{"id":34208,"date":"2026-11-03T12:00:00","date_gmt":"2026-11-03T04:00:00","guid":{"rendered":"https:\/\/cn.hostease.com\/blog\/?p=34208"},"modified":"2026-10-26T09:29:18","modified_gmt":"2026-10-26T01:29:18","slug":"vps-firewall-ufw-firewalld-minimal-rules","status":"publish","type":"post","link":"https:\/\/cn.hostease.com\/blog\/tutorials\/vps-firewall-ufw-firewalld-minimal-rules\/","title":{"rendered":"VPS \u9632\u706b\u5899\u7aef\u53e3\u7ba1\u7406\u5165\u95e8\uff1aufw \u4e0e firewalld \u7684\u6700\u5c0f\u5b89\u5168\u89c4\u5219\u96c6"},"content":{"rendered":"<p><a href=\"https:\/\/cn.hostease.com\/vps\/\">VPS<\/a>\uff08<a href=\"https:\/\/cn.hostease.com\/vps\/\">\u865a\u62df\u4e13\u7528\u670d\u52a1\u5668<\/a>\uff09\u521a\u4ea4\u4ed8\u7684\u90a3\u51e0\u5c0f\u65f6\uff0c\u6700\u5bb9\u6613\u57cb\u4e0b\u9690\u60a3\uff1a\u591a\u6570\u7cfb\u7edf\u955c\u50cf\u7684\u9632\u706b\u5899\u8981\u4e48\u5b8c\u5168\u5173\u95ed\uff0c\u8981\u4e48\u6cbf\u7528\u4e91\u5382\u5546\u504f\u5bbd\u677e\u7684\u9ed8\u8ba4\u7b56\u7565\uff0c\u7b49\u5230\u626b\u63cf\u5668\u5f00\u59cb\u6572 22\u30013306\u30016379 \u7aef\u53e3\u65f6\u624d\u60f3\u8d77\u6765\u8865\u89c4\u5219\u3002\u7aef\u53e3\u8be5\u5f00\u54ea\u51e0\u4e2a\u3001\u89c4\u5219\u6309\u4ec0\u4e48\u987a\u5e8f\u5199\u3001\u6539\u5b8c\u5982\u4f55\u786e\u8ba4\u5916\u90e8\u771f\u7684\u8fde\u4e0d\u4e0a\uff0c\u8fd9\u4e09\u4ef6\u4e8b\u51b3\u5b9a\u4e86\u540e\u9762\u51e0\u4e2a\u6708\u8fd0\u7ef4\u662f\u5426\u7701\u5fc3\u3002\u8fd9\u7bc7\u5165\u95e8\u6307\u5357\u7ed9\u51fa\u4e00\u5957\u53ef\u4ee5\u76f4\u63a5\u7167\u6284\u7684\u6700\u5c0f\u89c4\u5219\u96c6\uff1a\u9ed8\u8ba4\u62d2\u7edd\u5165\u7ad9\u3001\u53ea\u653e\u884c SSH \u4e0e\u7f51\u7ad9\u7aef\u53e3\uff0c\u7528 ufw \u6216 firewalld \u4efb\u9009\u4e00\u79cd\u843d\u5730\uff0c\u6700\u540e\u518d\u4ece\u5916\u90e8\u63a2\u6d4b\u9a8c\u8bc1\u6548\u679c\u3002<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cn.hostease.com\/blog\/wp-content\/uploads\/2026\/10\/vps-firewall-ufw-firewalld-cover.webp\" alt=\"VPS \u9632\u706b\u5899\u6700\u5c0f\u89c4\u5219\u96c6\u5c01\u9762\u56fe\" loading=\"lazy\" \/><\/p>\n<h2>\u5148\u5b9a\u7b56\u7565\uff0c\u518d\u6311\u5de5\u5177<\/h2>\n<p>\u9632\u706b\u5899\u7684\u4ef7\u503c\u4e0d\u5728&#8221;\u5f00\u4e86&#8221;,\u800c\u5728&#8221;\u53ea\u5f00\u8be5\u5f00\u7684&#8221;\u3002\u9ed8\u8ba4\u62d2\u7edd\u5165\u7ad9\u3001\u6309\u767d\u540d\u5355\u653e\u884c\uff0c\u8fd9\u5957\u601d\u8def\u5728 ufw \u548c firewalld \u4e0a\u662f\u540c\u4e00\u56de\u4e8b\uff0c\u533a\u522b\u53ea\u5728\u8868\u8fbe\u65b9\u5f0f\uff1aufw \u9762\u5411\u547d\u4ee4\u884c\u7684\u7b80\u5355\u89c4\u5219\u5217\u8868\uff0c\u4e00\u6761\u4e00\u6761\u8ffd\u52a0\uff1bfirewalld \u7528 zone\uff08\u533a\u57df\uff09\u548c service\uff08\u670d\u52a1\u5b9a\u4e49\uff09\u505a\u5206\u5c42\uff0c\u628a\u89c4\u5219\u6302\u5230\u7f51\u5361\u6240\u5c5e\u7684\u533a\u57df\u4e0a\u3002<\/p>\n<p>\u4e24\u8005\u5e95\u5c42\u90fd\u8c03\u7528\u5185\u6838\u7684\u5305\u8fc7\u6ee4\u673a\u5236\uff0c\u6240\u4ee5\u771f\u6b63\u9700\u8981\u5b88\u4f4f\u7684\u53ea\u6709\u4e00\u6761\u94c1\u5f8b\uff1a\u540c\u4e00\u53f0\u673a\u5668\u4e0a\u53ea\u542f\u7528\u5176\u4e2d\u4e00\u4e2a\u3002ufw \u4e0e firewalld \u540c\u65f6\u8fd0\u884c\u65f6\u4f1a\u4e92\u76f8\u8986\u76d6\u5bf9\u65b9\u7684\u89c4\u5219\u94fe\uff0c\u5178\u578b\u75c7\u72b6\u662f <code>ufw status<\/code> \u663e\u793a\u7aef\u53e3\u5df2\u62d2\u7edd\uff0c\u4ece\u5916\u90e8\u5374\u4f9d\u7136\u80fd\u8fde\u4e0a\u2014\u2014\u56e0\u4e3a firewalld \u7684\u89c4\u5219\u5148\u4e00\u6b65\u653e\u884c\u4e86\u6d41\u91cf\u3002\u5224\u65ad\u5f53\u524d\u73af\u5883\u7528\u54ea\u4e2a\uff0c\u770b\u5305\u7ba1\u7406\u6765\u6e90\u5c31\u591f\u4e86\uff1aDebian\/Ubuntu \u7cfb\u9ed8\u8ba4 ufw\uff0cRHEL\u3001Rocky\u3001AlmaLinux\u3001CentOS Stream \u7cfb\u9ed8\u8ba4 firewalld\u3002<\/p>\n<p>\u5728\u52a8\u624b\u524d\u5148\u76d8\u70b9\u8fd9\u53f0\u673a\u5668\u5bf9\u5916\u63d0\u4f9b\u7684\u670d\u52a1\u3002\u7528 <code>ss -lntp<\/code> \u5217\u51fa\u6240\u6709\u76d1\u542c\u4e2d\u7684 TCP \u7aef\u53e3\uff0c\u628a&#8221;\u5fc5\u987b\u7ed9\u516c\u7f51&#8221;\u548c&#8221;\u53ea\u7ed9\u5185\u7f51\u6216\u672c\u673a&#8221;\u5206\u5f00\u8bb0\u5f55\uff0c\u540e\u9762\u5199\u89c4\u5219\u65f6\u4e25\u683c\u6309\u8fd9\u4efd\u6e05\u5355\u6765\uff0c\u4e0d\u8981\u51ed\u5370\u8c61\u3002\u670d\u52a1\u5668\u4e0a\u5e38\u89c1\u7684\u5bf9\u5916\u5165\u53e3\u901a\u5e38\u53ea\u6709\u4e09\u4e2a\uff1aSSH\u3001HTTP\u3001HTTPS\u3002\u66f4\u591a\u7aef\u53e3\u66b4\u9732\u9762\u7684\u6574\u7406\u601d\u8def\u53ef\u53c2\u8003\u7ad9\u5185<a href=\"https:\/\/cn.hostease.com\/blog\/server\/\">\u670d\u52a1\u5668\u5206\u7c7b\u6587\u7ae0<\/a>\u3002<\/p>\n<h2>\u6700\u5c0f\u5b89\u5168\u89c4\u5219\u96c6\u5305\u542b\u54ea\u51e0\u6761<\/h2>\n<p>\u628a\u4e0a\u9762\u7684\u6e05\u5355\u538b\u7f29\u6210\u901a\u7528\u89c4\u5219\uff0c\u4e00\u5171\u4e94\u6761\uff0c\u8986\u76d6\u7edd\u5927\u591a\u6570\u5efa\u7ad9\u573a\u666f\uff1a<\/p>\n<ul>\n<li>\u5165\u7ad9\u9ed8\u8ba4\u62d2\u7edd\uff1a<code>ufw default deny incoming<\/code>\uff0cfirewalld \u5219\u628a\u7f51\u5361\u653e\u8fdb <code>public<\/code> \u533a\u57df\u5e76\u53ea\u6dfb\u52a0\u663e\u5f0f service\u3002<\/li>\n<li>\u7ba1\u7406\u901a\u9053\u9650\u5b9a\u6765\u6e90\uff1aSSH \u4e0d\u4e00\u5b9a\u8981\u5bf9\u5168\u7f51\u5f00\u653e\uff0c<code>ufw allow from 203.0.113.10 to any port 22 proto tcp<\/code> \u53ea\u653e\u884c\u56fa\u5b9a\u7ba1\u7406 IP\u3002<\/li>\n<li>\u4e1a\u52a1\u7aef\u53e3\u6309\u9700\u653e\u884c\uff1a\u7ad9\u70b9\u7528 <code>ufw allow 