如何解决 Linux 防火墙完全失效的问题？

[naohion]

CentOS 7 的服务器，之前配置 IPv6 一直无法使用，没去管，今天随手扫了一下开放端口发现 firewalld 规则里没有开放的端口全部被开放了。确定 zone 设置正确，firewalld 和 iptables 都在正常工作，规则都已正常保存。然后我加了一条 iptables 拒绝规则，然而还是可以访问。firewalld 打开 panic 模式照样能 ssh 连接服务器。不知道这和 IPv6 无效是否有关，请问有大佬知道吗？研究了一天还没解决。

[zwl2012]

docker

[snoopygao]

贴出来 list-all-zone 看看

[naohion]

@zwl2012 一直在用 docker 但一些容器的端口不希望外网访问

@snoopygao $ sudo firewall-cmd --list-all-zone
[sudo] password for user:
block
target: %%REJECT%%
icmp-block-inversion: no
interfaces:
sources:
services:
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:


dmz
target: default
icmp-block-inversion: no
interfaces:
sources:
services: ssh
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:


drop
target: DROP
icmp-block-inversion: no
interfaces:
sources:
services:
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:


external
target: default
icmp-block-inversion: no
interfaces:
sources:
services: ssh
ports:
protocols:
masquerade: yes
forward-ports:
source-ports:
icmp-blocks:
rich rules:


home
target: default
icmp-block-inversion: no
interfaces:
sources:
services: dhcpv6-client mdns samba-client ssh
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:


internal
target: default
icmp-block-inversion: no
interfaces:
sources:
services: dhcpv6-client mdns samba-client ssh
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:


public (active)
target: default
icmp-block-inversion: no
interfaces: eth0
sources:
services: dhcpv6-client ssh
ports: 443/tcp 22/tcp 80/tcp
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:


trusted
target: ACCEPT
icmp-block-inversion: no
interfaces:
sources:
services:
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:


work
target: default
icmp-block-inversion: no
interfaces:
sources:
services: dhcpv6-client ssh
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules: