防火墙作为系统平安的第一道防线，对于护着系统免受外部打至关关键。本文将详细介绍怎么在CentOS系统中设置和优化防火墙策略，以提升系统的平安性。

检查防火墙状态

在更新鲜防火墙设置之前，先说说需要检查防火墙的状态。以下命令能用来检查firewalld服务的状态：

sudo systemctl status firewalld

如果防火墙服务正在运行，您将看到类似以下输出：

firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded 
   Active: active  since Wed 2022-10-05 14:06:48 UTC; 1min 29s ago
   Docs: man:firewalld
   Main PID: 842 
   Tasks: 1 
   Memory: 4.1M
   CGroup: /system.slice/firewalld.service
           └─842 /usr/libexec/firewalld --nofork --nopid --allow-inbound-connections=drop --allow-outbound-connections=drop --allow-connection-scope=link --allow-connection-scope=global --allow-connection-scope=host --allow-connection-scope=network --zone=public --new-session-default=drop --icmfilter=no --direct-icmfilter=yes --ipv6-forward=both --default-icmp-filter=drop --icm-threshold=1 --log-denied=last --log-allowed=last --log-target=syslog --loglevel=5 --log-max-size=10240 --log-addr-info=yes --log-addr-family=inet --log-addr-family=inet6 --log-addr-mask=no --log-addr-mask-family=inet --log-addr-mask-family=inet6 --log-addr-info-mask=no --log-addr-info-mask-family=inet --log-addr-info-mask-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info-mask-size-family=inet6 --log-addr-info-mask-size=32 --log-addr-info

---