---
title: "firewall-cmd通过rich-rule和ipset封IP"
id: "296"
type: "post"
slug: "firewall-cmd%e9%80%9a%e8%bf%87rich-rule%e5%92%8cipset%e5%b0%81ip"
published_at: "2020-05-19T09:11:31+00:00"
modified_at: "2021-11-28T08:11:49+00:00"
url: "https://www.hitsword.org/2020/296.html"
markdown_url: "https://www.hitsword.org/2020/296.md"
excerpt: "单独封222.222.222.222/24 解封222.222.222.222/24 只用rich-rule封 […]"
taxonomy_category:
  - "Centos"
taxonomy_post_tag:
  - "Centos"
  - "firewall-cmd"
  - "ipset"
  - "防火墙"
---

# firewall-cmd通过rich-rule和ipset封IP

单独封222.222.222.222/24

```
firewall-cmd --permanent --zone=public --add-rich-rule 'rule family="ipv4" source address="222.222.222.222/24" drop'
firewall-cmd --reload
```

  
 解封222.222.222.222/24  
```
firewall-cmd --permanent --zone=public --remove-rich-rule 'rule family="ipv4" source address="222.222.222.222/24" drop'
firewall-cmd --reload
```

  
 只用rich-rule封一两条还行，封多了操作麻烦。下面结合ipset来封  
 1.创建一个blacklist  
```
firewall-cmd --permanent --zone=public --new-ipset=blacklist --type=hash:net
firewall-cmd --reload
```

  
 2.添加IP到blasklist  
```
firewall-cmd --permanent --zone=public --ipset=blacklist --add-entry=222.222.222.222/24
```

  
 3.把blacklist用rich-rule封掉  
```
firewall-cmd --permanent --zone=public --add-rich-rule='rule source ipset=blacklist drop'
firewall-cmd --reload
firewall-cmd --list-all
firewall-cmd --info-ipset=blacklist
```

  
 根据IP放行同理，把drop换成accept即可