Firewalld命令行参数中文注释，这鬼东西，太多，看了脑壳疼。
help帮助文档
# firewall-cmd -h Usage: firewall-cmd [OPTIONS...] General Options -h, --help Prints a short help text and exists -V, --version Print the version string of firewalld -q, --quiet Do not print status messages Status Options --state Return and print firewalld state --reload Reload firewall and keep state information --complete-reload Reload firewall and loose state information --runtime-to-permanent Create permanent from runtime configuration Permanent Options --permanent Set an option permanently Usable for options maked with [P] Zone Options --get-default-zone Print default zone for connections and interfaces --set-default-zone=<zone> Set default zone --get-active-zones Print currently active zones --get-zones Print predefined zones [P] --get-services Print predefined services [P] --get-icmptypes Print predefined icmptypes [P] --get-zone-of-interface=<interface> Print name of the zone the interface is bound to [P] --get-zone-of-source=<source>[/<mask>] Print name of the zone the source[/mask] is bound to [P] --list-all-zones List everything added for or enabled in all zones [P] --new-zone=<zone> Add a new zone [P only] --delete-zone=<zone> Delete an existing zone [P only] --zone=<zone> Use this zone to set or query options, else default zone Usable for options maked with [Z] --get-target Get the zone target [P] [Z] --set-target=<target> Set the zone target [P] [Z] IcmpType Options --new-icmptype=<icmptype> Add a new icmptype [P only] --delete-icmptype=<icmptype> Delete and existing icmptype [P only] Service Options --new-service=<service> Add a new service [P only] --delete-service=<service> Delete and existing service [P only] Options to Adapt and Query Zones --list-all List everything added for or enabled in a zone [P] [Z] --list-services List services added for a zone [P] [Z] --timeout=<timeval> Enable an option for timeval time, where timeval is a number followed by one of letters 's' or 'm' or 'h' Usable for options maked with [T] --add-service=<service> Add a service for a zone [P] [Z] [T] --remove-service=<service> Remove a service from a zone [P] [Z] --query-service=<service> Return whether service has been added for a zone [P] [Z] --list-ports List ports added for a zone [P] [Z] --add-port=<portid>[-<portid>]/<protocol> Add the port for a zone [P] [Z] [T] --remove-port=<portid>[-<portid>]/<protocol> Remove the port from a zone [P] [Z] --query-port=<portid>[-<portid>]/<protocol> Return whether the port has been added for zone [P] [Z] --list-icmp-blocks List Internet ICMP type blocks added for a zone [P] [Z] --add-icmp-block=<icmptype> Add an ICMP block for a zone [P] [Z] [T] --remove-icmp-block=<icmptype> Remove the ICMP block from a zone [P] [Z] --query-icmp-block=<icmptype> Return whether an ICMP block has been added for a zone [P] [Z] --list-forward-ports List IPv4 forward ports added for a zone [P] [Z] --add-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]] Add the IPv4 forward port for a zone [P] [Z] [T] --remove-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]] Remove the IPv4 forward port from a zone [P] [Z] --query-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]] Return whether the IPv4 forward port has been added for a zone [P] [Z] --add-masquerade Enable IPv4 masquerade for a zone [P] [Z] [T] --remove-masquerade Disable IPv4 masquerade for a zone [P] [Z] --query-masquerade Return whether IPv4 masquerading has been enabled for a zone [P] [Z] --list-rich-rules