span><\/p>\n<p><span class=\"token comment\"># \u5220\u9664zone\u4e2dinterface<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;remove-interface&#061;ens32 &#8211;zone&#061;home<\/span><\/p>\n<p><span class=\"token comment\"># \u5982\u679cinterface\u4e0d\u5c5e\u4e8e\u4efb\u4f55zone&#xff0c;\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4\u5c06interface\u7ed1\u5b9a\u5230\u7279\u5b9azone<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;add-interface&#061;ens32 &#8211;zone&#061;public<\/span><\/p>\n<h5>service \u7ba1\u7406<\/h5>\n<p>\u51c6\u5907nginx\u670d\u52a1<\/p>\n<p> yum <span class=\"token function\">install<\/span> <span class=\"token parameter variable\">-y<\/span> nginx<br \/>\nsystemctl start nginx<\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u7cfb\u7edf\u4e2d\u9884\u5b9a\u4e49\u4e86\u54ea\u4e9b\u670d\u52a1<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;get-services<\/span><\/p>\n<p><span class=\"token comment\"># \u6dfb\u52a0\u653e\u884c\u670d\u52a1<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;add-service&#061;http <\/span><\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u653e\u884c\u670d\u52a1\u5217\u8868<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;list-services <\/span><br \/>\ncockpit dhcpv6-client http <span class=\"token function\">ssh<\/span><\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u670d\u52a1\u662f\u5426\u653e\u884c<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;query-service&#061;http<\/span><br \/>\n<span class=\"token function\">yes<\/span><\/p>\n<p><span class=\"token comment\"># \u5220\u9664\u670d\u52a1<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;remove-service&#061;http<\/span><\/p>\n<p>firewall-cmd \u547d\u4ee4\u884c\u8fd8\u53ef\u4ee5\u5b9a\u4e49\u65b0\u7684\u670d\u52a1\u3002<\/p>\n<p>\u5e38\u7528\u9009\u9879\u5982\u4e0b&#xff1a;<\/p>\n<p> <span class=\"token parameter variable\">&#8211;permanent<\/span> &#8211;new-service<span class=\"token operator\">&#061;<\/span>service<br \/>\n Add a new permanent and empty service.<\/p>\n<p><span class=\"token parameter variable\">&#8211;permanent<\/span> &#8211;delete-service<span class=\"token operator\">&#061;<\/span>service<br \/>\n Delete an existing permanent service.<\/p>\n<p><span class=\"token parameter variable\">&#8211;permanent<\/span> <span class=\"token parameter variable\">&#8211;service<\/span><span class=\"token operator\">&#061;<\/span>service &#8211;set-description<span class=\"token operator\">&#061;<\/span>description<br \/>\n Set new description to <span class=\"token function\">service<\/span><\/p>\n<p><span class=\"token parameter variable\">&#8211;permanent<\/span> <span class=\"token parameter variable\">&#8211;service<\/span><span class=\"token operator\">&#061;<\/span>service &#8211;get-description<br \/>\n Print description <span class=\"token keyword\">for<\/span> <span class=\"token function\">service<\/span><\/p>\n<p><span class=\"token parameter variable\">&#8211;permanent<\/span> <span class=\"token parameter variable\">&#8211;service<\/span><span class=\"token operator\">&#061;<\/span>service &#8211;set-short<span class=\"token operator\">&#061;<\/span>description<br \/>\n Set short description to <span class=\"token function\">service<\/span><\/p>\n<p><span class=\"token parameter variable\">&#8211;permanent<\/span> <span class=\"token parameter variable\">&#8211;service<\/span><span class=\"token operator\">&#061;<\/span>service &#8211;get-short<br \/>\n Print short description <span class=\"token keyword\">for<\/span> <span class=\"token function\">service<\/span><\/p>\n<p><span class=\"token parameter variable\">&#8211;permanent<\/span> <span class=\"token parameter variable\">&#8211;service<\/span><span class=\"token operator\">&#061;<\/span>service &#8211;add-port<span class=\"token operator\">&#061;<\/span>portid<span class=\"token punctuation\">[<\/span>-portid<span class=\"token punctuation\">]<\/span>\/protocol<br \/>\n Add a new port to the permanent service.<\/p>\n<p><span class=\"token parameter variable\">&#8211;permanent<\/span> <span class=\"token parameter variable\">&#8211;service<\/span><span class=\"token operator\">&#061;<\/span>service &#8211;remove-port<span class=\"token operator\">&#061;<\/span>portid<span class=\"token punctuation\">[<\/span>-portid<span class=\"token punctuation\">]<\/span>\/protocol<br \/>\n Remove a port from the permanent service.<\/p>\n<p><span class=\"token parameter variable\">&#8211;permanent<\/span> <span class=\"token parameter variable\">&#8211;service<\/span><span class=\"token operator\">&#061;<\/span>service &#8211;get-ports<br \/>\n List ports added to the permanent service.<\/p>\n<p><span class=\"token parameter variable\">&#8211;permanent<\/span> <span class=\"token parameter variable\">&#8211;service<\/span><span class=\"token operator\">&#061;<\/span>service &#8211;add-protocol<span class=\"token operator\">&#061;<\/span>protocol<br \/>\n Add a new protocol to the permanent service.<\/p>\n<p><span class=\"token parameter variable\">&#8211;permanent<\/span> <span class=\"token parameter variable\">&#8211;service<\/span><span class=\"token operator\">&#061;<\/span>service &#8211;remove-protocol<span class=\"token operator\">&#061;<\/span>protocol<br \/>\n Remove a protocol from the permanent service.<\/p>\n<p><span class=\"token parameter variable\">&#8211;permanent<\/span> <span class=\"token parameter variable\">&#8211;service<\/span><span class=\"token operator\">&#061;<\/span>service &#8211;get-protocols<br \/>\n List protocols added to the permanent service.<\/p>\n<p><span class=\"token parameter variable\">&#8211;permanent<\/span> <span class=\"token parameter variable\">&#8211;service<\/span><span class=\"token operator\">&#061;<\/span>service &#8211;add-source-port<span class=\"token operator\">&#061;<\/span>portid<span class=\"token punctuation\">[<\/span>-portid<span class=\"token punctuation\">]<\/span>\/protocol<br \/>\n Add a new <span class=\"token builtin class-name\">source<\/span> port to the permanent service.<\/p>\n<p><span class=\"token parameter variable\">&#8211;permanent<\/span> <span class=\"token parameter variable\">&#8211;service<\/span><span class=\"token operator\">&#061;<\/span>service &#8211;remove-source-port<span class=\"token operator\">&#061;<\/span>portid<span class=\"token punctuation\">[<\/span>-portid<span class=\"token punctuation\">]<\/span>\/protocol<br \/>\n Remove a <span class=\"token builtin class-name\">source<\/span> port from the permanent service.<\/p>\n<p><span class=\"token parameter variable\">&#8211;permanent<\/span> <span class=\"token parameter variable\">&#8211;service<\/span><span class=\"token operator\">&#061;<\/span>service &#8211;get-source-ports<br \/>\n List <span class=\"token builtin class-name\">source<\/span> ports added to the permanent service.<\/p>\n<h5>port \u7ba1\u7406<\/h5>\n<p><span class=\"token comment\"># \u6dfb\u52a0\u653e\u884c\u7aef\u53e3<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;add-port&#061;5900\/tcp<\/span><\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u7aef\u53e3\u653e\u884c\u5217\u8868<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;list-ports <\/span><br \/>\n<span class=\"token number\">5900<\/span>\/tcp<\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u7aef\u53e3\u662f\u5426\u653e\u884c<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;query-port&#061;5900\/tcp<\/span><br \/>\n<span class=\"token function\">yes<\/span><\/p>\n<p><span class=\"token comment\"># \u5220\u9664\u7aef\u53e3<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;remove-port&#061;5900\/tcp<\/span><\/p>\n<h5>masquerade \u7ba1\u7406<\/h5>\n<p>\u7f51\u7edc\u62d3\u6251&#xff1a;<\/p>\n<ul>\n<li>server: 10.1.1.10\u300110.1.8.10&#xff08;\u53ef\u4ee5\u8bbf\u95ee\u516c\u7f51&#xff09;<\/li>\n<li>client&#xff1a;10.1.1.11 \u7f51\u5173 10.1.1.10<\/li>\n<\/ul>\n<p>\u9700\u6c42&#xff1a;\u786e\u4fddclient \u80fd\u8bbf\u95ee\u516c\u7f51\u3002<\/p>\n<p>\u73af\u5883\u51c6\u5907&#xff1a;<\/p>\n<p>server \u589e\u52a0\u4e00\u5757\u5173\u8054vmnet1\u6a21\u5f0f\u7684\u7f51\u5361<\/p>\n<p><span class=\"token punctuation\">[<\/span>root&#064;server ~ <span