80,443\/tcp<\/code>\uff1b\u4e34\u65f6\u8c03\u8bd5\u7684 8080\u30019000 \u9a8c\u8bc1\u5b8c\u5f53\u5929\u5c31\u5220\u6389\u3002<\/li>\n<li>\u51fa\u7ad9\u5148\u5bbd\u677e\u540e\u6536\u655b\uff1a\u9ed8\u8ba4 <code>allow outgoing<\/code>\uff0c\u7b49\u4e1a\u52a1\u7a33\u5b9a\u518d\u6309\u57df\u540d\u6216 IP \u6bb5\u6536\u7d27\uff0c\u907f\u514d\u4e00\u5f00\u59cb\u5c31\u628a\u5305\u7ba1\u7406\u5668\u548c\u66f4\u65b0\u6e90\u6321\u4f4f\u3002<\/li>\n<li>\u4fdd\u7559 ICMP \u4e0e loopback\uff1a\u5168\u9762\u4e22\u5f03 echo-request \u4f1a\u7834\u574f\u8def\u5f84 MTU \u53d1\u73b0\uff0c\u8868\u73b0\u4e3a SSH \u80fd\u767b\u5f55\u4f46\u5927\u6587\u4ef6\u4f20\u8f93\u5361\u6b7b\u3002<\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"https:\/\/cn.hostease.com\/blog\/wp-content\/uploads\/2026\/10\/vps-firewall-default-deny-path.webp\" alt=\"\u9ed8\u8ba4\u62d2\u7edd\u7b56\u7565\u4e0b\u53ea\u653e\u884c\u767d\u540d\u5355\u7aef\u53e3\u7684\u793a\u610f\" loading=\"lazy\" \/><\/p>\n<p>\u7ad9\u70b9\u4e0a\u7ebf\u540e\u5982\u679c\u8fd8\u60f3\u8fdb\u4e00\u6b65\u538b\u7f29\u9996\u5b57\u8282\u65f6\u95f4\uff0c\u53ef\u4ee5\u987a\u7740<a href=\"https:\/\/cn.hostease.com\/blog\/guides\/ttfb-hosting-optimization\/\">\u7f51\u7ad9\u6027\u80fd\u4f18\u5316\u6587\u7ae0<\/a>\u7684\u6392\u67e5\u987a\u5e8f\u505a\uff0c\u4f46\u524d\u63d0\u662f\u7aef\u53e3\u7b56\u7565\u5df2\u7ecf\u7a33\u5b9a\uff0c\u5426\u5219\u6027\u80fd\u8c03\u4f18\u7684\u6570\u636e\u6ca1\u6709\u53ef\u6bd4\u6027\u3002<\/p>\n<h2>\u5728 Ubuntu \u4e0e Debian \u4e0a\u7528 ufw \u843d\u5730<\/h2>\n<p>ufw \u7684\u4f18\u70b9\u662f\u8bed\u6cd5\u77ed\uff0c\u51e0\u6761\u547d\u4ee4\u5c31\u80fd\u4ece\u96f6\u5230\u53ef\u7528\u3002\u4e0b\u9762\u8fd9\u6bb5\u53ef\u4ee5\u76f4\u63a5\u590d\u5236\u6267\u884c\uff0c\u987a\u5e8f\u4e0d\u8981\u8c03\u6574\u2014\u2014\u5148\u628a\u5165\u7ad9\u9ed8\u8ba4\u7b56\u7565\u8bbe\u6210\u62d2\u7edd\uff0c\u518d\u653e\u884c SSH\uff0c\u6700\u540e\u624d\u542f\u7528\u670d\u52a1\uff1b\u5982\u679c\u53cd\u8fc7\u6765\u5148 <code>enable<\/code> \u518d\u653e\u884c\uff0c\u5f53\u524d\u4f1a\u8bdd\u4f1a\u5728\u4e0b\u4e00\u6b65\u65ad\u5f00\u3002<\/p>\n<pre><code class=\"language-bash\">sudo ufw default deny incoming\nsudo ufw default allow outgoing\nsudo ufw limit 22\/tcp\nsudo ufw allow 80,443\/tcp\nsudo ufw --dry-run enable\nsudo ufw enable\nsudo ufw status numbered\n<\/code><\/pre>\n<p><code>--dry-run<\/code> \u53ea\u6253\u5370\u5c06\u8981\u5199\u5165\u7684\u89c4\u5219\u800c\u4e0d\u771f\u6b63\u751f\u6548\uff0c\u9002\u5408\u5728\u6539\u751f\u4ea7\u673a\u524d\u9884\u89c8\u4e00\u904d\uff1b<code>status numbered<\/code> \u4f1a\u7ed9\u51fa\u6bcf\u6761\u89c4\u5219\u7684\u5e8f\u53f7\uff0c\u5220\u89c4\u5219\u65f6\u7528 <code>sudo ufw delete 