List rich language rules added for a zone [P] [Z] --add-rich-rule=<rule> Add rich language rule 'rule' for a zone [P] [Z] [T] --remove-rich-rule=<rule> Remove rich language rule 'rule' from a zone [P] [Z] --query-rich-rule=<rule> Return whether a rich language rule 'rule' has been added for a zone [P] [Z] Options to Handle Bindings of Interfaces --list-interfaces List interfaces that are bound to a zone [P] [Z] --add-interface=<interface> Bind the <interface> to a zone [P] [Z] --change-interface=<interface> Change zone the <interface> is bound to [Z] --query-interface=<interface> Query whether <interface> is bound to a zone [P] [Z] --remove-interface=<interface> Remove binding of <interface> from a zone [P] [Z] Options to Handle Bindings of Sources --list-sources List sources that are bound to a zone [P] [Z] --add-source=<source>[/<mask>] Bind <source>[/<mask>] to a zone [P] [Z] --change-source=<source>[/<mask>] Change zone the <source>[/<mask>] is bound to [Z] --query-source=<source>[/<mask>] Query whether <source>[/<mask>] is bound to a zone [P] [Z] --remove-source=<source>[/<mask>] Remove binding of <source>[/<mask>] from a zone [P] [Z] Direct Options --direct First option for all direct options --get-all-chains Get all chains [P] --get-chains {ipv4|ipv6|eb} <table> Get all chains added to the table [P] --add-chain {ipv4|ipv6|eb} <table> <chain> Add a new chain to the table [P] --remove-chain {ipv4|ipv6|eb} <table> <chain> Remove the chain from the table [P] --query-chain {ipv4|ipv6|eb} <table> <chain> Return whether the chain has been added to the table [P] --get-all-rules Get all rules [P] --get-rules {ipv4|ipv6|eb} <table> <chain> Get all rules added to chain in table [P] --add-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>... Add rule to chain in table [P] --remove-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>... Remove rule with priority from chain in table [P] --remove-rules {ipv4|ipv6|eb} <table> <chain> Remove rules from chain in table [P] --query-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>... Return whether a rule with priority has been added to chain in table [P] --passthrough {ipv4|ipv6|eb} <arg>... Pass a command through (untracked by firewalld) --get-all-passthroughs Get all tracked passthrough rules [P] --get-passthroughs {ipv4|ipv6|eb} <arg>... Get tracked passthrough rules [P] --add-passthrough {ipv4|ipv6|eb} <arg>... Add a new tracked passthrough rule [P] --remove-passthrough {ipv4|ipv6|eb} <arg>... Remove a tracked passthrough rule [P] --query-passthrough {ipv4|ipv6|eb} <arg>... Return whether the tracked passthrough rule has been added [P] Lockdown Options --lockdown-on Enable lockdown. --lockdown-off Disable lockdown. --query-lockdown Query whether lockdown is enabled Lockdown Whitelist Options --list-lockdown-whitelist-commands List all command lines that are on the whitelist [P] --add-lockdown-whitelist-command=<command> Add the command to the whitelist [P] --remove-lockdown-whitelist-command=<command> Remove the command from the whitelist [P] --query-lockdown-whitelist-command=<command> Query whether the command is on the whitelist [P] --list-lockdown-whitelist-contexts List all contexts that are on the whitelist [P] --add-lockdown-whitelist-context=<context> Add the context context to the whitelist [P] --remove-lockdown-whitelist-context=<context> Remove the context from the whitelist [P] --query-lockdown-whitelist-context=<context> Query whether the context is on the whitelist [P] --list-lockdown-whitelist-uids List all user ids that are on the whitelist [P] --add-lockdown-whitelist-uid=<uid> Add the user id uid to the whitelist [P] --remove-lockdown-whitelist-uid=<uid> Remove the user id uid from the whitelist [P] --query-lockdown-whitelist-uid=<uid> Query whether the user id uid is on the whitelist [P] --list-lockdown-whitelist-users List all user names that are on the whitelist [P] --add-lockdown-whitelist-user=<user> Add the user name user to the whitelist [P] --remove-lockdown-whitelist-user=<user> Remove the user name user from the whitelist [P] --query-lockdown-whitelist-user=<user> Query whether the user name user is on the whitelist [P] Panic Options --panic-on Enable panic mode --panic-off Disable panic mode --query-panic Query whether panic mode is enabled
中文注释
常规选项
General Options # 常规选项 -h, --help Prints a short help text and exists # 打印帮助信息 -V, --version Print the version string of firewalld # 打印firewalld的版本信息 -q, --quiet Do not print status messages # 不打印状态信息
状态选项
Status Options # 状态选项 --state Return and print firewalld state # 返回firewalld的状态，running or not running --reload Reload firewall and keep state information # 重载firewall，保留状态信息 --complete-reload Reload firewall and loose state information # 重载firewall，丢失状态信息 --runtime-to-permanent Create permanent from runtime configuration # 通过运行时配置创建永久文件
永久选项
Permanent Options # 永久选项，永久生效 --permanent Set an option permanently # 设置某个选项永久生效 Usable for options maked with [P] # 标记为[P]的可以使用该选项
zone选项
Zone Options --get-default-zone Print default zone for connections and interfaces # 打印连接和接口的默认zone --set-default-zone=<zone> # 设置默认zone Set default zone --get-active-zones Print currently active zones # 打印当前活跃的zones --get-zones Print predefined zones [P] # 打印预定义zones（即默认zones） --get-services Print predefined services [P] # 打印预定义的服务（即默认services） --get-icmptypes Print predefined icmptypes [P] # 打印预定义的icmptypes（即默认icmptypes） --get-zone-of-interface=<interface> Print name of the zone the interface is bound to [P] # 打印接口所绑定的zone --get-zone-of-source=<source>[/<mask>] Print name of the zone the source[/mask] is bound to [P] # 打印源/mask所绑定的zone --list-all-zones List everything added for or enabled in all zones [P] # 列出所有的zones，包括添加或启用的所有内容 --new-zone=<zone> Add a new zone [P only] # 增加一个新的zone --delete-zone=<zone> Delete an existing zone [P only] # 删除一个已有的zone --zone=<zone> Use this zone to set or query options, else default zone # 使用某个zone以设置或查询选项，否则使用默认，public zone Usable for options maked with [Z] # 标记为[Z]的可使用该选项 --get-target Get the zone target [P] [Z] # 获取zone的目标 --set-target=<target> # 设置zone的目标 Set the zone target [P] [Z]
IcmpType选项
IcmpType Options # icmptype选项 --new-icmptype=<icmptype> # 添加一个新的icmptype类型 Add a new icmptype [P only] --delete-icmptype=<icmptype> # 删除一个已有的icmptype类型 Delete and existing icmptype [P only]
服务选项
Service Options # 服务选项 --new-service=<service> # 增加一个新的服务 Add a new service [P only] --delete-service=<service> # 删除一个已有的服务 Delete and existing service [P only]
适应和查询区域的选项
