systemctl status firewall  
    #查看firewall服务状态
firewall-cmd --state        
    #查看firewall的状态
firewall-cmd --list-all
    #查看防火墙规则（只显示/etc/firewalld/zones/public.xml中防火墙策略）
firewall-cmd --list-all-zones
    #查看所有的防火墙策略（即显示/etc/firewalld/zones/下的所有策略）
firewall-cmd --reload
    #重新加载配置文件

[root@nginx01 zones]# cat public.xml
<?xml version="1.0" encoding="utf-8"?>
<zone>
  <short>Public</short>
  <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
  <rule family="ipv4">
    <source address="122.x.x.234"/>
    <port protocol="udp" port="514"/>
    <accept/>
  </rule>
  <rule family="ipv4">
    <source address="123.x.x.14"/>
    <port protocol="tcp" port="10050-10051"/> ##可以开放端口地址范围"10050-10051"，不单只限定一个端口
    <accept/>
  </rule>
<rule family="ipv4">
    <source address="192.x.x.114"/>      ##放通指定ip，指定端口、协议
    <port protocol="tcp" port="80"/>
    <accept/>
  </rule>
<rule family="ipv4">                        ##放通任意ip访问服务器的9527端口
    <port protocol="tcp" port="9527"/>
    <accept/>
  </rule>
</zone>


firewall-cmd --reload
service firewalld restart    #使配置文件重新加载

firwall-cmd --permanent --add-port=9527/tcp    插入防火墙规则，放通9527端口。
success

<zone>
  <short>xx.</short>
  <description>xxx.</description>
  <port protocol="tcp" port="9527"/>
</zone>

service firewalld restart
firewall-cmd --reload         #重启或重新加载配置文件，使配置生效  
firewall-cmd --list-all
firewall-cmd --permanent --query-port=9527/tcp    #查询刚插入的规则是否生效

firewall-cmd --zone=public --add-port=80/tcp --permanent    添加防火墙规则；
firewall-cmd --reload    重新加载防火墙；
firewall-cmd --permanent --zone=public --add-masquerade    允许内网上网；

firewall-cmd --permanent --add-rich-rule 'rule family=ipv4 source address=122.x.x.234/24 port port=5423 protocol=tcp drop'    
firewall-cmd --permanent --add-rich-rule 'rule family=ipv4 source address=122.x.x.234 port port=80 protocol=tcp accept'    
firewall-cmd --reload
[root@nginx02 ~]# firewall-cmd --list-all
public (default, active)
  interfaces: em1
  sources:
  services:
  ports:
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules:
    rule family="ipv4" source address="122.x.x.234" port port="5234" protocol="tcp" drop
    rule family="ipv4" source address="122.x.x.234" port port="80" protocol="tcp" accept
    rule family="ipv4" source address="123.x.x.14" port port="10050-10051" protocol="tcp" accept

cat /etc/firewalld/zones/ssh.xml
<?xml version='1.0' encoding='utf-8'?>
<zone>
  <short>ssh</short>
  <description>ssh.</description>
#fortress-new
  <source address='122.x.x.2/29'/>
  <service name='ssh'/>
</zone>

firewall-cmd --list-all-zones
...
ssh
  interfaces:
  sources: 122.x.x.2/29
  services: ssh
  ports:
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules:
...

cat /usr/lib/firewalld/services/ssh.xml

<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>SSH</short>
  <description>Secure Shell (SSH) is a protocol for logging into and executing commands on remote machines. It provides secure encrypted communications. If you plan on accessing your machine remotely via SSH over a firewalled interface, enable this option. You need the openssh-server package installed for this option to be useful.</description>
  <port protocol="tcp" port="22"/>
</service>

自定义服务(mongo.xml)模块
cat /usr/lib/firewalld/services/mongo.xml
<service>
  <short>mongo</short>
  <description>The service of mongo.</description>
  <port protocol="tcp" port="27017"/>
</service>

防火墙应用服务器模块
cat /etc/firewalld/zones/mongo.xml
<zone>
  <short>mongo</short>
  <description>mongo service</description>
  <source address="2.2.2.2/24"/>
  <service name="mongo"/>
</zone>

查看mongo.xml服务的防火墙生效情况
firewall-cmd --list-all-zones
...
mongo
  interfaces:
  sources: 2.2.2.2/24
  services: mongo
  ports:
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules:
...

cat multi.xml

<zone>
  <short> multi services</short>
  <description>IP of 10.10.86.44 apply in multi srevices.</description>
  <source address="10.10.86.44"/>
  <service name="ssh"/>
  <service name="mysql"/>
  <service name="http"/>        ##同时添加多个服务
</zone>

firewall-cmd --list-all-zones
...
multi
  interfaces:
  sources: 10.10.86.44
  services: http mysql ssh
  ports:
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules:
...

service firewalld restart
firewall-cmd --reload