class=\"token number\">16<\/span>:00:32<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># nmcli device <\/span><br \/>\nDEVICE      TYPE      STATE                       CONNECTION<br \/>\nens33       ethernet  \u5df2\u8fde\u63a5                      ens33<br \/>\nvirbr0      bridge    \u5df2\u8fde\u63a5                      virbr0<br \/>\nens35       ethernet  \u8fde\u63a5\u4e2d&#xff08;\u6b63\u5728\u83b7\u53d6 IP \u914d\u7f6e&#xff09;  \u6709\u7ebf\u8fde\u63a5 <span class=\"token number\">1<\/span><br \/>\nlo          loopback  \u672a\u6258\u7ba1                      &#8212;<br \/>\nvirbr0-nic  tun       \u672a\u6258\u7ba1                      &#8212;         <\/p>\n<p><span class=\"token punctuation\">[<\/span>root&#064;server ~ <span class=\"token number\">16<\/span>:00:39<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># nmcli connection show<\/span><br \/>\nNAME        UUID                                  TYPE      DEVICE<br \/>\n\u6709\u7ebf\u8fde\u63a5 <span class=\"token number\">1<\/span>  d4aee466-961c-3f52-b2d1-6e9a8fd92285  ethernet  ens35<br \/>\nens33       688ddc36-06c4-4392-bcf5-56ad860443c9  ethernet  ens33<br \/>\nvirbr0      919f64bb-a73c-40a9-b112-a9068d21b5f2  bridge    virbr0 <\/p>\n<p><span class=\"token punctuation\">[<\/span>root&#064;server ~ <span class=\"token number\">16<\/span>:00:55<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># nmcli connection delete \u6709\u7ebf\u8fde\u63a5\\\\ 1 <\/span><br \/>\n\u6210\u529f\u5220\u9664\u8fde\u63a5 <span class=\"token string\">&#034;\u6709\u7ebf\u8fde\u63a5 1&#034;<\/span> <span class=\"token punctuation\">(<\/span>d4aee466-961c-3f52-b2d1-6e9a8fd92285<span class=\"token punctuation\">)<\/span>\u3002<\/p>\n<p><span class=\"token punctuation\">[<\/span>root&#064;server ~ <span class=\"token number\">16<\/span>:01:12<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># nmcli connection add type ethernet ifname ens35 con-name ens35 ipv4.method manual ipv4.addresses 10.1.1.10\/24<\/span><br \/>\n\u8fde\u63a5 <span class=\"token string\">&#034;ens35&#034;<\/span> <span class=\"token punctuation\">(<\/span>1e4bfff4-3b57-4f88-ad03-5d1cf132c7d3<span class=\"token punctuation\">)<\/span> \u5df2\u6210\u529f\u6dfb\u52a0\u3002<\/p>\n<p><span class=\"token punctuation\">[<\/span>root&#064;server ~ <span class=\"token number\">16<\/span>:01:55<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># nmcli connection up ens35<\/span><br \/>\n\u8fde\u63a5\u5df2\u6210\u529f\u6fc0\u6d3b&#xff08;D-Bus \u6d3b\u52a8\u8def\u5f84&#xff1a;\/org\/freedesktop\/NetworkManager\/ActiveConnection\/8&#xff09;<\/p>\n<p>client \u7f51\u5361\u6a21\u5f0f\u66f4\u6539\u4e3avmnet1&#xff08;\u4ec5\u4e3b\u673a&#xff09;<\/p>\n<p><span class=\"token punctuation\">[<\/span>root&#064;client ~ <span class=\"token number\">16<\/span>:10:22<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># nmcli connection modify ens33 ipv4.addresses 10.1.1.11\/24 ipv4.gateway 10.1.1.10<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;client ~ <span class=\"token number\">16<\/span>:10:22<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># nmcli connection up ens33<\/span><\/p>\n<p>\u914d\u7f6e\u4f2a\u88c5&#xff1a;SNAT<\/p>\n<p><span class=\"token comment\"># \u67e5\u770bmasquerade\u662f\u5426\u542f\u52a8<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;server ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;query-masquerade <\/span><br \/>\nno<\/p>\n<p><span class=\"token comment\"># \u542f\u52a8 masquerade<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;server ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;add-masquerade <\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;server ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;query-masquerade<\/span><br \/>\n<span class=\"token function\">yes<\/span><\/p>\n<p><span class=\"token comment\"># \u7981\u7528masquerade<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;server ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;remove-masquerade<\/span><\/p>\n<p>client \u9a8c\u8bc1<\/p>\n<p><span class=\"token punctuation\">[<\/span>root&#064;client ~ <span class=\"token number\">16<\/span>:30:22<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># mtr 1.1.1.1<\/span><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/08\/20260814074946-6a7ec89a3e3af.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/> <img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/08\/20260814074946-6a7ec89a7f01b.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<p>\u8865\u5145&#xff1a;\u666e\u901a\u4e3b\u673a\u548c\u8def\u7531\u5668\u533a\u522b\u3002<\/p>\n<ul>\n<li>\u666e\u901a\u4e3b\u673a&#xff1a;\u76ee\u7684\u5730\u4e0d\u662f\u6211\u7684\u6570\u636e\u5305&#xff0c;\u4e22\u5f03\u3002<\/li>\n<li>\u8def\u7531\u5668&#xff1a;\u76ee\u7684\u5730\u4e0d\u662f\u6211\u7684\u6570\u636e\u5305&#xff0c;\u6839\u636e\u8def\u7531\u8868\u8fdb\u884c\u8f6c\u53d1\u3002<\/li>\n<\/ul>\n<h5>forward-port \u7ba1\u7406<\/h5>\n<p>\u4f7f\u7528 port forward\u524d&#xff0c;\u786e\u4fdd\u5bf9\u5e94zone\u542f\u7528masquerade\u529f\u80fd\u3002<\/p>\n<p><span class=\"token comment\"># \u542f\u52a8 masquerade<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;add-masquerade <\/span><\/p>\n<p><span class=\"token comment\"># \u6dfb\u52a0\u7aef\u53e3\u8f6c\u53d1\u8bed\u6cd5&#xff1a;<\/span><br \/>\n&#8211;add-forward-port<span class=\"token operator\">&#061;<\/span>port<span class=\"token operator\">&#061;<\/span>portid<span class=\"token punctuation\">[<\/span>-portid<span class=\"token punctuation\">]<\/span>:proto<span class=\"token operator\">&#061;<\/span>protocol<span class=\"token punctuation\">[<\/span>:toport<span class=\"token operator\">&#061;<\/span>portid<span class=\"token punctuation\">[<\/span>-portid<span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">[<\/span>:toaddr<span class=\"token operator\">&#061;<\/span>address<span class=\"token punctuation\">[<\/span>\/mask<span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">]<\/span><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/08\/20260814074947-6a7ec89b1be3f.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<p><span class=\"token comment\"># \u8bbf\u95ee\u672c\u673a\u7aef\u53e38000\u8f6c\u53d1\u5230\u672c\u673a80<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;add-forward-port&#061;port&#061;8000:proto&#061;tcp:toport&#061;80<\/span><\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u662f\u5426\u5177\u6709\u7279\u5b9a\u7aef\u53e3\u8f6c\u53d1\u89c4\u5219<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;query-forward-port&#061;port&#061;8000:proto&#061;tcp:toport&#061;80<\/span><br \/>\n<span class=\"token function\">yes<\/span><\/p>\n<p><span class=\"token comment\"># \u8bbf\u95ee\u672c\u673a\u7aef\u53e31022\u8f6c\u53d1\u523010.1.1.11:22<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;add-forward-port&#061;port&#061;1022:proto&#061;tcp:toport&#061;22:toaddr&#061;10.1.1.11<\/span><\/p>\n<p><span class=\"token comment\"># \u67e5\u8be2\u7aef\u53e3\u8f6c\u53d1\u6e05\u5355<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;list-forward-ports <\/span><br \/>\n<span class=\"token assign-left variable\">port<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token number\">8000<\/span>:proto<span class=\"token operator\">&#061;<\/span>tcp:toport<span class=\"token operator\">&#061;<\/span><span class=\"token number\">80<\/span>:toaddr<span class=\"token operator\">&#061;<\/span><br \/>\n<span class=\"token assign-left variable\">port<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token number\">1022<\/span>:proto<span class=\"token operator\">&#061;<\/span>tcp:toport<span class=\"token operator\">&#061;<\/span><span class=\"token number\">22<\/span>:toaddr<span class=\"token operator\">&#061;<\/span><span class=\"token number\">10.1<\/span>.1.11<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/08\/20260814074947-6a7ec89b32c6d.