☰

방화벽이 비활성화되었지만 여전히 iptables 규칙이 표시됩니다.

tag-icon • tag-icon iptables firewalld
방화벽이 비활성화되었지만 여전히 iptables 규칙이 표시됩니다.

운영 체제는 centos7.2이고 방화벽 버전은 0.4.3.2입니다. Firewalld.service를 비활성화했습니다.

[root@controller ~]# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
   Active: failed (Result: signal) since Thu 2017-03-30 23:17:24 CST; 17s ago
     Docs: man:firewalld(1)
 Main PID: 3417 (code=killed, signal=KILL)

Mar 30 23:15:22 controller.datall.cn systemd[1]: Starting firewalld - dynamic firewall daemon...
Mar 30 23:15:23 controller.datall.cn systemd[1]: Started firewalld - dynamic firewall daemon.
Mar 30 23:17:24 controller.datall.cn systemd[1]: firewalld.service: main process exited, code=kil...ILL
Mar 30 23:17:24 controller.datall.cn systemd[1]: Unit firewalld.service entered failed state.
Mar 30 23:17:24 controller.datall.cn systemd[1]: firewalld.service failed.
Hint: Some lines were ellipsized, use -l to show in full.
[root@controller ~]# ps aux  | grep firewalld
root       3640  0.0  0.0 112644   952 pts/0    S+   23:17   0:00 grep --color=auto firewalld

그런 다음 iptabes-save 명령은 아래와 같이 일부 규칙을 계속 표시합니다.

