Centos7之后，就不用iptables控制linux端口了，因为Centos7使用firewalld代替了原来的iptables。

1.查看防火墙状态

[sandwich@centos-elk ~]$ sudo firewall-cmd --state
[sudo] password for sandwich: 
running

2.查询哪些端口是开放的

[sandwich@centos-elk ~]$ sudo firewall-cmd --list-port

3.开放端口

[sandwich@centos-elk ~]$ sudo firewall-cmd --zone=public --add-port=9200/tcp --permanent
success

--zone #作用域

--add-port=9200/tcp #添加端口，格式为：端口/通讯协议

--permanent #永久生效，没有此参数重启后失效

4.查询9200端口是否开启

[sandwich@centos-elk ~]$ sudo firewall-cmd --query-port=9200/tcp
no

5.重新加载防火墙

刚修改完的端口需要重新加载防火墙才生效

[sandwich@centos-elk ~]$ sudo firewall-cmd --reload
success
[sandwich@centos-elk ~]$ sudo firewall-cmd --query-port=9200/tcp
yes

至此，开放端口已经完成了。

6.防火墙操作

检查防火墙状态

[sandwich@centos-elk elk]$ systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
   Active: active (running) since Mon 2022-04-18 07:22:56 PDT; 22h ago
     Docs: man:firewalld(1)
 Main PID: 678 (firewalld)
    Tasks: 2
   Memory: 2.2M
   CGroup: /system.slice/firewalld.service
           └─678 /usr/bin/python2 -Es /usr/sbin/firewalld --nofork --nopid

关闭防火墙

[sandwich@centos-elk elk]$ sudo systemctl stop firewalld.service

开启防火墙

[sandwich@centos-elk elk]$ sudo systemctl start firewalld

设置开机启动防火墙

[sandwich@centos-elk elk]$ sudo systemctl enable firewalld.service
Created symlink from /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service to /usr/lib/systemd/system/firewalld.service.
Created symlink from /etc/systemd/system/multi-user.target.wants/firewalld.service to /usr/lib/systemd/system/firewalld.service.

设置禁止开机启用防火墙

[sandwich@centos-elk elk]$ sudo systemctl disable firewalld.service
Removed symlink /etc/systemd/system/multi-user.target.wants/firewalld.service.
Removed symlink /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.