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<p><span class=\"token comment\"># \u5220\u9664\u7aef\u53e3\u8f6c\u53d1<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;remove-forward-port&#061;port&#061;8000:proto&#061;tcp:toport&#061;80:toaddr&#061;<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;remove-forward-port&#061;port&#061;1022:proto&#061;tcp:toport&#061;22:toaddr&#061;10.1.8.80<\/span><\/p>\n<h5>icmp-block-inversion \u7ba1\u7406<\/h5>\n<ul>\n<li>\n<p>icmp-block-inversion\u9ed8\u8ba4\u4e3ano&#xff0c;\u653e\u884c\u6240\u6709\u7684icmp type\u3002\u6b64\u65f6\u53ef\u4ee5\u901a\u8fc7\u5bcc\u89c4\u5219\u7981\u7528\u7279\u5b9a\u4e3b\u673aping\u672c\u673a\u3002<\/p>\n<\/li>\n<li>\n<p>icmp-block-inversion\u8bbe\u7f6e\u4e3ayes&#xff0c;\u7981\u6b62\u6240\u6709\u7684icmp type\u3002\u6b64\u65f6\u53ef\u4ee5\u901a\u8fc7\u5bcc\u89c4\u5219\u653e\u884c\u7279\u5b9a\u4e3b\u673aping\u672c\u673a\u3002<\/p>\n<\/li>\n<\/ul>\n<p><span class=\"token comment\"># \u67e5\u770bicmp-block-inversion\u662f\u5426\u542f\u7528<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;query-icmp-block-inversion <\/span><br \/>\nno<\/p>\n<p><span class=\"token comment\"># \u8bbe\u7f6eicmp-block-inversion\u4e3ayes<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;add-icmp-block-inversion <\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;add-icmp-block-inversion &#8211;permanent<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;query-icmp-block-inversion <\/span><br \/>\n<span class=\"token function\">yes<\/span><\/p>\n<p><span class=\"token comment\"># \u5ba2\u6237\u7aefping\u6d4b\u8bd5<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>c:<span class=\"token punctuation\">\\\\<\/span>~<span class=\"token punctuation\">]<\/span>$ <span class=\"token function\">ping<\/span> <span class=\"token parameter variable\">-n<\/span> <span class=\"token number\">1<\/span> <span class=\"token number\">10.1<\/span>.8.88<\/p>\n<p>\u6b63\u5728 Ping <span class=\"token number\">10.1<\/span>.8.88 \u5177\u6709 <span class=\"token number\">32<\/span> \u5b57\u8282\u7684\u6570\u636e:<br \/>\n\u6765\u81ea <span class=\"token number\">10.1<\/span>.8.88 \u7684\u56de\u590d: \u65e0\u6cd5\u8bbf\u95ee\u76ee\u6807\u4e3b\u673a\u3002<\/p>\n<p><span class=\"token number\">10.1<\/span>.8.88 \u7684 Ping \u7edf\u8ba1\u4fe1\u606f:<br \/>\n    \u6570\u636e\u5305: \u5df2\u53d1\u9001 <span class=\"token operator\">&#061;<\/span> <span class=\"token number\">1<\/span>&#xff0c;\u5df2\u63a5\u6536 <span class=\"token operator\">&#061;<\/span> <span class=\"token number\">1<\/span>&#xff0c;\u4e22\u5931 <span class=\"token operator\">&#061;<\/span> <span class=\"token number\">0<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token number\">0<\/span>% \u4e22\u5931<span class=\"token punctuation\">)<\/span>&#xff0c;<\/p>\n<p><span class=\"token comment\"># \u7531\u4e8efirewalld\u4f1a\u4fdd\u7559\u4e4b\u524d\u7684\u8fde\u63a5\u72b6\u6001&#xff0c;\u5982\u679c\u6b64\u65f6\u4ecd\u80fdping\u901a&#xff0c;<\/span><br \/>\n<span class=\"token comment\"># \u5219\u9700\u8981\u91cd\u542ffirewalld\u670d\u52a1\u6216\u4f7f\u7528\u9009\u9879 &#8211;complete-reload\u5f7b\u5e95\u91cd\u65b0\u52a0\u8f7d\u9632\u706b\u5899\u89c4\u5219\u3002<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;complete-reload <\/span><\/p>\n<p><span class=\"token comment\"># \u6539\u56de\u9ed8\u8ba4\u503c<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;remove-icmp-block-inversion<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;remove-icmp-block-inversion &#8211;permanent<\/span><\/p>\n<h5>icmp-blocks \u7ba1\u7406<\/h5>\n<p><span class=\"token comment\"># \u67e5\u770b\u7cfb\u7edf\u4e2d\u9884\u5b9a\u4e49\u4e86\u54ea\u4e9bicmptypes<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;get-icmptypes<\/span><br \/>\n<span class=\"token comment\"># \u5e38\u7528\u7684ICMP\u7c7b\u578b\u6709<\/span><br \/>\n<span class=\"token comment\">#   echo-request&#xff1a;icmp\u8bf7\u6c42\u62a5\u6587<\/span><br \/>\n<span class=\"token comment\">#   echo-reply&#xff1a;icmp\u54cd\u5e94\u56de\u590d\u62a5\u6587<\/span><\/p>\n<p><span class=\"token comment\"># \u6dfb\u52a0\u7981\u6b62\u901a\u8fc7\u7684icmp\u7c7b\u578b&#xff0c;\u4f8b\u5982\u901a\u8fc7\u6dfb\u52a0echo-request\u5b9e\u73b0\u7981\u6b62ping<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;add-icmp-block echo-request<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;add-icmp-block echo-request &#8211;permanent <\/span><\/p>\n<p><span class=\"token comment\"># \u67e5\u770b icmp-block \u7981\u6b62\u6e05\u5355<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;list-icmp-blocks <\/span><br \/>\necho-request<\/p>\n<p><span class=\"token comment\"># \u67e5\u770becho-request\u662f\u5426\u6dfb\u52a0<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;query-icmp-block echo-request<\/span><br \/>\n<span class=\"token function\">yes<\/span><\/p>\n<p><span class=\"token comment\"># \u5ba2\u6237\u7aefping\u6d4b\u8bd5<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>c:<span class=\"token punctuation\">\\\\<\/span>~<span class=\"token punctuation\">]<\/span>$ <span class=\"token function\">ping<\/span> <span class=\"token parameter variable\">-n<\/span> <span class=\"token number\">1<\/span> <span class=\"token number\">10.1<\/span>.8.88<\/p>\n<p>\u6b63\u5728 Ping <span class=\"token number\">10.1<\/span>.8.88 \u5177\u6709 <span class=\"token number\">32<\/span> \u5b57\u8282\u7684\u6570\u636e:<br \/>\n\u6765\u81ea <span class=\"token number\">10.1<\/span>.8.88 \u7684\u56de\u590d: \u65e0\u6cd5\u8bbf\u95ee\u76ee\u6807\u4e3b\u673a\u3002<\/p>\n<p><span class=\"token number\">10.1<\/span>.8.88 \u7684 Ping \u7edf\u8ba1\u4fe1\u606f:<br \/>\n    \u6570\u636e\u5305: \u5df2\u53d1\u9001 <span class=\"token operator\">&#061;<\/span> <span class=\"token number\">1<\/span>&#xff0c;\u5df2\u63a5\u6536 <span class=\"token operator\">&#061;<\/span> <span class=\"token number\">1<\/span>&#xff0c;\u4e22\u5931 <span class=\"token operator\">&#061;<\/span> <span class=\"token number\">0<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token number\">0<\/span>% \u4e22\u5931<span class=\"token punctuation\">)<\/span>&#xff0c;<\/p>\n<p><span class=\"token comment\"># \u7531\u4e8efirewalld\u4f1a\u4fdd\u7559\u4e4b\u524d\u7684\u8fde\u63a5\u72b6\u6001&#xff0c;\u5982\u679c\u6b64\u65f6\u4ecd\u80fdping\u901a&#xff0c;<\/span><br \/>\n<span class=\"token comment\"># \u5219\u9700\u8981\u91cd\u542ffirewalld\u670d\u52a1\u6216\u4f7f\u7528\u9009\u9879 &#8211;complete-reload\u5f7b\u5e95\u91cd\u65b0\u52a0\u8f7d\u9632\u706b\u5899\u89c4\u5219\u3002<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;complete-reload <\/span><\/p>\n<p><span class=\"token comment\"># \u6539\u56de\u9ed8\u8ba4\u503c<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;remove-icmp-block echo-request <\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;remove-icmp-block echo-request  &#8211;permanent <\/span><\/p>\n<h5>protocol \u7ba1\u7406<\/h5>\n<p><span class=\"token comment\"># \u6dfb\u52a0protocol<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;add-protocol&#061;icmp<\/span><\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u653e\u884cprotocol\u6e05\u5355<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;list-protocol<\/span><br \/>\nicmp<\/p>\n<p><span class=\"token comment\"># \u67e5\u770bprotocol\u662f\u5426\u653e\u884c<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;query-protocol&#061;icmp<\/span><br \/>\n<span class=\"token function\">yes<\/span><\/p>\n<p><span class=\"token comment\"># \u5220\u9664\u653e\u884cprotocol<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;remove-protocol&#061;icmp<\/span><\/p>\n<h5>source-ports \u7ba1\u7406<\/h5>\n<p>\u9650\u5236\u5ba2\u6237\u7aef source-ports&#xff0c;\u5f88\u5c11\u7528&#xff0c;\u8bbe\u7f6e\u65b9\u6cd5\u540c source\u7ba1\u7406 \u90e8\u5206\u3002<\/p>\n<h5>rich rule \u7ba1\u7406<\/h5>\n<p>\u5bcc\u89c4\u5219\u53ef\u7075\u6d3b\u81ea\u5b9a\u4e49\u5404\u79cd\u89c4\u5219&#xff0c;\u4f8b\u5982&#xff1a;<\/p>\n<ul>\n<li>\u5141\u8bb8\u5355\u4e2aIP\u5730\u5740\u6216\u8005\u7f51\u6bb5\u8fde\u63a5\u5230\u67d0\u4e2a\u670d\u52a1<\/li>\n<li>\u914d\u7f6e\u8bb0\u5f55\u548c\u5ba1\u8ba1<\/li>\n<li>\u9650\u5236\u901f\u7387<\/li>\n<\/ul>\n<p>\u5bcc\u89c4\u5219\u53c2\u8003 firewalld.richlanguage(5)\u3002<\/p>\n<p>\u5bcc\u89c4\u5219\u8bed\u6cd5&#xff1a;<\/p>\n<p>rule<br \/>\n  <span class=\"token punctuation\">[<\/span>source<span class=\"token punctuation\">]<\/span><br \/>\n  <span class=\"token punctuation\">[<\/span>destination<span class=\"token punctuation\">]<\/span><br \/>\n  <span class=\"token function\">service<\/span><span class=\"token operator\">|<\/span>port<span class=\"token operator\">|<\/span>protocol<span class=\"token operator\">|<\/span>icmp-block<span class=\"token operator\">|<\/span>icmp-type<span class=\"token operator\">|<\/span>masquerade<span class=\"token operator\">|<\/span>forward-port<span class=\"token operator\">|<\/span>source-port<br \/>\n  <span class=\"token punctuation\">[<\/span>log<span class=\"token punctuation\">]<\/span><br \/>\n  <span class=\"token punctuation\">[<\/span>audit<span class=\"token punctuation\">]<\/span><br \/>\n  <span class=\"token punctuation\">[<\/span>accept<span class=\"token operator\">|<\/span>reject<span class=\"token operator\">|<\/span>drop<span class=\"token operator\">|<\/span>mark<span class=\"token punctuation\">]<\/span><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/08\/20260814074948-6a7ec89c36ea4.