Options to Adapt and Query Zones # 适应和查询区域的选项 --list-all List everything added for or enabled in a zone [P] [Z] # 列出一个zone里所有添加或者启用的信息 --list-services List services added for a zone [P] [Z] # 列出一个zone里所有添加的服务 --timeout=<timeval> Enable an option for timeval time, where timeval is # 启用时间间隔选项（超时时间），时间间隔是由's'、'm'、'h'跟一个数字 a number followed by one of letters 's' or 'm' or 'h' Usable for options maked with [T] --add-service=<service> # 添加一个服务到zone Add a service for a zone [P] [Z] [T] --remove-service=<service> # 从zone中移除服务 Remove a service from a zone [P] [Z] --query-service=<service> # 查询zone 是否添加了某个服务 Return whether service has been added for a zone [P] [Z] --list-ports List ports added for a zone [P] [Z] # 列出zone添加的所有端口 --add-port=<portid>[-<portid>]/<protocol> Add the port for a zone [P] [Z] [T] # 添加一个端口到zone --remove-port=<portid>[-<portid>]/<protocol> Remove the port from a zone [P] [Z] # 从zone移除一个端口 --query-port=<portid>[-<portid>]/<protocol> # 查询zone是否添加了某个服务 Return whether the port has been added for zone [P] [Z] --list-icmp-blocks List Internet ICMP type blocks added for a zone [P] [Z] # 列出zone禁用的所有的icmp类型 --add-icmp-block=<icmptype> # 添加zone禁用的icmp类型 Add an ICMP block for a zone [P] [Z] [T] --remove-icmp-block=<icmptype> # 移除zone禁用的icmp类型 Remove the ICMP block from a zone [P] [Z] --query-icmp-block=<icmptype> # 查询zone里某个icmp类型是否被禁用 Return whether an ICMP block has been added for a zone [P] [Z] --list-forward-ports List IPv4 forward ports added for a zone [P] [Z] # 列出zone所有ipv4的转发端口 --add-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]] Add the IPv4 forward port for a zone [P] [Z] [T] # 为zone添加一个ipv4的转发端口 --remove-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]] Remove the IPv4 forward port from a zone [P] [Z] # 从zone众删除一个ipv4转发端口 --query-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]] Return whether the IPv4 forward port has been added for a zone [P] [Z] # 查询某个ipv4端口是否添加到zone中 --add-masquerade Enable IPv4 masquerade for a zone [P] [Z] [T] # 启用zone伪装 --remove-masquerade Disable IPv4 masquerade for a zone [P] [Z] # 禁用zone伪装 --query-masquerade Return whether IPv4 masquerading has been enabled for a # 查询zone是否启用伪装 zone [P] [Z] --list-rich-rules List rich language rules added for a zone [P] [Z] # 列出zone的所有富规则 --add-rich-rule=<rule> # 添加富规则到zone Add rich language rule 'rule' for a zone [P] [Z] [T] --remove-rich-rule=<rule> # 从zone移除一条富规则 Remove rich language rule 'rule' from a zone [P] [Z] --query-rich-rule=<rule> # 查询zone里是否存在某富规则 Return whether a rich language rule 'rule' has been added for a zone [P] [Z]
处理绑定接口的选项
Options to Handle Bindings of Interfaces # 处理绑定接口的选项 --list-interfaces List interfaces that are bound to a zone [P] [Z] # 列出绑定到某个zone的所有接口 --add-interface=<interface> # 绑定某个接口到zone Bind the <interface> to a zone [P] [Z] --change-interface=<interface> # 改变接口绑定的zone Change zone the <interface> is bound to [Z] --query-interface=<interface> # 查询某个接口是否绑定到zone Query whether <interface> is bound to a zone [P] [Z] --remove-interface=<interface> # 从zone移除绑定的接口 Remove binding of <interface> from a zone [P] [Z]
处理绑定源的选项
Options to Handle Bindings of Sources # 处理绑定源的选项 --list-sources List sources that are bound to a zone [P] [Z] # 列出绑定到zone的所有源 --add-source=<source>[/<mask>] # 绑定某个源到zone Bind <source>[/<mask>] to a zone [P] [Z] --change-source=<source>[/<mask>] # 改变源绑定的zone Change zone the <source>[/<mask>] is bound to [Z] --query-source=<source>[/<mask>] # 查询某个源是否绑定到zone Query whether <source>[/<mask>] is bound to a zone [P] [Z] --remove-source=<source>[/<mask>] # 从zone移除某个绑定的源 Remove binding of <source>[/<mask>] from a zone [P] [Z]
直接选项direct