3<\/code> \u6bd4\u5bf9\u7740\u5185\u5bb9\u731c\u66f4\u65b9\u4fbf\u3002<code>limit<\/code> \u7684\u4f5c\u7528\u662f\u7ed9\u540c\u4e00\u4e2a\u6765\u6e90 IP \u7684\u8fde\u63a5\u9891\u7387\u8bbe\u4e0a\u9650\uff0c\u9ed8\u8ba4 30 \u79d2\u5185\u5141\u8bb8 6 \u6b21\u65b0\u8fde\u63a5\uff0c\u8d85\u8fc7\u7684\u5305\u88ab\u4e22\u5f03\uff0c\u5bf9 SSH \u7206\u7834\u6709\u76f4\u63a5\u7684\u51cf\u901f\u6548\u679c\uff0c\u4f46\u5b83\u4e0d\u662f\u8ba4\u8bc1\u624b\u6bb5\uff0c\u5bc6\u94a5\u767b\u5f55\u548c\u7981\u7528 root \u5bc6\u7801\u767b\u5f55\u4ecd\u7136\u8981\u505a\u3002<\/p>\n<p>\u7ad9\u70b9\u8dd1 WordPress \u65f6\uff0c\u771f\u6b63\u9700\u8981\u957f\u671f\u5bf9\u5916\u5f00\u653e\u7684\u53ea\u6709 80 \u4e0e 443\uff1b\u6570\u636e\u5e93 3306\u3001\u7f13\u5b58 6379 \u8fd9\u7c7b\u7aef\u53e3\u5e94\u5f53\u53ea\u76d1\u542c <code>127.0.0.1<\/code>\uff0c\u9760 <code>bind-address<\/code> \u6216 <code>bind 127.0.0.1<\/code> \u5728\u670d\u52a1\u5c42\u5c31\u6321\u4f4f\uff0c\u800c\u4e0d\u662f\u6307\u671b\u9632\u706b\u5899\u89c4\u5219\u4e00\u76f4\u5199\u5bf9\u3002\u7ad9\u5185\u8fd8\u6709\u4e00\u7bc7<a href=\"https:\/\/cn.hostease.com\/blog\/wordpress\/\">WordPress \u5206\u7c7b\u6587\u7ae0<\/a>\u6574\u7406\u4e86\u5e38\u89c1\u7ad9\u70b9\u670d\u52a1\u7684\u7aef\u53e3\u4e0e\u6743\u9650\u914d\u7f6e\uff0c\u53ef\u4ee5\u5bf9\u7167\u68c0\u67e5\u3002\u6539\u5b8c\u89c4\u5219\u540e\u522b\u6025\u7740\u5173\u7ec8\u7aef\uff0c\u5148\u5728\u53e6\u4e00\u4e2a\u7a97\u53e3\u9a8c\u8bc1 SSH \u4ecd\u7136\u53ef\u7528\uff0c\u518d\u7ee7\u7eed\u4e0b\u4e00\u6b65\u3002<\/p>\n<h2>\u5728 RHEL \u7cfb\u4e0a\u7528 firewalld \u8868\u8fbe\u540c\u4e00\u5957\u89c4\u5219<\/h2>\n<p>firewalld \u628a\u89c4\u5219\u5199\u8fdb\u533a\u57df\u6587\u4ef6\uff0c<code>--permanent<\/code> \u8868\u793a\u843d\u5230\u78c1\u76d8\u3001<code>--reload<\/code> \u624d\u8ba9\u8fd0\u884c\u65f6\u751f\u6548\u3002\u5f88\u591a\u4eba\u4ee5\u4e3a\u52a0\u4e86 <code>--permanent<\/code> \u5c31\u5373\u65f6\u751f\u6548\uff0c\u5176\u5b9e\u6ca1\u6709 <code>--reload<\/code> \u4e4b\u524d <code>--list-all<\/code> \u770b\u5230\u7684\u4ecd\u662f\u65e7\u72b6\u6001\uff0c\u8fd9\u662f\u6392\u67e5&#8221;\u89c4\u5219\u52a0\u4e86\u5374\u6ca1\u6321\u4f4f&#8221;\u7684\u5e38\u89c1\u539f\u56e0\u3002<\/p>\n<pre><code class=\"language-bash\">sudo systemctl enable --now firewalld\nsudo firewall-cmd --get-default-zone\nsudo firewall-cmd --permanent --add-service=ssh\nsudo firewall-cmd --permanent --add-service=http\nsudo firewall-cmd --permanent --add-service=https\nsudo firewall-cmd --permanent --add-port=8080\/tcp\nsudo firewall-cmd --reload\nsudo firewall-cmd --list-all\n<\/code><\/pre>\n<p>\u5982\u679c SSH \u53ea\u60f3\u5bf9\u56fa\u5b9a\u7ba1\u7406 IP \u5f00\u653e\uff0c\u7528 rich rule \u66f4\u7cbe\u786e\uff1a<\/p>\n<pre><code class=\"language-bash\">sudo firewall-cmd --permanent --add-rich-rule='rule family=&quot;ipv4&quot; source address=&quot;203.0.113.10&quot; port port=&quot;22&quot; protocol=&quot;tcp&quot; accept'\nsudo firewall-cmd --reload\n<\/code><\/pre>\n<p>\u9ed8\u8ba4\u533a\u57df\u4e00\u822c\u662f <code>public<\/code>\uff0c\u5b83\u672c\u8eab\u5df2\u7ecf\u662f&#8221;\u9ed8\u8ba4\u62d2\u7edd\u5165\u7ad9\u3001\u653e\u884c\u5df2\u58f0\u660e\u670d\u52a1&#8221;\u7684\u8bed\u4e49\uff0c\u6240\u4ee5\u4e0d\u9700\u8981\u989d\u5916\u5199\u62d2\u7edd\u89c4\u5219\u3002\u53cd\u8fc7\u6765\uff0c\u5982\u679c\u67d0\u5f20\u7f51\u5361\u88ab\u9519\u8bef\u5730\u653e\u8fdb\u4e86 <code>trusted<\/code> \u533a\u57df\uff0c\u90a3\u53f0\u673a\u5668\u4e0a\u6240\u6709\u7aef\u53e3\u90fd\u4f1a\u5bf9\u5168\u7f51\u5f00\u653e\u2014\u2014<code>firewall-cmd --get-active-zones<\/code> \u80fd\u76f4\u63a5\u770b\u51fa\u6bcf\u5f20\u7f51\u5361\u5f52\u5c5e\u54ea\u4e2a\u533a\u57df\uff0c\u8fd9\u662f\u63a5\u624b\u4e00\u53f0\u964c\u751f\u673a\u5668\u65f6\u5148\u8dd1\u7684\u547d\u4ee4\u3002\u4e34\u65f6\u6539\u52a8\u60f3\u4fdd\u7559\uff0c\u7528 <code>--runtime-to-permanent<\/code> \u628a\u8fd0\u884c\u65f6\u914d\u7f6e\u6574\u4f53\u5199\u56de\u78c1\u76d8\uff1b\u53ea\u60f3\u64a4\u9500\u67d0\u6761\u89c4\u5219\uff0c\u628a <code>--add-*<\/code> \u6362\u6210 <code>--remove-*<\/code> \u518d reload\u3002<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cn.hostease.com\/blog\/wp-content\/uploads\/2026\/10\/vps-firewall-ufw-vs-firewalld.webp\" alt=\"ufw \u4e0e firewalld \u89c4\u5219\u8868\u8fbe\u65b9\u5f0f\u5bf9\u6bd4\u793a\u610f\" loading=\"lazy\" \/><\/p>\n<h2>\u6539\u5b8c\u4ece\u5916\u90e8\u9a8c\u8bc1\uff0c\u4e0d\u8981\u53ea\u770b\u547d\u4ee4\u56de\u663e<\/h2>\n<p>\u9632\u706b\u5899\u547d\u4ee4\u6267\u884c\u6210\u529f\uff0c\u53ea\u8bf4\u660e\u89c4\u5219\u5199\u8fdb\u4e86\u5185\u6838\uff0c\u4e0d\u8bf4\u660e\u7aef\u53e3\u771f\u7684\u5bf9\u5916\u5173\u95ed\u3002\u5148\u5728\u672c\u673a\u786e\u8ba4\u670d\u52a1\u76d1\u542c\u60c5\u51b5\uff0c\u518d\u4ece\u53e6\u4e00\u53f0\u673a\u5668\u505a\u5916\u90e8\u63a2\u6d4b\uff0c\u4e24\u6b65\u90fd\u8981\u505a\uff1a<code>ss -lntp<\/code> \u770b\u5230\u7684\u662f\u670d\u52a1\u5728\u4e0d\u5728\u542c\uff0c<code>nmap<\/code> \u6216 <code>nc<\/code> \u770b\u5230\u7684\u662f\u6d41\u91cf\u80fd\u4e0d\u80fd\u8fdb\u6765\uff0c\u8fd9\u4e24\u4ef6\u4e8b\u4e92\u76f8\u72ec\u7acb\uff0c\u53ea\u505a\u4e00\u534a\u5c31\u5f88\u5bb9\u6613\u8bef\u5224\u3002<\/p>\n<pre><code class=\"language-bash\"># \u672c\u673a\uff1a\u786e\u8ba4\u76d1\u542c\u5730\u5740\u4e0e\u8fdb\u7a0b\nss -lntp\n\n# \u5916\u90e8\u673a\u5668\uff1a\u53ea\u63a2\u6d4b\u5173\u5fc3\u7684\u7aef\u53e3\nnmap -Pn -p 22,80,443,8080 203.0.113.25\nnc -vz 203.0.113.25 