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<p>**\u793a\u4f8b1&#xff1a;**\u7981\u6b62\u6240\u6709\u4e3b\u673aping\u672c\u673a\u3002<\/p>\n<p><span class=\"token comment\"># \u6dfb\u52a0\u5bcc\u89c4\u5219<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;add-rich-rule&#061;&#039;rule protocol value&#061;icmp drop&#039;<\/span><\/p>\n<p><span class=\"token comment\"># \u660e\u786e\u62d2\u7edd\u7c7b\u578b<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;add-rich-rule&#061;&#039;rule family&#061;ipv4 protocol value&#061;icmp reject type&#061;net-prohib&#039;<\/span><\/p>\n<p><span class=\"token comment\"># \u51b3\u7edd\u7c7b\u578b\u5305\u62ec&#xff1a;<\/span><br \/>\n<span class=\"token comment\"># icmp-host-prohibited, host-prohib, icmp-net-unreachable, net-unreach, icmp-host-unreachable, host-unreach, icmp-port-unreachable, port-unreach, icmp-proto-unreachable, proto-unreach, icmp-net-prohibited, net-prohib, tcp-reset, tcp-rst, icmp-admin-prohibited, admin-prohib<\/span><\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u5bcc\u89c4\u5219\u6e05\u5355<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;list-rich-rules <\/span><br \/>\nrule protocol <span class=\"token assign-left variable\">value<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;icmp&#034;<\/span> drop<\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u5bcc\u89c4\u5219\u662f\u5426\u6dfb\u52a0<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;query-rich-rule&#061;&#039;rule protocol value&#061;icmp drop&#039;<\/span><br \/>\n<span class=\"token function\">yes<\/span><\/p>\n<p><span class=\"token comment\"># \u5220\u9664\u5bcc\u89c4\u5219<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;remove-rich-rule&#061;&#039;rule protocol value&#061;&#034;icmp&#034; drop&#039;<\/span><\/p>\n<p>\u793a\u4f8b2&#xff1a;<\/p>\n<ul>\n<li>\u9488\u5bf9IPv4<\/li>\n<li>\u6765\u6e90\u4e3b\u673a10.1.8.10<\/li>\n<li>\u5141\u8bb8ping\u672c\u673a<\/li>\n<\/ul>\n<p><span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;add-rich-rule&#061;&#039;rule family&#061;ipv4 source address&#061;&#034;10.1.8.10&#034; icmp-type name&#061;&#034;echo-request&#034; accept&#039;<\/span><\/p>\n<p>\u793a\u4f8b3&#xff1a;<\/p>\n<ul>\n<li>\u9488\u5bf9IPv4<\/li>\n<li>\u6765\u6e9010.1.8.0\/24\u7f51\u6bb5\u4e2d\u4e3b\u673a<\/li>\n<li>\u8bbf\u95ee\u975e172.16.0.0\/24\u7f51\u6bb5\u4e2d\u4e3b\u673a\u7684http\u670d\u52a1<\/li>\n<li>1\u79d2\u4e2d\u53ea\u5141\u8bb8\u8bbf\u95ee3\u6b21<\/li>\n<li>\u505a\u597d\u65e5\u5fd7\u8bb0\u5f55&#xff0c;\u524d\u7f00\u4e3a&#034; http-error \u201c&#xff0c;\u65e5\u5fd7\u7ea7\u522b\u4e3a&#034;error\u201d&#xff0c;\u6bcf\u79d2\u8bb0\u5f552\u6b21<\/li>\n<li>\u505a\u597d\u5ba1\u8ba1&#xff0c;\u6bcf\u79d2\u8bb0\u5f551\u6b21<\/li>\n<\/ul>\n<p><span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;add-rich-rule &#039;rule family&#061;&#034;ipv4&#034; source address&#061;&#034;10.1.8.0\/24&#034; destination not address&#061;&#034;172.16.0.0\/24&#034; service name&#061;&#034;http&#034; log prefix&#061;&#034; http-error &#034; level&#061;&#034;error&#034; limit value&#061;&#034;2\/s&#034; audit limit value&#061;&#034;1\/s&#034; accept limit value&#061;&#034;3\/s&#034;&#039;<\/span><\/p>\n<h5>direct rule \u7ba1\u7406<\/h5>\n<p>Firewalld \u9632\u706b\u5899\u8fd8\u652f\u6301\u76f4\u63a5\u89c4\u5219&#xff1a;<\/p>\n<ul>\n<li>\u76f4\u63a5\u89c4\u5219\u4f18\u5148\u7ea7\u9ad8\u4e8efirewalld\u89c4\u5219&#xff0c;\u5373\u9632\u706b\u5899\u89e3\u6790\u76f4\u63a5\u89c4\u5219&#xff0c; \u7136\u540e\u624d\u4f1a\u89e3\u6790firewalld\u89c4\u5219\u3002\u8fd8\u53ef\u4ee5\u663e\u5f0f\u5730\u5c06\u76f4\u63a5\u89c4\u5219\u63d2\u5165\u5230\u67d0\u4e2a\u533a\u57df\u3002<\/li>\n<li>**\u76f4\u63a5\u89c4\u5219\u7528\u4e8e\u8865\u5145firewalld\u89c4\u5219\u3002**\u4f7f\u7528firewalld\u89c4\u5219\u80fd\u5b9e\u73b0\u7684\u9700\u6c42&#xff0c;\u5c3d\u53ef\u80fd\u4f7f\u7528firewalld\u89c4\u5219\u5b9e\u73b0\u3002<\/li>\n<li>\u76f4\u63a5\u89c4\u5219\u7684\u8bed\u6cd5&#xff0c;\u7c7b\u4f3c\u4e8eiptable\u7684\u8bed\u6cd5&#xff0c;\u6240\u4ee5\u8bfb\u8005\u9700\u8981\u77e5\u9053iptables\u6982\u5ff5&#xff1a;\n<ul>\n<li>table (filter\/mangle\/nat\/\u2026)<\/li>\n<li>chain (INPUT\/OUTPUT\/FORWARD\/\u2026)<\/li>\n<li>commands (-A\/-D\/-I\/\u2026)<\/li>\n<li>parameters (-p\/-s\/-d\/-j\/\u2026)<\/li>\n<li>targets (ACCEPT\/DROP\/REJECT\/\u2026).<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>\u5e38\u89c1\u9009\u9879&#xff1a;<\/p>\n<ul>\n<li>\n<p>[\u2013permanent] &#8211;direct &#8211;get-all-chains<\/p>\n<p>\u67e5\u770b\u6240\u6709\u8868\u4e2d\u6240\u6709chain\u6e05\u5355<\/p>\n<\/li>\n<li>\n<p>[\u2013permanent] &#8211;direct &#8211;get-chains { ipv4 | ipv6 | eb } table<\/p>\n<p>\u67e5\u770b\u7279\u5b9a\u8868\u4e2dchain\u6e05\u5355<\/p>\n<\/li>\n<li>\n<p>[\u2013permanent] &#8211;direct &#8211;add-chain { ipv4 | ipv6 | eb } table chain<\/p>\n<p>\u7279\u5b9a\u8868\u4e2d\u6dfb\u52a0chain<\/p>\n<\/li>\n<li>\n<p>[\u2013permanent] &#8211;direct &#8211;remove-chain { ipv4 | ipv6 | eb } table chain<\/p>\n<p>\u7279\u5b9a\u8868\u4e2d\u5220\u9664chain<\/p>\n<\/li>\n<li>\n<p>[\u2013permanent] &#8211;direct &#8211;get-all-rules<\/p>\n<p>\u67e5\u770b\u6240\u6709\u8868\u4e2d\u6240\u6709chain\u4e2d\u6240\u6709\u89c4\u5219<\/p>\n<\/li>\n<li>\n<p>[\u2013permanent] &#8211;direct &#8211;get-rules { ipv4 | ipv6 | eb } table chain<\/p>\n<p>\u67e5\u770b\u7279\u5b9a\u8868\u4e2d\u7279\u5b9achain\u4e2d\u89c4\u5219<\/p>\n<\/li>\n<li>\n<p>[\u2013permanent] &#8211;direct &#8211;add-rule { ipv4 | ipv6 | eb } table chain priority args<\/p>\n<p>\u7279\u5b9a\u8868\u4e2d\u7279\u5b9achain\u4e2d\u6dfb\u52a0\u89c4\u5219<\/p>\n<\/li>\n<li>\n<p>[\u2013permanent] &#8211;direct &#8211;remove-rule { ipv4 | ipv6 | eb } table chain priority args<\/p>\n<p>\u7279\u5b9a\u8868\u4e2d\u7279\u5b9achain\u4e2d\u5220\u9664\u89c4\u5219<\/p>\n<\/li>\n<li>\n<p>[\u2013permanent] &#8211;direct &#8211;remove-rules { ipv4 | ipv6 | eb } table chain<\/p>\n<p>\u5220\u9664\u7279\u5b9a\u8868\u4e2d\u7279\u5b9achain\u4e2d\u6240\u6709\u89c4\u5219<\/p>\n<\/li>\n<\/ul>\n<p>**\u793a\u4f8b&#xff1a;**\u5c06192.168.0.0\/24\u5217\u5165\u9ed1\u540d\u5355&#xff0c;\u5355\u4e2aIP\u6bcf\u5206\u949f\u6700\u9ad8\u8fde\u63a5\u5e76\u53d1\u662f1&#xff0c;\u8d85\u8fc7\u5e76\u53d1\u7684\u8fde\u63a5\u90fd\u4e22\u5f03\u3002<\/p>\n<p><span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;direct &#8211;permanent &#8211;add-chain ipv4 raw blacklist<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;direct &#8211;permanent &#8211;add-rule ipv4 raw PREROUTING 0 -s 192.168.0.0\/24 -j blacklist     <\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;direct &#8211;permanent &#8211;add-rule ipv4 raw blacklist 0 -m limit &#8211;limit 1\/min -j LOG &#8211;log-prefix &#034;blacklisted &#034;<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;direct &#8211;permanent &#8211;add-rule ipv4 raw blacklist 1 -j DROP<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;reload<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;direct &#8211;get-all-rules<\/span><br \/>\nipv4 raw PREROUTING <span class=\"token number\">0<\/span> <span class=\"token parameter variable\">-s<\/span> <span class=\"token number\">192.168<\/span>.0.0\/24 <span class=\"token parameter variable\">-j<\/span> blacklist<br \/>\nipv4 raw blacklist <span class=\"token number\">0<\/span> <span class=\"token parameter variable\">-m<\/span> limit <span class=\"token parameter variable\">&#8211;limit<\/span> <span class=\"token number\">1<\/span>\/min <span class=\"token parameter variable\">-j<\/span> LOG &#8211;log-prefix <span class=\"token string\">&#039;blacklisted &#039;<\/span><br \/>\nipv4 raw blacklist <span class=\"token number\">1<\/span> <span class=\"token parameter variable\">-j<\/span> DROP<\/p>\n<p>\u6e05\u7406\u89c4\u5219<\/p>\n<p><span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;permanent &#8211;direct &#8211;remove-rules ipv4 raw blacklist<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;permanent &#8211;direct &#8211;remove-rules ipv4 raw PREROUTING<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;direct &#8211;remove-rules ipv4 raw blacklist<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;direct &#8211;remove-rules ipv4 raw PREROUTING<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;direct &#8211;remove-chain ipv4 raw blacklist<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;reload<\/span><\/p>\n<h5>panic \u6a21\u5f0f<\/h5>\n<ul>\n<li>\u4f7f\u7528\u9009\u9879 **\u2013panic-on&#xff0c;\u542f\u7528panic\u6a21\u5f0f&#xff0c;\u6240\u6709\u8fdb\u51fa\u6d41\u91cf\u5c06\u4f1a\u88ab\u4e22\u5f03\u3002**\u4e00\u822c\u670d\u52a1\u5668\u88ab\u9ed1\u5ba2\u653b\u51fb&#xff0c;\u4f7f\u7528\u8be5\u9009\u9879\u65ad\u5f00\u6240\u6709\u7f51\u7edc\u3002<\/li>\n<li>\u4f7f\u7528\u9009\u9879 &#8211;query-panic&#xff0c;\u67e5\u8be2panic\u6a21\u5f0f\u3002<\/li>\n<li>\u4f7f\u7528\u9009\u9879 &#8211;panic-off&#xff0c;\u7981\u7528panic\u6a21\u5f0f\u3002<\/li>\n<\/ul>\n<h5>\u5176\u4ed6\u914d\u7f6e<\/h5>\n<p><span class=\"token comment\"># \u4f7f\u7528\u9009\u9879&#8211;runtime-to-permanent\u5c06\u8fd0\u884c\u65f6\u7684\u914d\u7f6e\u5199\u5165\u5230\u914d\u7f6e\u6587\u4ef6<\/span><br \/>\nroot&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;runtime-to-permanent<\/span><\/p>\n<p><span class=\"token comment\"># \u4f7f\u7528\u9009\u9879 &#8211;timeout\u8bbe\u7f6e\u89c4\u5219\u751f\u6548\u65f6\u95f4&#xff0c;\u5355\u4f4d\u79d2&#xff0c;\u4e00\u822c\u7528\u4e8e\u8c03\u8bd5\u89c4\u5219\u3002<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;add-service&#061;http &#8211;timeout&#061;10<\/span><\/p>\n<h5>\u7efc\u5408\u6848\u4f8b<\/h5>\n<p>\u6848\u4f8b1&#xff1a; \u7981\u6b6210.1.8.10\u4e3b\u673aping\u672c\u673a\u3002<\/p>\n<p><span class=\"token comment\"># \u786e\u4fddicmp-block-inversion\u662f\u9ed8\u8ba4\u503cno<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;list-all|grep inversion<\/span><br \/>\n  icmp-block-inversion: no<br \/>\n<span class=\"token comment\"># \u5982\u679cicmp-block-inversion\u662fyes&#xff0c;\u6267\u884c\u4ee5\u4e0b\u547d\u4ee4\u8bbe\u7f6e\u4e3ano<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;permanent &#8211;remove-icmp-block-inversion<\/span><\/p>\n<p><span class=\"token comment\"># \u786e\u4fddicmp-blocks\u4e0d\u5305\u542becho-request<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;list-icmp-blocks<\/span><br \/>\n<span class=\"token comment\"># \u5982\u679cicmp-blocks\u5305\u542becho-request&#xff0c;\u6267\u884c\u4ee5\u4e0b\u547d\u4ee4\u5220\u9664icmp-blocks\u4e2decho-request<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;permanent &#8211;remove-icmp-block&#061;echo-request<\/span><\/p>\n<p><span class=\"token comment\"># \u7981\u6b6210.1.8.10\u4e3b\u673aping\u672c\u673a<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;permanent &#8211;add-rich-rule&#061;&#039;rule family&#061;&#034;ipv4&#034; source address&#061;&#034;10.1.8.10&#034; icmp-type name&#061;&#034;echo-request&#034; reject&#039;<\/span><\/p>\n<p><span class=\"token comment\"># \u5f7b\u5e95\u91cd\u65b0\u52a0\u8f7d\u9632\u706b\u5899\u89c4\u5219<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;complete-reload<\/span><\/p>\n<p>**\u6848\u4f8b2&#xff1a;**\u53ea\u5141\u8bb810.1.8.10\u4e3b\u673aping\u672c\u673a\u3002<\/p>\n<p><span class=\"token comment\"># \u7981\u6b62\u6240\u6709\u6765\u6e90ping\u672c\u673a<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;permanent &#8211;add-icmp-block-inversion<\/span><\/p>\n<p><span class=\"token comment\"># \u5141\u8bb810.1.8.10\u4e3b\u673aping\u672c\u673a<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;permanent &#8211;add-rich-rule&#061;&#039;rule family&#061;ipv4 source address&#061;&#034;10.1.8.10&#034; icmp-type name&#061;&#034;echo-request&#034; accept&#039;<\/span><\/p>\n<p><span class=\"token comment\"># \u5f7b\u5e95\u91cd\u65b0\u52a0\u8f7d\u9632\u706b\u5899\u89c4\u5219<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># firewall-cmd &#8211;complete-reload<\/span><\/p>\n<p>**\u6848\u4f8b3&#xff1a;**\u901a\u8fc7\u5bcc\u89c4\u5219\u5b9e\u73b0 \u53ea\u5141\u8bb810.1.8.10\u4e3b\u673aping\u672c\u673a\u3002<\/p>\n<h4>firewall-config \u56fe\u5f62\u5de5\u5177<\/h4>\n<p>\u901a\u8fc7firewall-config\u547d\u4ee4&#xff0c;\u6253\u5f00\u9632\u706b\u5899\u56fe\u5f62\u7ba1\u7406\u5de5\u5177\u3002<\/p>\n<p>\u8be5\u754c\u9762\u53ef\u4ee5\u76f4\u89c2\u5730\u914d\u7f6e\u9632\u706b&#xff0c;\u6ce8\u610f\u9632\u706b\u5899\u7684\u914d\u7f6e\u72b6\u6001\u548c\u9009\u62e9\u7684\u533a\u57df\u3002<\/p>\n<p>\u9700\u8981\u5b89\u88c5\u7684\u8f6f\u4ef6\u5305&#xff1a;firewall-config\u3001xorg-x11-xauth\u3001libglvnd-glx<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/08\/20260814074948-6a7ec89c5b8f6.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<ul>\n<li>\n<p>\u9009\u9879\u83dc\u5355\u53ef\u6267\u884c\u5982\u4e0b\u64cd\u4f5c&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u91cd\u8f7d\u9632\u706b\u5899<\/p>\n<\/li>\n<li>\n<p>\u6539\u53d8\u9ed8\u8ba4\u533a\u57df<\/p>\n<\/li>\n<li>\n<p>\u5e94\u6025\u6a21\u5f0f<\/p>\n<\/li>\n<li>\n<p>\u5c06 Runtime \u8bbe\u5b9a\u4e3a\u6c38\u4e45\u914d\u7f6e<\/p>\n<\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/08\/20260814074948-6a7ec89cc2809.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<\/li>\n<li>\n<p>\u67e5\u770b\u83dc\u5355\u7528\u4e8e\u663e\u793a\u989d\u5916\u7684\u914d\u7f6e\u4fe1\u606f\u3002<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/08\/20260814074949-6a7ec89d2e135.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/08\/20260814074949-6a7ec89d84b32.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<\/li>\n<\/ul>\n<h5>\u670d\u52a1\u914d\u7f6e<\/h5>\n<p>\u52fe\u9009\u5bf9\u5e94\u670d\u52a1\u5373\u53ef&#xff0c;\u4f8b\u5982http\u3002<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/08\/20260814074949-6a7ec89de2d6d.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<h5>\u7aef\u53e3\u914d\u7f6e<\/h5>\n<p>\u5355\u51fb\u6dfb\u52a0\u3002<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/08\/20260814074950-6a7ec89e42bd9.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<p>\u8f93\u5165\u76f8\u5e94\u503c&#xff0c;\u4f8b\u5982tcp\/5900\u3002<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/08\/20260814074950-6a7ec89e998a3.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<p>\u6839\u636e\u9700\u8981\u8fdb\u884c \u7f16\u8f91 \u548c \u5220\u9664\u3002<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/08\/20260814074950-6a7ec89ead7ce.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<p>\u5355\u51fb\u6dfb\u52a0\u3002<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/08\/20260814074951-6a7ec89f1b6ba.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<p>\u8f93\u5165\u76f8\u5e94\u503c&#xff0c;\u4f8b\u5982icmp\u3002<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/08\/20260814074951-6a7ec89f6f882.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<p>\u6839\u636e\u9700\u8981\u8fdb\u884c \u7f16\u8f91 \u548c \u5220\u9664\u3002<\/p>\n<p><img decoding=\"async\" src=\"2026-08-14qwztgltn01n.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<h5>\u6e90\u7aef\u53e3\u914d\u7f6e<\/h5>\n<p>\u5355\u51fb\u6dfb\u52a0\u3002<\/p>\n<p><img decoding=\"async\" src=\"2026-08-14rmlaqiztjgt.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<p>\u8f93\u5165\u76f8\u5e94\u503c&#xff0c;\u4f8b\u5982tcp\/32760<\/p>\n<p><img decoding=\"async\" src=\"2026-08-14y5zboto3xnc.