我正在使用以下内容：
# cat /etc/redhat-release CentOS Linux release 7.1.1503 (Core) # rpm -q firewalld firewalld-0.3.9-11.el7.noarch # 我试图阻止特定的IP地址（10.52.208.220）从我的系统到达它，但无法这样做：
之前：
# firewall-cmd --reload success # firewall-cmd --list-all public (default, active) interfaces: eno1 sources: services: dhcpv6-client high-availability http https ssh ports: 5666/tcp 3306/tcp 5900/tcp 9001/tcp masquerade: no forward-ports: icmp-blocks: rich rules: # ping -c1 wcmisdlin01 PING wcmisdlin01.uftmasterad.org (10.52.208.220) 56(84) bytes of data. 64 bytes from wcmisdlin01.uftmasterad.org (10.52.208.220): icmp_seq=1 ttl=64 time=0.379 ms --- wcmisdlin01.uftmasterad.org ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.379/0.379/0.379/0.000 ms #
后：
# firewall-cmd --add-rich-rule='rule family="ipv4" destination address="10.52.208.220" protocol value="icmp" reject' success # firewall-cmd --list-all public (default, active) interfaces: eno1 sources: services: dhcpv6-client high-availability http https ssh ports: 5666/tcp 3306/tcp 5900/tcp 9001/tcp masquerade: no forward-ports: icmp-blocks: rich rules: rule family="ipv4" destination address="10.52.208.220" protocol value="icmp" reject # ping -c1 wcmisdlin01 PING wcmisdlin01.uftmasterad.org (10.52.208.220) 56(84) bytes of data. 64 bytes from wcmisdlin01.uftmasterad.org (10.52.208.220): icmp_seq=1 ttl=64 time=0.266 ms --- wcmisdlin01.uftmasterad.org ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.266/0.266/0.266/0.000 ms #
IPTABLES(8) - iptables/ip6tables — administration tool for IPv4/IPv6 packet filtering and NAT
# iptables --list IN_public_deny Chain IN_public_deny (1 references) target prot opt source destination REJECT icmp -- anywhere wcmisdlin01.uftmasterad.org ctstate NEW reject-with icmp-port-unreachable #
我究竟做错了什么？
在检查完整的iptables -n --list输出后，（最终）从INPUT链中调用IN_public_deny ，这与从系统发送给未经授权的主机的数据包无关。 这些数据包是通过OUTPUT链（或者如果防火墙是源和目的地之间的路由器或网桥，则可能是FORWARD路由。 firewalld.richlanguage(5)似乎没有提供任何指定该规则必须进入OUTPUT （或FORWARD ）链的方法，所以直接规则的“最后的手段”选项似乎是一个解决scheme。
firewall-cmd --direct --add-rule ipv4 filter OUTPUT_direct 0 -p icmp -d 10.52.208.220 -j REJECT --reject-with icmp-host-prohibited
（虽然通常我更喜欢DROP（也可能是带有速率限制的LOG），而不是发送ICMP拒绝，就好像要阻塞的主机发生了什么事情一样，把ICMP响应数据包丢回到一个负担很重的networking上，从坏到坏…）