企业官网建设流程全解析

1.web主机放开8088端口并限制来源:

明确三个虚拟机的ip地址

ansible:192.168.88.130

dns:192.168.88.131

web:192.168.88.132

设开机自启并立即启动

[root@web ~]# systemctl enable --now firewalld
Created symlink '/etc/systemd /system/dbus-org.fedoraproject.FirewallD1.service' → '/usr/lib/systemd/system/firewalld.service'.
Created symlink '/etc/systemd/system/multi-user.target.wants/firewalld.service' → '/usr/lib/systemd/system/firewalld.service'

首先启动防火墙

[root@web ~]# systemctl start firewalld

在web虚拟机上输入以放开8088端口

[root@web ~]# firewall-cmd --permanent --add-service=8088/tcp

success

查看public zone所有规则

[root@web ~]# firewall-cmd --list-all
public (default, active)
target: default
ingress-priority: 0
egress-priority: 0
icmp-block-inversion: no
interfaces: ens160
sources:
services: cockpit dhcpv6-client ssh
ports:
protocols:
forward: yes
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:

重载生效服务

[root@web ~]# firewall-cmd --reload
success

放行后，再次查看所有规则

[root@web ~]# firewall-cmd --list-all
public (default, active)
target: default
ingress-priority: 0
egress-priority: 0
icmp-block-inversion: no
interfaces: ens160
sources:
services: cockpit dhcpv6-client ssh
ports: 8088/tcp
protocols:
forward: yes
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:

在dns上输入，要先安装nmap

nmap -p 8088 192.168.88.132

输入完毕

切回web主机，删除port规则，改用rich富规则
[root@web ~]# firewall-cmd --permanent --remove-port=8088/tcp
success

[root@web ~]# firewall-cmd --list-all
public (default, active)
target: default
ingress-priority: 0
egress-priority: 0
icmp-block-inversion: no
interfaces: ens160
sources:
services: cockpit dhcpv6-client ssh
ports:
protocols:
forward: yes
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:

删除port后，此时访问信息中closed变为filtered

添加新规则，只允许ansible访问，其他全拒绝
[root@web ~]# firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address ="192.168.88.130/32" port protocol="tcp" port="8088" accept'
success

重载生效服务

[root@web ~]# firewall-cmd --reload
success

新规则写入

[root@web ~]# firewall-cmd --list-all
public (default, active)
target: default
ingress-priority: 0
egress-priority: 0
icmp-block-inversion: no
interfaces: ens160
sources:
services: cockpit dhcpv6-client ssh
ports:
protocols:
forward: yes
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family="ipv4" source address="192.168.88.130/32" port port="8088" protocol="tcp" accept

切换到ansible主机
[root@ansible ~]# curl 192.168.88.132:8088
curl: (7) Failed to connect to 192.168.88.132 port 8088 after 1 ms: Could not connect to server

日志定时备份
[root@ansible ~]# mkdir -p /opt/ops/backup
[root@ansible ~]# crontab -e
crontab: installing new crontab
Backup of root's previous crontab saved to /root/.cache/crontab/crontab.bak

添加富规则，只允许ansible访问，其他全拒绝
[root@web ~]# firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address ="192.168.88.130/32" port protocol="tcp" port="8088" accept'
success

重载生效服务

[root@web ~]# firewall-cmd --reload
success

查看富规则是否写入

[root@web ~]# firewall-cmd --list-all
public (default, active)
target: default
ingress-priority: 0
egress-priority: 0
icmp-block-inversion: no
interfaces: ens160
sources:
services: cockpit dhcpv6-client ssh
ports:
protocols:
forward: yes
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family="ipv4" source address="192.168.88.130/32" port port="8088" protocol="tcp" accept
（富规则成功写入）

切换到ansible主机
[root@ansible ~]# curl 192.168.88.132:8088
curl: (7) Failed to connect to 192.168.88.132 port 8088 after 1 ms: Could not connect to server

做完以后备份

[root@ansible ~]# mkdir -p /opt/ops/backup
[root@ansible ~]# crontab -e
crontab: installing new crontab
Backup of root's previous crontab saved to /root/.cache/crontab/crontab.bak

打最后一行

确认已经录入

查看任务

[root@ansible ~]# ls /opt/ops/backup
backup_chrony.sh chrony.conf-20261024-101125 chrony.conf-20261026-190242
check.log chrony.conf-20261024-101139

通过本次作业，我深入掌握了 Linux 系统安全与自动化运维的核心技能。在防火墙配置中，我学会了利用 firewall-cmd 结合 rich rule 实现从“端口开放”到“指定 IP 精细化管控”的策略升级，并通过 nmap 测试不同主机对端口状态（closed/filtered）的反馈，深刻理解了防火墙规则对网络流量的拦截逻辑及验证方法；在日志备份任务中，我熟练运用了 crontab 定时任务调度与 Shell 脚本中的日期格式化命令，实现了日志文件的自动化、规范化归档。这次实践不仅提升了我的命令行操作能力，更让我建立了“配置需验证、运维要自动化”的严谨思维，为后续系统管理工作打下了坚实基础。