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<p>\u6839\u636e\u9700\u8981\u8fdb\u884c \u7f16\u8f91 \u548c \u5220\u9664\u3002<\/p>\n<p><img decoding=\"async\" src=\"2026-08-14lbhaah4hwnt.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<h5>\u4f2a\u88c5\u914d\u7f6e<\/h5>\n<p>\u901a\u8fc7\u52fe\u9009\u6216\u53d6\u6d88\u52fe\u9009&#xff0c;\u6765\u542f\u7528\u6216\u7981\u7528\u8be5\u533a\u57df\u4f2a\u88c5\u529f\u80fd\u3002<\/p>\n<p><img decoding=\"async\" src=\"2026-08-14agqwytxjufz.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<h5>\u7aef\u53e3\u8f6c\u53d1\u914d\u7f6e<\/h5>\n<p>\u5355\u51fb\u6dfb\u52a0\u3002<\/p>\n<p><img decoding=\"async\" src=\"2026-08-14jqbz4fqtcfe.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<p>\u8f93\u5165\u76f8\u5e94\u503c&#xff0c;\u4f8b\u5982&#xff1a;\u8bbf\u95ee\u672c\u57301022\u7aef\u53e3\u8f6c\u53d1\u523010.1.8.80:22\u3002<\/p>\n<p><img decoding=\"async\" src=\"2026-08-14aoqxcv5mpr3.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<p>\u6839\u636e\u9700\u8981\u8fdb\u884c \u7f16\u8f91 \u548c \u5220\u9664\u3002<\/p>\n<p><img decoding=\"async\" src=\"2026-08-14gxjzqpf1jpz.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<h5>ICMP\u8fc7\u6ee4\u914d\u7f6e<\/h5>\n<p>\u52fe\u9009\u5bf9\u5e94icmp\u7c7b\u578b\u5373\u53ef&#xff0c;\u4f8b\u5982echo-request\u3002<\/p>\n<p><img decoding=\"async\" src=\"2026-08-14o4kyzmnduqw.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<p>\u8f93\u5165\u76f8\u5e94\u503c&#xff0c;\u4f8b\u5982\u3002<\/p>\n<p>\u6839\u636e\u9700\u8981\u8fdb\u884c \u7f16\u8f91 \u548c \u5220\u9664\u3002<\/p>\n<h5>\u5bcc\u89c4\u5219\u914d\u7f6e<\/h5>\n<p>\u5355\u51fb\u6dfb\u52a0\u3002<\/p>\n<p><img decoding=\"async\" src=\"2026-08-14ebztsy1pqks.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<p>\u8f93\u5165\u76f8\u5e94\u503c&#xff0c;\u4f8b\u5982&#xff1a;<\/p>\n<p><img decoding=\"async\" src=\"2026-08-14pe0ygzjucez.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<p>\u6839\u636e\u9700\u8981\u8fdb\u884c \u7f16\u8f91 \u548c \u5220\u9664\u3002<\/p>\n<p><img decoding=\"async\" src=\"2026-08-145vdl5eqdhkw.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<h5>\u7f51\u5361\u914d\u7f6e<\/h5>\n<p>\u5355\u51fb\u6dfb\u52a0\u3002<\/p>\n<p><img decoding=\"async\" src=\"2026-08-14t44cwymjnbi.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<p>\u8f93\u5165\u76f8\u5e94\u503c&#xff0c;\u4f8b\u5982ens33\u3002<\/p>\n<p><img decoding=\"async\" src=\"2026-08-14a30ko0aviin.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<p>\u6839\u636e\u9700\u8981\u8fdb\u884c \u7f16\u8f91 \u548c \u5220\u9664\u3002<\/p>\n<p><img decoding=\"async\" src=\"2026-08-14t3qzc2ypi40.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<h5>\u6765\u6e90\u914d\u7f6e<\/h5>\n<p>\u5355\u51fb\u6dfb\u52a0\u3002<\/p>\n<p><img decoding=\"async\" src=\"2026-08-14lkixhz21ecd.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<p>\u8f93\u5165\u76f8\u5e94\u503c&#xff0c;\u4f8b\u5982192.168.1.0\/24\u3002<\/p>\n<p><img decoding=\"async\" src=\"2026-08-14455skhxk3qv.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<p><img decoding=\"async\" src=\"2026-08-14kptithyyzrv.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<p><img decoding=\"async\" src=\"2026-08-14aoihuenkn3y.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<p>\u6839\u636e\u9700\u8981\u8fdb\u884c \u7f16\u8f91 \u548c \u5220\u9664\u3002<\/p>\n<p><img decoding=\"async\" src=\"2026-08-14j32xz54shhp.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<h2>Linux \u7cfb\u7edf\u5b89\u5168\u52a0\u56fa<\/h2>\n<h3>SELinux \u4ecb\u7ecd<\/h3>\n<h4>SELinux \u6982\u8ff0<\/h4>\n<p>\u6587\u4ef6\u6743\u9650\u63a7\u5236\u4e86\u54ea\u4e9b\u7528\u6237\u6216\u7528\u6237\u7ec4\u53ef\u4ee5\u8bbf\u95ee\u54ea\u4e9b\u7279\u5b9a\u6587\u4ef6&#xff0c;\u4f46\u672a\u9650\u5b9a\u7528\u6237\u8bbf\u95ee\u6587\u4ef6\u7684\u65b9\u5f0f\u3002<\/p>\n<p>\u4f8b\u5982&#xff1a;\u5bf9\u4e8e\u6587\u4ef6\u7684\u5199\u5165\u6743\u9650\u800c\u8a00&#xff0c; \u7ed3\u6784\u5316\u6570\u636e\u6587\u4ef6\u662f\u5426\u5e94\u5f53\u8bbe\u8ba1\u4e3a\u53ea\u80fd\u4f7f\u7528\u7279\u5b9a\u7684\u7a0b\u5e8f\u5199\u5165&#xff0c;\u4f46\u5176\u4ed6\u7f16\u8f91\u5668\u4ecd\u53ef\u4ee5\u6253\u5f00\u548c\u4fee\u6539\u6b64\u6587\u4ef6&#xff0c;\u800c\u8fd9\u53ef\u80fd\u4f1a\u5bfc\u81f4\u635f\u574f\u3002\u6587\u4ef6\u6743\u9650\u4ec5\u4ec5\u662f\u63a7\u5236\u8c01\u53ef\u4ee5\u8bfb\u53d6\u3001\u5199\u5165\u6216\u8fd0\u884c\u6587\u4ef6&#xff0c;\u65e0\u6cd5\u63a7\u5236\u5982\u4f55\u4f7f\u7528\u6587\u4ef6\u3002<\/p>\n<p>Security Enhanced Linux (SELinux)\u662f\u4e00\u4e2a\u989d\u5916\u7684\u7cfb\u7edf\u5b89\u5168\u5c42&#xff0c;\u4e3b\u8981\u76ee\u6807\u662f\u9632\u6b62\u5df2\u906d\u6cc4\u9732\u7684\u7cfb\u7edf\u670d\u52a1\u8bbf\u95ee\u7528\u6237\u6570\u636e\u3002<\/p>\n<p>\u4f8b\u5982&#xff1a;\u6076\u610f\u4eba\u5458\u6210\u529f\u5165\u4fb5\u4e86 Web\u670d\u52a1\u5668\u8fdb\u7a0b&#xff0c;\u83b7\u5f97\u8fdb\u7a0b\u7684\u6743\u9650&#xff0c;\u4e5f\u5c31\u662fapache\u7528\u6237\u548capache\u7ec4\u7684\u6743\u9650\u3002\u8be5\u7528\u6237\u548c\u7ec4\u5bf9\u6587\u6863\u6839\u76ee\u5f55\/var\/www\/html\u5177\u6709\u8bfb\u53d6\u6743\u9650&#xff0c;\u8fd8\u53ef\u4ee5\u8bbf\u95ee\/tmp\u548c\/var\/tmp&#xff0c;\u4ee5\u53ca\u5168\u5c40\u53ef\u5199\u7684\u5176\u4ed6\u4efb\u4f55\u6587\u4ef6\u548c\u76ee\u5f55\u3002<\/p>\n<p>SELinux \u5f3a\u5236\u6267\u884c\u4e00\u7ec4\u8bbf\u95ee\u89c4\u5219&#xff0c;\u660e\u786e\u5b9a\u4e49\u8fdb\u7a0b\u548c\u8d44\u6e90\u4e4b\u95f4\u5141\u8bb8\u7684\u64cd\u4f5c\u3002\u6bcf\u4e2a\u8fdb\u7a0b\u3001\u6587\u4ef6\u3001\u76ee\u5f55\u548c\u7aef\u53e3\u90fd\u5177\u6709\u4e13\u95e8\u7684\u5b89\u5168\u6807\u7b7e&#xff0c; \u79f0\u4e3aSELinux\u4e0a\u4e0b\u6587\u3002\u4e0a\u4e0b\u6587\u662f\u4e00\u4e2a\u540d\u79f0&#xff0c; SELinux\u7b56\u7565\u4f7f\u7528\u5b83\u6765\u786e\u5b9a\u67d0\u4e2a\u8fdb\u7a0b\u80fd\u5426\u8bbf\u95ee\u6587\u4ef6\u3001\u76ee\u5f55\u6216\u7aef\u53e3\u3002\u9664\u975e\u663e\u5f0f\u89c4\u5219\u6388\u4e88\u8bbf\u95ee\u6743\u9650&#xff0c;\u5426\u5219&#xff0c;\u5728\u9ed8\u8ba4\u60c5\u51b5\u4e0b&#xff0c;\u7b56\u7565\u4e0d\u5141\u8bb8\u4efb\u4f55\u4ea4\u4e92\u3002<\/p>\n<p>SELinux \u6807\u7b7e\u6709\u591a\u4e2a\u5185\u5bb9&#xff1a;\u7528\u6237&#xff0c;\u89d2\u8272&#xff0c;\u7c7b\u578b\u548c\u654f\u611f\u5ea6\u3002rhel\u4e2d\u9ed8\u8ba4\u7b56\u7565targeted&#xff0c;\u57fa\u4e8e\u7c7b\u578b\u90e8\u5206\u3002\u7c7b\u578b\u90e8\u5206\u901a\u5e38\u4ee5_t\u7ed3\u5c3e\u3002<\/p>\n<p>\u793a\u4f8b&#xff1a;<\/p>\n<p><img decoding=\"async\" src=\"2026-08-14uo25rtmcchs.png\" alt=\"\u8bf7\u6dfb\u52a0\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<p>\u793a\u4f8b&#xff1a;<\/p>\n<ul>\n<li>web \u670d\u52a1\u5668\u5b88\u62a4\u8fdb\u7a0b\u7c7b\u578b\u662f httpd_exec_t<\/li>\n<li>web \u670d\u52a1\u5668\u7684\u7f51\u9875\u7c7b\u578b\u662f httpd_sys_content_t<\/li>\n<li>web \u670d\u52a1\u5668\u7684\u7aef\u53e3\u7c7b\u578b\u662f http_port_t<\/li>\n<li>\/tmp \u6807\u7b7e tmp_t<\/li>\n<\/ul>\n<h4>\u57fa\u672c\u539f\u7406<\/h4>\n<ul>\n<li>SELinux\u9ed8\u8ba4\u7b56\u7565\u5141\u8bb8apache\u8fdb\u7a0b\u8bbf\u95ee\u5728\/var\/www\/html\u6587\u4ef6\u5939\u4e0b\u7684\u6587\u4ef6\u548c\u6587\u4ef6\u5939&#xff0c;\u4ee5\u53ca\u5176\u4ed6\u4e00\u4e9b\u5177\u6709httpd_sys_content_t\u4e0a\u4e0b\u6587\u7684\u6587\u4ef6\u5939&#xff0c;\u7981\u6b62\u8bbf\u95ee\u5177\u6709\u5176\u4ed6\u4e0d\u5339\u914d\u6807\u7b7e\u7684\u76ee\u5f55\u3002<\/li>\n<li>\u5728 SELinux \u7684\u4fdd\u62a4\u4e0b&#xff0c;apache\u8fdb\u7a0b\u4e0d\u5141\u8bb8\u8bbf\u95ee\/tmp\u548c\/var\/tmp\u76ee\u5f55\u3002\u56e0\u4e3a\/tmp\u3001\/var\/tmp\u76ee\u5f55\u7684\u6807\u7b7e\u662ftmp_t&#xff0c;\u4e0e\u9ed8\u8ba4\u7b56\u7565\u4e0d\u5339\u914d\u3002<\/li>\n<\/ul>\n<h4>\u547d\u4ee4\u9009\u9879 -Z<\/h4>\n<p>\u8bb8\u591a\u5904\u7406\u6587\u4ef6\u7684\u547d\u4ee4\u90fd\u4e00\u4e2a-Z \u9009\u9879&#xff0c;\u7528\u4e8e\u663e\u793a\u548c\u8bbe\u7f6eSELinux\u4e0a\u4e0b\u6587\u3002<\/p>\n<p><span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># ps -C sshd -Z<\/span><br \/>\nLABEL                               PID TTY          TIME CMD<br \/>\nsystem_u:system_r:sshd_t:s0-s0:c0.c1023 <span class=\"token number\">951<\/span> ?    00:00:00 sshd<br \/>\nsystem_u:system_r:sshd_t:s0-s0:c0.c1023 <span class=\"token number\">1261<\/span> ?   