常用富规则
常用富规则
firewall-cmd --add-rich-rule='rule family="ipv4" source address="10.0.0.0/24" port port="3306" protocol="tcp" accept' --permanent
firewall-cmd --add-rich-rule='rule family="ipv4" source address="192.168.100.0/24" service name="ssh" log prefix="ssh-deny " level="warning" reject' --permanent
firewall-cmd --add-rich-rule='rule family="ipv4" service name="http" limit value="30/m" accept' --permanent
firewall-cmd --reload
firewall-cmd --list-rich-rules记录日志的富规则便于定位被拒来源；日志会进 kernel 日志（dmesg/journalctl -k），排查时按 prefix 过滤。