为什么CentOS 7上的Firewalldconfiguration无法启动并显示iptables错误？

我想：

1. 删除外部networking中除80和443之外的所有传入连接
2. 允许192.168.0.0/16上的内部机器连接到：9000：8080

以下是我通过firewall-cmd设置我的drop区的过程：

 echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf sysctl -p systemctl start firewalld.service systemctl enable firewalld firewall-cmd --set-default-zone=drop firewall-cmd --permanent --zone=drop --add-service=ssh firewall-cmd --permanent --zone=drop --add-port=80/tcp firewall-cmd --permanent --zone=drop --add-port=443/tcp firewall-cmd --zone=drop --permanent --add-rich-rule='rule source address="192.168.0.0/16" port port="9000" protocol="tcp" accept' firewall-cmd --zone=drop --permanent --add-rich-rule='rule source address="192.168.0.0/16" port port="8080" protocol="tcp" accept' firewall-cmd --reload 

以下是活动drop区的外观：

 [root@machine ~]# firewall-cmd --zone=drop --list-all drop (default, active) interfaces: eth0 vethadc7c41 vethaef84e2 vethd53fa38 sources: services: ssh ports: 443/tcp 80/tcp masquerade: no forward-ports: icmp-blocks: rich rules: rule family="ipv4" source address="192.168.0.0/16" port port="9000" protocol="tcp" accept rule family="ipv4" source address="192.168.0.0/16" port port="8080" protocol="tcp" accept 

这似乎确定; 然而，我重新加载后遇到问题：

• 多个firewalld区可以在任何特定时间活动？
• 在maildir中找不到postfix / mailx邮件，为什么不呢？
• 在CentOS 7上安装OpenLDAP
• 无法ping到本地主机到CentOS
• 我如何能够拍摄CentOS 5服务器的快照并稍后进行比较？

 [root@machine ~]# systemctl status firewalld -l firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled) Active: active (running) since Sun 2014-12-21 19:48:53 UTC; 2s ago Main PID: 21689 (firewalld) CGroup: /system.slice/firewalld.service └─21689 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid Dec 21 19:48:53 machine.hostname systemd[1]: Started firewalld - dynamic firewall daemon. Dec 21 19:48:56 machine.hostname firewalld[21689]: 2014-12-21 19:48:56 ERROR: '/sbin/iptables -t filter -A DROP_allow -s 192.168.0.0/16 -m tcp -p tcp --dport 9000 -m conntrack --ctstate NEW -j ACCEPT' failed: iptables: No chain/target/match by that name. Dec 21 19:48:56 machine.hostname firewalld[21689]: 2014-12-21 19:48:56 ERROR: '/sbin/iptables -t filter -A DROP_allow -s 192.168.0.0/16 -m tcp -p tcp --dport 9000 -m conntrack --ctstate NEW -j ACCEPT' failed: iptables: No chain/target/match by that name. Dec 21 19:48:56 machine.hostname firewalld[21689]: 2014-12-21 19:48:56 ERROR: COMMAND_FAILED: '/sbin/iptables -t filter -A DROP_allow -s 192.168.0.0/16 -m tcp -p tcp --dport 9000 -m conntrack --ctstate NEW -j ACCEPT' failed: iptables: No chain/target/match by that name. Dec 21 19:48:56 machine.hostname firewalld[21689]: 2014-12-21 19:48:56 ERROR: '/sbin/iptables -t filter -A DROP_allow -s 192.168.0.0/16 -m tcp -p tcp --dport 8080 -m conntrack --ctstate NEW -j ACCEPT' failed: iptables: No chain/target/match by that name. Dec 21 19:48:56 machine.hostname firewalld[21689]: 2014-12-21 19:48:56 ERROR: '/sbin/iptables -t filter -A DROP_allow -s 192.168.0.0/16 -m tcp -p tcp --dport 8080 -m conntrack --ctstate NEW -j ACCEPT' failed: iptables: No chain/target/match by that name. Dec 21 19:48:56 machine.hostname firewalld[21689]: 2014-12-21 19:48:56 ERROR: COMMAND_FAILED: '/sbin/iptables -t filter -A DROP_allow -s 192.168.0.0/16 -m tcp -p tcp --dport 8080 -m conntrack --ctstate NEW -j ACCEPT' failed: iptables: No chain/target/match by that name. 

我有点困惑，因为我认为firewall-cmd是一个抽象，与iptables相互排斥，后者是我不应该惹的祸。

这是我的版本：

 [machine@douglasii ~]# firewall-cmd -V 0.3.9 [machine@douglasii ~]# cat /proc/version Linux version 3.16.7-x86_64-linode49 (maker@build) (gcc version 4.7.2 (Debian 4.7.2-5) ) #3 SMP Fri Nov 14 16:55:37 EST 2014 [machine@douglasii ~]# cat /etc/redhat-release CentOS Linux release 7.0.1406 (Core) [machine@douglasii ~]# iptables -v iptables v1.4.21: no command specified Try `iptables -h' or 'iptables --help' for more information.