ORACLE 19c RAC防火墙设置

郑全

--1.最核心的部分

--增加公网
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.133.0/24" accept'
--增加私网
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/16" accept'
--增加haip
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="169.254.0.0/16" accept'



--2.可以缩小范围，具体的IP
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.133.203/32" accept'
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.133.204/32" accept'
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.133.254/32" accept'
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.133.253/32" accept'

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.203/32" accept'
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.1.203/32" accept'
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.2.203/32" accept'
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.204/32" accept'
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.1.204/32" accept'
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.2.204/32" accept'

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="169.254.0.0/16" accept'

--3.取消规则
firewall-cmd --permanent --remove-rich-rule='rule family="ipv4" source address="10.0.0.203/32" accept'
firewall-cmd --permanent --remove-rich-rule='rule family="ipv4" source address="10.0.1.203/32" accept'
firewall-cmd --permanent --remove-rich-rule='rule family="ipv4" source address="10.0.2.203/32" accept'
firewall-cmd --permanent --remove-rich-rule='rule family="ipv4" source address="10.0.0.204/32" accept'
firewall-cmd --permanent --remove-rich-rule='rule family="ipv4" source address="10.0.1.204/32" accept'
firewall-cmd --permanent --remove-rich-rule='rule family="ipv4" source address="10.0.2.204/32" accept'

--4.生效

firewall-cmd --reload



#在主机防火墙上添加漏扫设备地址10.100.109.225为白名单
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.100.109.225" accept
#允许备份服务器ssh访问数据库
firewallcmd --permanent -add-rich-rule='rule family="ipv4" source address="10.100.109.148/32" port protocol="tcp" port="22" accept
#允许深信服堡垒机ssh访问数据库
firewa-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.101.140.253/32" port protocol="tcp" port="22" accept
#允许应用服务器访问
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.100.194.0/24" accept