Direct Options # direct选项 --direct First option for all direct options # --direct指定 --get-all-chains # 获取所有chains Get all chains [P] --get-chains {ipv4|ipv6|eb} <table> # 获取某个table中所有的chains Get all chains added to the table [P] --add-chain {ipv4|ipv6|eb} <table> <chain> # 添加一个新chain到table Add a new chain to the table [P] --remove-chain {ipv4|ipv6|eb} <table> <chain> # 从table中移除一个chain Remove the chain from the table [P] --query-chain {ipv4|ipv6|eb} <table> <chain> # 查询table中是否包含chain Return whether the chain has been added to the table [P] --get-all-rules # 获取所有的规则 Get all rules [P] --get-rules {ipv4|ipv6|eb} <table> <chain> # 获取某table某链中的所有规则 Get all rules added to chain in table [P] --add-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>... # 填加rule到某table某chain中 Add rule to chain in table [P] --remove-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>... # 从某table某chain中删除规则 Remove rule with priority from chain in table [P] --remove-rules {ipv4|ipv6|eb} <table> <chain> # 删除table中的所有chain Remove rules from chain in table [P] --query-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>... # 查询某条带优先级的规则是否添加到table:chain中 Return whether a rule with priority has been added to chain in table [P] --passthrough {ipv4|ipv6|eb} <arg>... Pass a command through (untracked by firewalld) # 传递命令（不受firewalld跟踪） --get-all-passthroughs Get all tracked passthrough rules [P] # 获取所有跟踪的通过规则 --get-passthroughs {ipv4|ipv6|eb} <arg>... Get tracked passthrough rules [P] # 获取跟踪的通过规则 --add-passthrough {ipv4|ipv6|eb} <arg>... # 增加一条跟踪通过规则 Add a new tracked passthrough rule [P] --remove-passthrough {ipv4|ipv6|eb} <arg>... # 移除一条跟踪通过规则 Remove a tracked passthrough rule [P] --query-passthrough {ipv4|ipv6|eb} <arg>... # 查询跟踪的通过规则是否已添加 Return whether the tracked passthrough rule has been added [P]
锁定选项
Lockdown Options # 锁定选项 --lockdown-on Enable lockdown. # 启用锁定 --lockdown-off Disable lockdown. # 禁用锁定 --query-lockdown Query whether lockdown is enabled # 查询锁定是否启用
锁定白名单选项
Lockdown Whitelist Options # 锁定白名单选项 --list-lockdown-whitelist-commands # 列出白名单里所有的命令行 List all command lines that are on the whitelist [P] --add-lockdown-whitelist-command=<command> # 往白名单列表中添加命令 Add the command to the whitelist [P] --remove-lockdown-whitelist-command=<command> # 从白名单列表移除命令 Remove the command from the whitelist [P] --query-lockdown-whitelist-command=<command> # 查询白名单列表中是否有某命令 Query whether the command is on the whitelist [P] --list-lockdown-whitelist-contexts # 列出白名单上的所有上下文 List all contexts that are on the whitelist [P] --add-lockdown-whitelist-context=<context> # 将上下文内容添加到白名单 Add the context context to the whitelist [P] --remove-lockdown-whitelist-context=<context> # 从白名单中删除上下文 Remove the context from the whitelist [P] --query-lockdown-whitelist-context=<context> # 查询上下文是否在白名单上 Query whether the context is on the whitelist [P] --list-lockdown-whitelist-uids # 列出白名单上的所有用户ID List all user ids that are on the whitelist [P] --add-lockdown-whitelist-uid=<uid> # 将用户ID uid添加到白名单 Add the user id uid to the whitelist [P] --remove-lockdown-whitelist-uid=<uid> # 从白名单中删除用户ID uid Remove the user id uid from the whitelist [P] --query-lockdown-whitelist-uid=<uid> # 查询用户id uid是否在白名单中 Query whether the user id uid is on the whitelist [P] --list-lockdown-whitelist-users # 列出白名单上的所有用户名 List all user names that are on the whitelist [P] --add-lockdown-whitelist-user=<user> # 将用户名user添加到白名单 Add the user name user to the whitelist [P] --remove-lockdown-whitelist-user=<user> # 从白名单中删除用户名user Remove the user name user from the whitelist [P] --query-lockdown-whitelist-user=<user> # 查询用户名“ user”是否在白名单中 Query whether the user name user is on the whitelist [P]
紧急选项
Panic Options # 紧急选项 --panic-on Enable panic mode # 启用panic模式 --panic-off Disable panic mode # 禁用panic --query-panic Query whether panic mode is enabled # 查询panic模式是否启用