环境红帽企业Linux 7红帽企业Linux 8红帽企业Linux 9问题如何使用 firewalld 记录所有入站和出站流量如何在应用阻止规则之前记录所有传入流量解决添加以下 firewalld 直接规则以监控入站流量Raw# firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -p all -s 0.0.0.0/0 -j LOG --log-prefix Incoming_Traffic --log-level 4 # firewall-cmd --reload添加以下 firewalld 直接规则以监控出站流量Raw# firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 -p all -s 0.0.0.0/0 -j LOG --log-prefix Outgoing_Traffic --log-level 4 # firewall-cmd --reload使用以下命令验证直接规则Raw# firewall-cmd --direct --get-all-rules笔记直接规则的优先级高于所有其他 firewalld 规则。诊断步骤直接规则的示例输出Raw# firewall-cmd --direct --get-all-rules ipv4 filter INPUT 0 -p all -s 0.0.0.0/0 -j LOG --log-prefix Incoming_Traffic --log-level 4 ipv4 filter OUTPUT 0 -p all -s 0.0.0.0/0 -j LOG --log-prefix Outgoing_Traffic --log-level 4传入流量日志示例输出Raw# tail -f /var/log/messages |grep Incoming_Traffic May 17 08:46:17 vm003 kernel: Incoming_TrafficINens192 OUT MAC00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC192.16.100.40 DST192.16.100.20 LEN104 TOS0x00 PREC0x00 TTL128 ID21890 DF PROTOTCP SPT63559 DPT22 WINDOW1025 RES0x00 ACK PSH URGP0 May 17 08:46:17 vm003 kernel: Incoming_TrafficINens192 OUT MAC00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC192.16.100.40 DST192.16.100.20 LEN104 TOS0x00 PREC0x00 TTL128 ID21891 DF PROTOTCP SPT63559 DPT22 WINDOW1025 RES0x00 ACK PSH URGP0 May 17 08:46:17 vm003 kernel: Incoming_TrafficINens192 OUT MAC00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC192.16.100.40 DST192.16.100.20 LEN104 TOS0x00 PREC0x00 TTL128 ID21892 DF PROTOTCP SPT63559 DPT22 WINDOW1024 RES0x00 ACK PSH URGP0出站流量日志示例输出Raw# tail -f /var/log/messages |grep Outgoing_Traffic May 22 19:56:50 vm003 kernel: Outgoing_Traffic IN OUTens192 SRC192.16.100.20 DST192.16.100.40 LEN120 TOS0x08 PREC0x40 TTL64 ID23391 DF PROTOTCP SPT22 DPT56984 WINDOW503 RES0x00 ACK PSH URGP0 May 22 19:56:50 vm003 kernel: Outgoing_Traffic IN OUTens192 SRC192.16.100.20 DST192.16.100.40 LEN120 TOS0x08 PREC0x40 TTL64 ID23392 DF PROTOTCP SPT22 DPT56984 WINDOW503 RES0x00 ACK PSH URGP0 May 22 19:56:50 vm003 kernel: Outgoing_Traffic IN OUTens192 SRC192.16.100.20 DST192.16.100.40 LEN120 TOS0x08 PREC0x40 TTL64 ID23393 DF PROTOTCP SPT22 DPT56984 WINDOW503 RES0x00 ACK PSH URGP0删除 之前添加的firewalld 直接规则[rootlocalhost ~]# firewall-cmd --direct --get-all-rules ipv4 filter INPUT 0 -p all -s 0.0.0.0/0 -j LOG --log-prefix Incoming_Traffic --log-level 4 ipv4 filter OUTPUT 0 -p all -s 0.0.0.0/0 -j LOG --log-prefix Outgoing_Traffic --log-level 4 [rootlocalhost ~]# firewall-cmd --permanent --direct --remove-rule ipv4 filter INPUT 0 -p all -s 0.0.0.0/0 -j LOG --log-prefix Incoming_Traffic --log-level 4 success [rootlocalhost ~]# firewall-cmd --permanent --direct --remove-rule ipv4 filter OUTPUT 0 -p all -s 0.0.0.0/0 -j LOG --log-prefix Outgoing_Traffic --log-level 4 success [rootlocalhost ~]# firewall-cmd --reload success [rootlocalhost ~]# firewall-cmd --direct --get-all-rules [rootlocalhost ~]#