00:00:00 sshd<br \/>\nunconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 <span class=\"token number\">1276<\/span> ? 00:00:00 sshd<br \/>\nsystem_u:system_r:sshd_t:s0-s0:c0.c1023 <span class=\"token number\">2455<\/span> ?   00:00:00 sshd<br \/>\nunconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 <span class=\"token number\">2459<\/span> ? 00:00:00 sshd<\/p>\n<p><span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># ls -Z \/home<\/span><br \/>\nunconfined_u:object_r:user_home_dir_t:s0 laoma<\/p>\n<p><span class=\"token comment\"># \u5176\u4ed6\u547d\u4ee4\u4e2d -Z \u9009\u9879<\/span><br \/>\n<span class=\"token comment\"># cp -Z     set SELinux security context of destination file to default type<\/span><br \/>\n<span class=\"token comment\"># mkdir -Z     set SELinux security context of each created directory to the default type<\/span><\/p>\n<h4>SELinux \u6a21\u5f0f<\/h4>\n<ul>\n<li>enforcing \u6a21\u5f0f&#xff1a; SELinux\u5f3a\u5236\u6267\u884c\u8bbf\u95ee\u63a7\u5236\u89c4\u5219\u3002 \u5728\u5f3a\u5236\u6a21\u5f0f\u4e0b&#xff0c;\u5982\u679c\u89c4\u5219\u6ca1\u6709\u660e\u786e\u5141\u8bb8\u8bbf\u95ee&#xff0c;\u5219\u62d2\u7edd\u8bbf\u95ee&#xff0c;\u5e76\u5199\u5165\u65e5\u5fd7\u3002\u6b64\u6a21\u5f0f\u662f\u9ed8\u8ba4\u6a21\u5f0f\u3002<\/li>\n<li>Permissive \u6a21\u5f0f&#xff1a;SELinux \u52a0\u8f7d\u7b56\u7565\u5e76\u5904\u4e8e\u6d3b\u52a8\u72b6\u6001&#xff0c;\u4f46\u4e0d\u5f3a\u5236\u6267\u884c\u8bbf\u95ee\u63a7\u5236\u89c4\u5219&#xff0c;\u2f7d\u662f\u8bb0\u5f55\u8bbf\u95ee\u8fdd\u89c4\u3002\u6b64\u6a21\u5f0f\u6709\u52a9\u4e8e\u5bf9\u5e94\u7528\u548c\u89c4\u5219\u8fdb\u884c\u6d4b\u8bd5\u548c\u6545\u969c\u6392\u9664\u3002<\/li>\n<li>disable \u6a21\u5f0f&#xff1a;\u5b8c\u5168\u5173\u95ed SELinux\u3002\u4e0d\u62d2\u7edd\u4efb\u4f55SELinux\u8fdd\u89c4&#xff0c;\u4e0d\u4e88\u8bb0\u5f55\u3002<\/li>\n<\/ul>\n<p>\u67e5\u770b\u5f53\u524d\u6a21\u5f0f<\/p>\n<p><span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># getenforce <\/span><\/p>\n<p>\u66f4\u6539\u5f53\u524d\u6a21\u5f0f<\/p>\n<p><span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># setenforce <\/span><br \/>\nusage:  setenforce <span class=\"token punctuation\">[<\/span> Enforcing <span class=\"token operator\">|<\/span> Permissive <span class=\"token operator\">|<\/span> <span class=\"token number\">1<\/span> <span class=\"token operator\">|<\/span> <span class=\"token number\">0<\/span> <span class=\"token punctuation\">]<\/span><\/p>\n<p><span class=\"token comment\"># \u5f3a\u5236\u6a21\u5f0f\u4e34\u65f6\u5207\u6362\u4e3a\u5141\u8bb8\u6a21\u5f0f<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># setenforce 0<\/span><br \/>\n<span class=\"token comment\"># \u6216\u8005<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># setenforce Permissive<\/span><\/p>\n<p><span class=\"token comment\"># \u5141\u8bb8\u6a21\u5f0f\u4e34\u65f6\u5207\u6362\u4e3a\u5f3a\u5236\u6a21\u5f0f<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># setenforce 1<\/span><br \/>\n<span class=\"token comment\"># \u6216\u8005<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># setenforce Enforcing<\/span><\/p>\n<p>\u6a21\u5f0f\u5207\u6362\u6ce8\u610f\u4e8b\u9879&#xff1a;<\/p>\n<ul>\n<li>\u5f3a\u5236\u6a21\u5f0f\u548c\u5141\u8bb8\u6a21\u5f0f\u4e4b\u95f4\u53d8\u66f4&#xff0c;\u4e0d\u9700\u8981\u91cd\u542f\u7cfb\u7edf\u3002<\/li>\n<li>\u4ece\u5f3a\u5236\u6a21\u5f0f\u6216\u8005\u5141\u8bb8\u6a21\u5f0f\u53d8\u66f4\u5230\u7981\u7528\u6a21\u5f0f&#xff0c;\u6216\u8005\u4ece\u7981\u7528\u6a21\u5f0f\u53d8\u66f4\u5230\u5f3a\u5236\u6a21\u5f0f\u6216\u8005\u5141\u8bb8\u6a21\u5f0f\u90fd\u9700\u8981\u91cd\u542f\u7cfb\u7edf\u3002<\/li>\n<\/ul>\n<p>\u66f4\u6539 SELinux \u9ed8\u8ba4\u6a21\u5f0f<\/p>\n<p><span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># vim \/etc\/selinux\/config<\/span><br \/>\n<span class=\"token assign-left variable\">SELINUX<\/span><span class=\"token operator\">&#061;<\/span>enforcing<br \/>\n<span class=\"token assign-left variable\">SELINUXTYPE<\/span><span class=\"token operator\">&#061;<\/span>targeted<\/p>\n<p>\u5728\u542f\u52a8\u65f6\u901a\u8fc7\u5c06\u5411\u5185\u6838\u4f20\u9012\u53c2\u6570\u6765\u8bbe\u7f6eSELinux \u6a21\u5f0f&#xff1a;<\/p>\n<ul>\n<li>enforcing&#061;1&#xff0c;\u8bbe\u7f6e\u5f3a\u5236\u6a21\u5f0f\u3002<\/li>\n<li>enforcing&#061;0&#xff0c;\u8bbe\u7f6e\u8bb8\u53ef\u6a21\u5f0f\u3002<\/li>\n<li>selinux&#061;0&#xff0c;\u6765\u5f7b\u5e95\u7981\u7528 SELinux\u3002<\/li>\n<li>selinux&#061;1&#xff0c;\u542f\u7528 SELinux&#xff08;\u5f53\u8bbe\u7f6eenforcing\u53c2\u6570\u662f&#xff0c;\u8be5\u53c2\u6570\u53ef\u4ee5\u7701\u7565&#xff09;\u3002<\/li>\n<\/ul>\n<p>\u5b9e\u9a8c&#xff1a; selinux\u6a21\u5f0f\u4e3aenforcing\u60c5\u51b5\u4e0b&#xff0c;\u7834\u89e3root\u5bc6\u7801\u3002\u7834\u89e3\u5b8c\u6210\u540e\u4e0d\u6267\u884c touch \/.autorelabel\u547d\u4ee4\u3002<\/p>\n<p>\u91cd\u542f\u6d4b\u8bd5&#xff1a;\u4f7f\u7528\u6b63\u786e\u7684\u5bc6\u7801\u767b\u5f55\u3002\u7ed3\u679c&#xff1a;\u767b\u5f55\u5931\u8d25\u3002\u539f\u56e0&#xff1a;\u7528\u6237\u9a8c\u8bc1\u7a0b\u5e8f\u65e0\u6cd5\u8bbf\u95ee\/etc\/shadow&#xff0c;\u56e0\u4e3a\u7834\u89e3\u5bc6\u7801\u8fc7\u7a0b\u4e2d\/etc\/shadow\u6587\u4ef6\u6807\u7b7e\u88ab\u7834\u574f\u4e86\u3002<\/p>\n<p>\u5904\u7406\u65b9\u6cd5&#xff1a;\u7cfb\u7edf\u542f\u52a8\u65f6&#xff0c;\u5185\u6838\u6dfb\u52a0\u53c2\u6570 selinux&#061;1 enforcing&#061;0<\/p>\n<p>0 laoma<\/p>\n<h2>\u5176\u4ed6\u547d\u4ee4\u4e2d -Z \u9009\u9879<\/h2>\n<h2>cp -Z set SELinux security context of destination file to default type<\/h2>\n<h2>mkdir -Z set SELinux security context of each created directory to the default type<\/h2>\n<p>### SELinux \u6a21\u5f0f<\/p>\n<p>&#8211; **enforcing \u6a21\u5f0f**&#xff1a; SELinux**\u5f3a\u5236\u6267\u884c**\u8bbf\u95ee\u63a7\u5236\u89c4\u5219\u3002 \u5728\u5f3a\u5236\u6a21\u5f0f\u4e0b&#xff0c;\u5982\u679c\u89c4\u5219\u6ca1\u6709\u660e\u786e\u5141\u8bb8\u8bbf\u95ee&#xff0c;\u5219\u62d2\u7edd\u8bbf\u95ee&#xff0c;\u5e76\u5199\u5165\u65e5\u5fd7\u3002\u6b64\u6a21\u5f0f\u662f\u9ed8\u8ba4\u6a21\u5f0f\u3002<br \/>\n&#8211; **Permissive \u6a21\u5f0f**&#xff1a;SELinux \u52a0\u8f7d\u7b56\u7565\u5e76\u5904\u4e8e\u6d3b\u52a8\u72b6\u6001&#xff0c;\u4f46**\u4e0d\u5f3a\u5236\u6267\u884c**\u8bbf\u95ee\u63a7\u5236\u89c4\u5219&#xff0c;**\u2f7d\u662f\u8bb0\u5f55\u8bbf\u95ee\u8fdd\u89c4**\u3002\u6b64\u6a21\u5f0f\u6709\u52a9\u4e8e\u5bf9\u5e94\u7528\u548c\u89c4\u5219\u8fdb\u884c\u6d4b\u8bd5\u548c\u6545\u969c\u6392\u9664\u3002<br \/>\n&#8211; **disable \u6a21\u5f0f**&#xff1a;\u5b8c\u5168**\u5173\u95ed SELinux**\u3002\u4e0d\u62d2\u7edd\u4efb\u4f55SELinux\u8fdd\u89c4&#xff0c;\u4e0d\u4e88\u8bb0\u5f55\u3002<\/p>\n<p>**\u67e5\u770b\u5f53\u524d\u6a21\u5f0f**<\/p>\n<p>&#096;&#096;&#096;bash<br \/>\n[root&#064;centos7 ~]# getenforce <\/p>\n<p>\u66f4\u6539\u5f53\u524d\u6a21\u5f0f<\/p>\n<p><span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># setenforce <\/span><br \/>\nusage:  setenforce <span class=\"token punctuation\">[<\/span> Enforcing <span class=\"token operator\">|<\/span> Permissive <span class=\"token operator\">|<\/span> <span class=\"token number\">1<\/span> <span class=\"token operator\">|<\/span> <span class=\"token number\">0<\/span> <span class=\"token punctuation\">]<\/span><\/p>\n<p><span class=\"token comment\"># \u5f3a\u5236\u6a21\u5f0f\u4e34\u65f6\u5207\u6362\u4e3a\u5141\u8bb8\u6a21\u5f0f<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># setenforce 0<\/span><br \/>\n<span class=\"token comment\"># \u6216\u8005<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># setenforce Permissive<\/span><\/p>\n<p><span class=\"token comment\"># \u5141\u8bb8\u6a21\u5f0f\u4e34\u65f6\u5207\u6362\u4e3a\u5f3a\u5236\u6a21\u5f0f<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># setenforce 1<\/span><br \/>\n<span class=\"token comment\"># \u6216\u8005<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># setenforce Enforcing<\/span><\/p>\n<p>\u6a21\u5f0f\u5207\u6362\u6ce8\u610f\u4e8b\u9879&#xff1a;<\/p>\n<ul>\n<li>\u5f3a\u5236\u6a21\u5f0f\u548c\u5141\u8bb8\u6a21\u5f0f\u4e4b\u95f4\u53d8\u66f4&#xff0c;\u4e0d\u9700\u8981\u91cd\u542f\u7cfb\u7edf\u3002<\/li>\n<li>\u4ece\u5f3a\u5236\u6a21\u5f0f\u6216\u8005\u5141\u8bb8\u6a21\u5f0f\u53d8\u66f4\u5230\u7981\u7528\u6a21\u5f0f&#xff0c;\u6216\u8005\u4ece\u7981\u7528\u6a21\u5f0f\u53d8\u66f4\u5230\u5f3a\u5236\u6a21\u5f0f\u6216\u8005\u5141\u8bb8\u6a21\u5f0f\u90fd\u9700\u8981\u91cd\u542f\u7cfb\u7edf\u3002<\/li>\n<\/ul>\n<p>\u66f4\u6539 