22\n<\/code><\/pre>\n<p>\u7ed3\u679c\u8981\u5206\u4e09\u79cd\u8bfb\u6cd5\u3002<code>open<\/code> \u8868\u793a\u670d\u52a1\u5728\u542c\u4e14\u89c4\u5219\u653e\u884c\uff0c\u7b26\u5408\u9884\u671f\uff1b<code>closed<\/code> \u8868\u793a\u5305\u5230\u8fbe\u4e86\u4e3b\u673a\u4f46\u88ab\u62d2\u7edd\u5e76\u56de\u4e86 RST\uff0c\u901a\u5e38\u662f\u670d\u52a1\u6ca1\u542f\u52a8\u6216\u89c4\u5219\u7528\u4e86 reject\uff1b<code>filtered<\/code> \u8868\u793a\u6ca1\u6709\u4efb\u4f55\u56de\u5305\uff0c\u8bf4\u660e\u5305\u88ab\u9759\u9ed8\u4e22\u5f03\uff0c\u8fd9\u6b63\u662f <code>ufw default deny<\/code> \u7684\u9ed8\u8ba4\u6548\u679c\uff0c\u4e5f\u662f\u5bf9\u5916\u6700\u7701\u4e8b\u7684\u59ff\u6001\u3002\u628a 22 \u4e4b\u5916\u7684\u7aef\u53e3\u4ece <code>open<\/code> \u53d8\u6210 <code>filtered<\/code>\uff0c\u5c31\u7b49\u4e8e\u628a\u8fd9\u53f0\u673a\u5668\u7684\u626b\u63cf\u9762\u538b\u5230\u53ea\u5269\u4e00\u4e2a\u5165\u53e3\u3002<\/p>\n<p>\u9700\u8981\u63d0\u9192\u7684\u4e00\u70b9\uff1a\u628a\u7aef\u53e3\u5173\u6389\u4e0d\u7b49\u4e8e\u628a\u670d\u52a1\u505c\u6389\u3002\u6570\u636e\u5e93\u4ecd\u7136\u5728 3306 \u4e0a\u76d1\u542c\uff0c\u53ea\u662f\u5916\u9762\u8fde\u4e0d\u8fdb\u6765\uff1b\u4e00\u65e6\u54ea\u5929\u9632\u706b\u5899\u89c4\u5219\u88ab\u8bef\u5220\u6216\u5bb9\u5668\u91cd\u5efa\u7ed5\u8fc7\u89c4\u5219\uff0c\u66b4\u9732\u5c31\u662f\u77ac\u95f4\u7684\u4e8b\u3002\u6240\u4ee5\u80fd\u6539\u76d1\u542c\u5730\u5740\u7684\u670d\u52a1\u5c31\u6539\u76d1\u542c\u5730\u5740\uff0c\u9632\u706b\u5899\u53ea\u662f\u5176\u4e2d\u4e00\u5c42\uff0c\u4e0d\u662f\u552f\u4e00\u4e00\u5c42\u3002<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cn.hostease.com\/blog\/wp-content\/uploads\/2026\/10\/vps-firewall-outbound-check.webp\" alt=\"\u4ece\u5916\u90e8\u63a2\u6d4b\u7aef\u53e3\u72b6\u6001\u7684\u9a8c\u8bc1\u6d41\u7a0b\u793a\u610f\" loading=\"lazy\" \/><\/p>\n<h2>\u56db\u4e2a\u5bb9\u6613\u7ffb\u8f66\u7684\u8fb9\u754c<\/h2>\n<ul>\n<li>\u987a\u5e8f\u53cd\u4e86\u4f1a\u628a\u81ea\u5df1\u9501\u5728\u95e8\u5916\uff1a\u5148 <code>ufw enable<\/code> \u518d\u653e\u884c 22\uff0c\u5f53\u524d SSH \u4f1a\u8bdd\u5728\u89c4\u5219\u751f\u6548\u77ac\u95f4\u65ad\u5f00\uff0c\u53ea\u80fd\u53bb\u63a7\u5236\u53f0\u6216 VNC \u6551\u63f4\uff0c\u8fd9\u7c7b\u4e8b\u6545\u5728\u65b0\u5efa\u673a\u5668\u4e0a\u51fa\u73b0\u9891\u7387\u6700\u9ad8\u3002<\/li>\n<li>Docker \u53d1\u5e03\u7684\u7aef\u53e3\u4f1a\u7ed5\u8fc7\u7cfb\u7edf\u9632\u706b\u5899\uff1a<code>docker run -p 8080:80<\/code> \u5728 nat \u8868\u5199 DNAT \u5e76\u5728 FORWARD \u94fe\u653e\u884c\uff0cufw \u7684\u5165\u7ad9\u89c4\u5219\u6839\u672c\u770b\u4e0d\u5230\u8fd9\u4e9b\u6d41\u91cf\uff0c\u7aef\u53e3\u5c31\u6210\u4e86\u4e00\u6761\u9690\u85cf\u901a\u9053\u3002\u8981\u4e48\u6539\u6210 <code>-p 127.0.0.1:8080:80<\/code> \u7531\u53cd\u5411\u4ee3\u7406\u8f6c\u53d1\uff0c\u8981\u4e48\u7528\u4e13\u95e8\u7684 