阻止到IP 7防火墙的smtp服务

Question

我想知道如何阻止IP使用带有centos 7防火墙的服务器上的smtp服务。我试着用这样的方法：

   firewall-cmd --permanent --zone="public" --add-rich-rule='rule family=ipv4 source address=[ipadress] --remove-service=smtp'

但不是正确的语法

还是应该阻止TCP端口25、465和587？

另外，如果有人可以告诉我如何自动从文件中获取de (如果可能的话)，那就太好了。

Answer 1

正如firewalld.richlanguage(5)手册中所描述的，正确的语法是：

# firewall-cmd --zone="FedoraWorkstation" \
  --add-rich-rule='rule family=ipv4 source address=1.2.3.4 service name=smtp reject'
success

# iptables-save | grep 1.2.3.4
-A IN_FedoraWorkstation_deny -s 1.2.3.4/32 -p tcp -m tcp --dport 25 -m conntrack --ctstate NEW -j REJECT --reject-with icmp-port-unreachable

请注意，这适用于端口25/tcp的传入通信量，如服务文件/usr/lib/firewalld/services/smtp.xml中所述：

<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>Mail (SMTP)</short>
  <description>This option allows incoming SMTP mail delivery. If you need to allow remote hosts to connect directly to your machine to deliver mail, enable this option. You do not need to enable this if you collect your mail from your ISP's server by POP3 or IMAP, or if you use a tool such as fetchmail. Note that an improperly configured SMTP server can allow remote machines to use your server to send spam.</description>
  <port protocol="tcp" port="25"/>
</service>