SELinux \u9ed8\u8ba4\u6a21\u5f0f<\/p>\n<p><span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># vim \/etc\/selinux\/config<\/span><br \/>\n<span class=\"token assign-left variable\">SELINUX<\/span><span class=\"token operator\">&#061;<\/span>enforcing<br \/>\n<span class=\"token assign-left variable\">SELINUXTYPE<\/span><span class=\"token operator\">&#061;<\/span>targeted<\/p>\n<p>\u5728\u542f\u52a8\u65f6\u901a\u8fc7\u5c06\u5411\u5185\u6838\u4f20\u9012\u53c2\u6570\u6765\u8bbe\u7f6eSELinux \u6a21\u5f0f&#xff1a;<\/p>\n<ul>\n<li>enforcing&#061;1&#xff0c;\u8bbe\u7f6e\u5f3a\u5236\u6a21\u5f0f\u3002<\/li>\n<li>enforcing&#061;0&#xff0c;\u8bbe\u7f6e\u8bb8\u53ef\u6a21\u5f0f\u3002<\/li>\n<li>selinux&#061;0&#xff0c;\u6765\u5f7b\u5e95\u7981\u7528 SELinux\u3002<\/li>\n<li>selinux&#061;1&#xff0c;\u542f\u7528 SELinux&#xff08;\u5f53\u8bbe\u7f6eenforcing\u53c2\u6570\u662f&#xff0c;\u8be5\u53c2\u6570\u53ef\u4ee5\u7701\u7565&#xff09;\u3002<\/li>\n<\/ul>\n<p>\u5b9e\u9a8c&#xff1a; selinux\u6a21\u5f0f\u4e3aenforcing\u60c5\u51b5\u4e0b&#xff0c;\u7834\u89e3root\u5bc6\u7801\u3002\u7834\u89e3\u5b8c\u6210\u540e\u4e0d\u6267\u884c touch \/.autorelabel\u547d\u4ee4\u3002<\/p>\n<p>\u91cd\u542f\u6d4b\u8bd5&#xff1a;\u4f7f\u7528\u6b63\u786e\u7684\u5bc6\u7801\u767b\u5f55\u3002\u7ed3\u679c&#xff1a;\u767b\u5f55\u5931\u8d25\u3002\u539f\u56e0&#xff1a;\u7528\u6237\u9a8c\u8bc1\u7a0b\u5e8f\u65e0\u6cd5\u8bbf\u95ee\/etc\/shadow&#xff0c;\u56e0\u4e3a\u7834\u89e3\u5bc6\u7801\u8fc7\u7a0b\u4e2d\/etc\/shadow\u6587\u4ef6\u6807\u7b7e\u88ab\u7834\u574f\u4e86\u3002<\/p>\n<p>\u5904\u7406\u65b9\u6cd5&#xff1a;\u7cfb\u7edf\u542f\u52a8\u65f6&#xff0c;\u5185\u6838\u6dfb\u52a0\u53c2\u6570 selinux&#061;1 enforcing&#061;0<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Linux \u4ea4\u6362\u7a7a\u95f4\u7ba1\u7406<br \/>\n\u8ba1\u7b97\u673a\u5b58\u50a8\u5668\u7684\u5c42\u6b21\u7ed3\u6784<br \/>\n\u8ba1\u7b97\u673a\u5b58\u50a8\u5668\u901f\u5ea6\u8d8a\u5feb&#xff0c;\u6210\u672c\u8f83\u9ad8\u3002 \u4e3a\u4e86\u83b7\u5f97\u597d\u7684\u6027\u80fd\/\u4ef7\u683c\u6bd4&#xff0c;\u8ba1\u7b97\u673a\u4e2d\u5404\u79cd\u5b58\u50a8\u5668\u7ec4\u6210\u4e00\u4e2a\u5c42\u72b6\u7684\u5854\u5f0f\u7ed3\u6784&#xff0c;\u53d6\u957f\u8865\u77ed&#xff0c;\u534f\u8c03\u5de5\u4f5c\u3002 CPU \u5bc4\u5b58\u5668&#xff0c;\u662f CPU \u5185\u90e8\u7528\u6765\u5b58\u653e\u6570\u636e\u7684\u4e00\u4e9b\u5c0f\u578b\u5b58\u50a8\u533a\u57df&#xff0c;\u7528\u6765\u6682\u65f6\u5b58\u653e\u53c2\u4e0e\u8fd0\u7b97\u7684\u6570\u636e\u548c\u8fd0\u7b97\u7ed3\u679c\u4ee5\u53ca\u4e00\u4e9b CPU \u8fd0\u884c\u9700\u8981\u7684\u4fe1\u606f\u3002  CPU \u9ad8\u901f\u7f13\u5b58&#xff0c;\u4e5f\u5c31\u662fCPU Cache&#xff0c;\u662f\u4e00\u79cd\u5bb9<\/p>\n","protected":false},"author":2,"featured_media":94467,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[58,105,100],"topic":[],"class_list":["post-94487","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-server","tag-linux","tag-redis","tag-100"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.3 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>\u5f6d\u4e8e\u664f\u4e00\u4e2a\u6708\u5e26\u4f60\u73a9\u8f6cLinux\u64cd\u4f5c\u7cfb\u7edf13 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/94487.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u5f6d\u4e8e\u664f\u4e00\u4e2a\u6708\u5e26\u4f60\u73a9\u8f6cLinux\u64cd\u4f5c\u7cfb\u7edf13 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"Linux \u4ea4\u6362\u7a7a\u95f4\u7ba1\u7406 \u8ba1\u7b97\u673a\u5b58\u50a8\u5668\u7684\u5c42\u6b21\u7ed3\u6784 \u8ba1\u7b97\u673a\u5b58\u50a8\u5668\u901f\u5ea6\u8d8a\u5feb&#xff0c;\u6210\u672c\u8f83\u9ad8\u3002 \u4e3a\u4e86\u83b7\u5f97\u597d\u7684\u6027\u80fd\/\u4ef7\u683c\u6bd4&#xff0c;\u8ba1\u7b97\u673a\u4e2d\u5404\u79cd\u5b58\u50a8\u5668\u7ec4\u6210\u4e00\u4e2a\u5c42\u72b6\u7684\u5854\u5f0f\u7ed3\u6784&#xff0c;\u53d6\u957f\u8865\u77ed&#xff0c;\u534f\u8c03\u5de5\u4f5c\u3002 CPU \u5bc4\u5b58\u5668&#xff0c;\u662f CPU \u5185\u90e8\u7528\u6765\u5b58\u653e\u6570\u636e\u7684\u4e00\u4e9b\u5c0f\u578b\u5b58\u50a8\u533a\u57df&#xff0c;\u7528\u6765\u6682\u65f6\u5b58\u653e\u53c2\u4e0e\u8fd0\u7b97\u7684\u6570\u636e\u548c\u8fd0\u7b97\u7ed3\u679c\u4ee5\u53ca\u4e00\u4e9b CPU \u8fd0\u884c\u9700\u8981\u7684\u4fe1\u606f\u3002 CPU \u9ad8\u901f\u7f13\u5b58&#xff0c;\u4e5f\u5c31\u662fCPU Cache&#xff0c;\u662f\u4e00\u79cd\u5bb9\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/94487.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-14T07:49:52+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/08\/20260814074944-6a7ec898e1247.png\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"18 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/94487.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/94487.html\",\"name\":\"\u5f6d\u4e8e\u664f\u4e00\u4e2a\u6708\u5e26\u4f60\u73a9\u8f6cLinux\u64cd\u4f5c\u7cfb\u7edf13 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-08-14T07:49:52+00:00\",\"dateModified\":\"2026-08-14T07:49:52+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/94487.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/94487.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/94487.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u5f6d\u4e8e\u664f\u4e00\u4e2a\u6708\u5e26\u4f60\u73a9\u8f6cLinux\u64cd\u4f5c\u7cfb\u7edf13\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"\u5f6d\u4e8e\u664f\u4e00\u4e2a\u6708\u5e26\u4f60\u73a9\u8f6cLinux\u64cd\u4f5c\u7cfb\u7edf13 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/94487.html","og_locale":"zh_CN","og_type":"article","og_title":"\u5f6d\u4e8e\u664f\u4e00\u4e2a\u6708\u5e26\u4f60\u73a9\u8f6cLinux\u64cd\u4f5c\u7cfb\u7edf13 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"Linux \u4ea4\u6362\u7a7a\u95f4\u7ba1\u7406 \u8ba1\u7b97\u673a\u5b58\u50a8\u5668\u7684\u5c42\u6b21\u7ed3\u6784 \u8ba1\u7b97\u673a\u5b58\u50a8\u5668\u901f\u5ea6\u8d8a\u5feb&#xff0c;\u6210\u672c\u8f83\u9ad8\u3002 \u4e3a\u4e86\u83b7\u5f97\u597d\u7684\u6027\u80fd\/\u4ef7\u683c\u6bd4&#xff0c;\u8ba1\u7b97\u673a\u4e2d\u5404\u79cd\u5b58\u50a8\u5668\u7ec4\u6210\u4e00\u4e2a\u5c42\u72b6\u7684\u5854\u5f0f\u7ed3\u6784&#xff0c;\u53d6\u957f\u8865\u77ed&#xff0c;\u534f\u8c03\u5de5\u4f5c\u3002 CPU \u5bc4\u5b58\u5668&#xff0c;\u662f CPU \u5185\u90e8\u7528\u6765\u5b58\u653e\u6570\u636e\u7684\u4e00\u4e9b\u5c0f\u578b\u5b58\u50a8\u533a\u57df&#xff0c;\u7528\u6765\u6682\u65f6\u5b58\u653e\u53c2\u4e0e\u8fd0\u7b97\u7684\u6570\u636e\u548c\u8fd0\u7b97\u7ed3\u679c\u4ee5\u53ca\u4e00\u4e9b CPU \u8fd0\u884c\u9700\u8981\u7684\u4fe1\u606f\u3002 CPU \u9ad8\u901f\u7f13\u5b58&#xff0c;\u4e5f\u5c31\u662fCPU Cache&#xff0c;\u662f\u4e00\u79cd\u5bb9","og_url":"https:\/\/www.wsisp.com\/helps\/94487.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-08-14T07:49:52+00:00","og_image":[{"url":"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/08\/20260814074944-6a7ec898e1247.png"}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"18 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/94487.html","url":"https:\/\/www.wsisp.com\/helps\/94487.html","name":"\u5f6d\u4e8e\u664f\u4e00\u4e2a\u6708\u5e26\u4f60\u73a9\u8f6cLinux\u64cd\u4f5c\u7cfb\u7edf13 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-08-14T07:49:52+00:00","dateModified":"2026-08-14T07:49:52+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/94487.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/94487.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/94487.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"\u5f6d\u4e8e\u664f\u4e00\u4e2a\u6708\u5e26\u4f60\u73a9\u8f6cLinux\u64cd\u4f5c\u7cfb\u7edf13"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/94487","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=94487"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/94487\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media\/94467"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=94487"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=94487"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=94487"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=94487"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}