docker \u94fe\u7ba1\u7406\u65b9\u6848\u63a5\u7ba1\u3002<\/li>\n<li>\u4e91\u5b89\u5168\u7ec4\u4e0e\u7cfb\u7edf\u9632\u706b\u5899\u662f\u4e24\u5c42\u72ec\u7acb\u5f00\u5173\uff1a\u5b89\u5168\u7ec4\u653e\u884c\u3001\u7cfb\u7edf\u9632\u706b\u5899\u62d2\u7edd\u65f6\u8868\u73b0\u4e3a filtered\uff1b\u4e24\u8fb9\u90fd\u653e\u884c\u624d\u662f\u771f\u6b63\u5f00\u653e\u3002\u53ea\u6539\u4e00\u8fb9\uff0c\u6392\u67e5\u65f6\u5f88\u5bb9\u6613\u8bef\u5224\u6210\u89c4\u5219\u6ca1\u751f\u6548\u3002<\/li>\n<li>\u540c\u65f6\u542f\u7528 ufw \u4e0e firewalld \u4f1a\u8ba9\u4e24\u5957\u89c4\u5219\u4e92\u76f8\u6253\u67b6\uff1a\u547d\u4ee4\u8bf4\u7aef\u53e3\u5df2\u7ecf\u5173\u4e86\uff0c\u5916\u90e8\u5374\u8fde\u5f97\u4e0a\u3002\u88c5\u7cfb\u7edf\u540e\u5148\u786e\u8ba4\u53ea\u7559\u4e00\u4e2a\uff0c\u518d\u5f00\u59cb\u5199\u89c4\u5219\u3002<\/li>\n<\/ul>\n<h2>\u4ece\u96f6\u5230\u53ef\u7528\u7684\u843d\u5730\u987a\u5e8f<\/h2>\n<p>\u8fd9\u5957\u6d41\u7a0b\u5957\u5230\u65b0\u673a\u5668\u4e0a\u5927\u7ea6\u4e8c\u5341\u5206\u949f\uff1a\u5148\u7528 <code>ss -lntp<\/code> \u76d8\u70b9\u76d1\u542c\u7aef\u53e3\uff0c\u5199\u4e0b\u5fc5\u987b\u5bf9\u516c\u7f51\u5f00\u653e\u7684\u6e05\u5355\uff1b\u63a5\u7740\u6309\u955c\u50cf\u6765\u6e90\u9009 ufw \u6216 firewalld\uff0c\u5199\u5165\u9ed8\u8ba4\u62d2\u7edd\u4e0e\u653e\u884c\u89c4\u5219\uff1b\u7136\u540e\u5728\u53e6\u4e00\u4e2a\u7a97\u53e3\u9a8c\u8bc1 SSH\u3001\u518d\u9a8c\u8bc1 80\/443\uff1b\u6700\u540e\u4ece\u5916\u90e8\u673a\u5668\u8dd1\u4e00\u6b21 <code>nmap<\/code>\uff0c\u786e\u8ba4\u6e05\u5355\u5916\u7684\u7aef\u53e3\u5168\u90e8\u662f filtered \u72b6\u6001\u3002\u8fd9\u5957\u52a8\u4f5c\u505a\u5b8c\uff0c\u673a\u5668\u5c31\u6709\u4e86\u4e00\u4e2a\u53ef\u4ee5\u957f\u671f\u7ef4\u6301\u7684\u6700\u5c0f\u66b4\u9732\u9762\u3002<\/p>\n<p>\u540e\u7eed\u7ef4\u62a4\u7684\u91cd\u70b9\u662f&#8221;\u89c4\u5219\u8981\u8ddf\u7740\u670d\u52a1\u8d70&#8221;\u3002\u5173\u6389\u4e00\u4e2a\u4e34\u65f6\u670d\u52a1\u65f6\u987a\u624b\u5220\u6389\u5bf9\u5e94\u89c4\u5219\uff0c\u7528 <code>ufw status numbered<\/code> \u6216 <code>firewall-cmd --list-all<\/code> \u6bcf\u6708\u5bf9\u4e00\u6b21\u8d26\uff0c\u6bd4\u4e8b\u540e\u7ffb\u65e5\u5fd7\u7701\u529b\u3002<\/p>\n<h2>\u7ed9\u65b0\u624b\u7684\u914d\u7f6e\u5efa\u8bae<\/h2>\n<p>\u5982\u679c\u4f60\u9700\u8981\u4e00\u5957\u7701\u5fc3\u7684\u8d77\u70b9\uff0c\u6211\u4eec\u7684\u5efa\u8bae\u662f\uff1a\u9ed8\u8ba4\u62d2\u7edd\u5165\u7ad9\u3001\u53ea\u653e\u884c 22\uff08\u9650\u5b9a\u7ba1\u7406 IP\uff09\u300180\u3001443\uff0c\u5176\u4f59\u7aef\u53e3\u4e00\u5f8b\u4e0d\u5f00\u53e3\uff0c\u7136\u540e\u6bcf\u4e2a\u6708\u590d\u67e5\u4e00\u6b21\u89c4\u5219\u4e0e\u76d1\u542c\u72b6\u6001\u3002\u8fd9\u6761\u8def\u5f84\u80fd\u6321\u4f4f\u626b\u63cf\u5668\u4e0e\u591a\u6570\u81ea\u52a8\u5316\u7206\u7834\uff0c\u4e5f\u7ed9\u540e\u7eed\u52a0\u89c4\u5219\u7559\u4e86\u4f4d\u7f6e\u3002<\/p>\n<p>\u5982\u679c\u4f60\u8fd8\u6ca1\u51b3\u5b9a\u670d\u52a1\u5668\u5f62\u6001\uff0c\u53ef\u4ee5\u5148\u770b <a href=\"https:\/\/cn.hostease.com\/vps\/\">Hostease VPS \u65b9\u6848<\/a>\u4e86\u89e3\u7aef\u53e3\u4e0e\u8d44\u6e90\u914d\u989d\u7684\u5b9e\u9645\u60c5\u51b5\uff1b\u7ad9\u70b9\u8fd8\u5728\u5355\u7ad9\u70b9\u9636\u6bb5\u3001\u53c8\u4e0d\u60f3\u81ea\u5df1\u7ef4\u62a4\u8865\u4e01\u4e0e\u9632\u706b\u5899\u65f6\uff0c<a href=\"https:\/\/cn.hostease.com\/shared-hosting.html\">\u865a\u62df\u4e3b\u673a\u65b9\u6848<\/a>\u628a\u8fd9\u4e00\u5c42\u6258\u7ba1\u7ed9\u4e86\u670d\u52a1\u5546\uff0c\u628a\u7cbe\u529b\u7559\u7ed9\u4e1a\u52a1\u672c\u8eab\u66f4\u5212\u7b97\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u7528\u9ed8\u8ba4\u62d2\u7edd\u7b56\u7565\u4e3a VPS \u642d\u4e00\u5957\u6700\u5c0f\u9632\u706b\u5899\u89c4\u5219\u96c6\uff1aufw \u4e0e firewalld \u7684\u653e\u884c\u547d\u4ee4\u3001\u5916\u90e8\u9a8c\u8bc1\u65b9\u6cd5\uff0c\u4ee5\u53ca Docker \u4e0e\u4e91\u5b89\u5168\u7ec4\u8fd9\u4e9b\u5bb9\u6613\u7ffb\u8f66\u7684\u8fb9\u754c\u3002<\/p>\n","protected":false},"author":2,"featured_media":34204,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4099],"tags":[4956,909,3904,882,5452],"class_list":["post-34208","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tutorials","tag-firewalld","tag-linux","tag-ufw","tag-vps","tag-5452"],"aioseo_notices":[],"jetpack_featured_media_url":"https:\/\/cn.hostease.com\/blog\/wp-content\/uploads\/2026\/10\/vps-firewall-ufw-firewalld-cover.webp","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/cn.hostease.com\/blog\/wp-json\/wp\/v2\/posts\/34208","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cn.hostease.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cn.hostease.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cn.hostease.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/cn.hostease.com\/blog\/wp-json\/wp\/v2\/comments?post=34208"}],"version-history":[{"count":1,"href":"https:\/\/cn.hostease.com\/blog\/wp-json\/wp\/v2\/posts\/34208\/revisions"}],"predecessor-version":[{"id":34209,"href":"https:\/\/cn.hostease.com\/blog\/wp-json\/wp\/v2\/posts\/34208\/revisions\/34209"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cn.hostease.com\/blog\/wp-json\/wp\/v2\/media\/34204"}],"wp:attachment":[{"href":"https:\/\/cn.hostease.com\/blog\/wp-json\/wp\/v2\/media?parent=34208"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cn.hostease.com\/blog\/wp-json\/wp\/v2\/categories?post=34208"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cn.hostease.com\/blog\/wp-json\/wp\/v2\/tags?post=34208"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}