[root@controller ~]# iptables-save
# Generated by iptables-save v1.4.21 on Thu Mar 30 23:19:22 2017
*security
:INPUT ACCEPT [359:27396]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [311:43588]
:FORWARD_direct - [0:0]
:INPUT_direct - [0:0]
:OUTPUT_direct - [0:0]
-A INPUT -j INPUT_direct
-A FORWARD -j FORWARD_direct
-A OUTPUT -j OUTPUT_direct
COMMIT
# Completed on Thu Mar 30 23:19:22 2017
# Generated by iptables-save v1.4.21 on Thu Mar 30 23:19:22 2017
*raw
:PREROUTING ACCEPT [422:37323]
:OUTPUT ACCEPT [311:43588]
:OUTPUT_direct - [0:0]
:PREROUTING_direct - [0:0]
-A PREROUTING -j PREROUTING_direct
-A OUTPUT -j OUTPUT_direct
COMMIT
# Completed on Thu Mar 30 23:19:22 2017
# Generated by iptables-save v1.4.21 on Thu Mar 30 23:19:22 2017
*mangle
:PREROUTING ACCEPT [166:15197]
:INPUT ACCEPT [166:15197]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [118:24382]
:POSTROUTING ACCEPT [118:24382]
:FORWARD_direct - [0:0]
:INPUT_direct - [0:0]
:OUTPUT_direct - [0:0]
:POSTROUTING_direct - [0:0]
:PREROUTING_ZONES - [0:0]
:PREROUTING_ZONES_SOURCE - [0:0]
:PREROUTING_direct - [0:0]
:PRE_public - [0:0]
:PRE_public_allow - [0:0]
:PRE_public_deny - [0:0]
:PRE_public_log - [0:0]
-A PREROUTING -j PREROUTING_direct
-A PREROUTING -j PREROUTING_ZONES_SOURCE
-A PREROUTING -j PREROUTING_ZONES
-A INPUT -j INPUT_direct
-A FORWARD -j FORWARD_direct
-A OUTPUT -j OUTPUT_direct
-A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
-A POSTROUTING -j POSTROUTING_direct
-A PREROUTING_ZONES -g PRE_public
-A PRE_public -j PRE_public_log
-A PRE_public -j PRE_public_deny
-A PRE_public -j PRE_public_allow
COMMIT
# Completed on Thu Mar 30 23:19:22 2017
# Generated by iptables-save v1.4.21 on Thu Mar 30 23:19:22 2017
*nat
:PREROUTING ACCEPT [24:2833]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [5:348]
:POSTROUTING ACCEPT [5:348]
:OUTPUT_direct - [0:0]
:POSTROUTING_ZONES - [0:0]
:POSTROUTING_ZONES_SOURCE - [0:0]
:POSTROUTING_direct - [0:0]
:POST_public - [0:0]
:POST_public_allow - [0:0]
:POST_public_deny - [0:0]
:POST_public_log - [0:0]
:PREROUTING_ZONES - [0:0]
:PREROUTING_ZONES_SOURCE - [0:0]
:PREROUTING_direct - [0:0]
:PRE_public - [0:0]
:PRE_public_allow - [0:0]
:PRE_public_deny - [0:0]
:PRE_public_log - [0:0]
-A PREROUTING -j PREROUTING_direct
-A PREROUTING -j PREROUTING_ZONES_SOURCE
-A PREROUTING -j PREROUTING_ZONES
-A OUTPUT -j OUTPUT_direct
-A POSTROUTING -s 192.168.122.0/24 -d 224.0.0.0/24 -j RETURN
-A POSTROUTING -s 192.168.122.0/24 -d 255.255.255.255/32 -j RETURN
-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
-A POSTROUTING -j POSTROUTING_direct
-A POSTROUTING -j POSTROUTING_ZONES_SOURCE
-A POSTROUTING -j POSTROUTING_ZONES
-A POSTROUTING_ZONES -g POST_public
-A POST_public -j POST_public_log
-A POST_public -j POST_public_deny
-A POST_public -j POST_public_allow
-A PREROUTING_ZONES -g PRE_public
-A PRE_public -j PRE_public_log
-A PRE_public -j PRE_public_deny
-A PRE_public -j PRE_public_allow
COMMIT
# Completed on Thu Mar 30 23:19:22 2017
# Generated by iptables-save v1.4.21 on Thu Mar 30 23:19:22 2017
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [118:24382]
:FORWARD_IN_ZONES - [0:0]
:FORWARD_IN_ZONES_SOURCE - [0:0]
:FORWARD_OUT_ZONES - [0:0]
:FORWARD_OUT_ZONES_SOURCE - [0:0]
:FORWARD_direct - [0:0]
:FWDI_public - [0:0]
:FWDI_public_allow - [0:0]
:FWDI_public_deny - [0:0]
:FWDI_public_log - [0:0]
:FWDO_public - [0:0]
:FWDO_public_allow - [0:0]
:FWDO_public_deny - [0:0]
:FWDO_public_log - [0:0]
:INPUT_ZONES - [0:0]
:INPUT_ZONES_SOURCE - [0:0]
:INPUT_direct - [0:0]
:IN_public - [0:0]
:IN_public_allow - [0:0]
:IN_public_deny - [0:0]
:IN_public_log - [0:0]
:OUTPUT_direct - [0:0]
-A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -j INPUT_direct
-A INPUT -j INPUT_ZONES_SOURCE
-A INPUT -j INPUT_ZONES
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -d 192.168.122.0/24 -o virbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT
-A FORWARD -i virbr0 -o virbr0 -j ACCEPT
-A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i lo -j ACCEPT
-A FORWARD -j FORWARD_direct
-A FORWARD -j FORWARD_IN_ZONES_SOURCE
-A FORWARD -j FORWARD_IN_ZONES
-A FORWARD -j FORWARD_OUT_ZONES_SOURCE
-A FORWARD -j FORWARD_OUT_ZONES
-A FORWARD -m conntrack --ctstate INVALID -j DROP
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A OUTPUT -o virbr0 -p udp -m udp --dport 68 -j ACCEPT
-A OUTPUT -j OUTPUT_direct
-A FORWARD_IN_ZONES -g FWDI_public
-A FORWARD_OUT_ZONES -g FWDO_public
-A FWDI_public -j FWDI_public_log
-A FWDI_public -j FWDI_public_deny
-A FWDI_public -j FWDI_public_allow
-A FWDI_public -p icmp -j ACCEPT
-A FWDO_public -j FWDO_public_log
-A FWDO_public -j FWDO_public_deny
-A FWDO_public -j FWDO_public_allow
-A INPUT_ZONES -g IN_public
-A IN_public -j IN_public_log
-A IN_public -j IN_public_deny
-A IN_public -j IN_public_allow
-A IN_public -p icmp -j ACCEPT
-A IN_public_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
-A IN_public_allow -p tcp -m tcp --dport 443 -m conntrack --ctstate NEW -j ACCEPT
-A IN_public_allow -p tcp -m tcp --dport 80 -m conntrack --ctstate NEW -j ACCEPT
COMMIT
# Completed on Thu Mar 30 23:19:22 2017

모든 iptables 서비스가 비활성화되었습니다. 지금은 정말 혼란스러워요. 누구든지 이유를 말해 줄 수 있습니까?

[root@controller ~]# systemctl list-unit-files | egrep 'firewalld|table'
ebtables.service                           disabled
firewalld.service                          disabled
ip6tables.service                          disabled
iptables.service                           disabled

답변1

Firewalld는 필터링 규칙을 관리하는 데몬일 뿐입니다. 필터링 자체는 사용자 공간에서 커널로 로드된 규칙을 사용하여 커널에서 수행됩니다. 필터링에는 실행 중인 활성 프로세스가 필요하지 않습니다. 규칙이 로드되면 방화벽이 종료된 경우에도 커널이 필터링됩니다.

관련 정보