现象描述
在 CentOS 7.6.1810 下执行 service iptables save 命令，出现如下错误：
[root@test ~]# service iptables save
The service command supports only basic LSB actions (start, stop, restart, try-restart, reload, force-reload, status). For other actions, please try to use systemctl.
原因
从 CentOS 7.x 开始，CentOS 开始使用 systemd 服务来代替 daemon，原来管理系统启动和管理系统服务的相关命令全部由 systemctl 命令来代替。service 命令之保留了极少部分使用，大部分命令都要改用 systemctl 命令来使用。
在 RHEL 7 和 CentOS 7 中， firewalld 被引入来管理 iptables。
解决方案
首先停止防火墙：
systemctl stop firewalld systemctl mask firewalld
在 CentOS 7 和 RHEL 7 中，没有 /etc/sysconfig/iptables 这个配置文件，也不能执行 service iptables restart 命令，需要通过安装 iptables-services 才有。
[root@test ~]# cat /etc/redhat-release CentOS Linux release 7.6.1810 (Core) [root@test ~]# rpm -qa|grep iptables iptables-1.4.21-28.el7.x86_64 [root@test ~]# yum -y install iptables-services
然后就可以使用 service iptables [start | stop | restart | save ....] 命令。
# 这样就可以保存防火墙规则了 [root@test ~]# service iptables save iptables: Saving firewall rules to /etc/sysconfig/iptables:[ OK ] [root@test ~]# ll /etc/sysconfig/iptables -rw-------. 1 root root 6479 Nov 7 04:00 /etc/sysconfig/iptables # 或者 使用如下命令 [root@test ~]# /usr/libexec/iptables/iptables.init save iptables: Saving firewall rules to /etc/sysconfig/iptables:[ OK ]
延伸知识
CentOS 7 中没有 service iptables save 指令来保存防火墙规则，怎么处理的呢？
解决办法：
systemctl stop firewalld # 关闭防火墙 yum -y install iptables-services # 安装 iptables 服务 systemctl enable iptables # 设置 iptables 服务开机启动 systemctl start iptables # 启动 iptables 服务 service iptables save # 保存 iptables 配置 service iptables restart # 重启 iptables 服务
[root@test ~]# systemctl status iptables ● iptables.service - IPv4 firewall with iptables Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled; vendor preset: disabled) Active: active (exited) since Thu 2019-11-07 04:09:20 EST; 14s ago Process: 85040 ExecStart=/usr/libexec/iptables/iptables.init start (code=exited, status=0/SUCCESS) Main PID: 85040 (code=exited, status=0/SUCCESS) Nov 07 04:09:20 test systemd[1]: Starting IPv4 firewall with iptables... Nov 07 04:09:20 test iptables.init[85040]: iptables: Applying firewall rules: [ OK ] Nov 07 04:09:20 test systemd[1]: Started IPv4 firewall with iptables. [root@test ~]# service iptables status Redirecting to /bin/systemctl status iptables.service ● iptables.service - IPv4 firewall with iptables Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled; vendor preset: disabled) Active: active (exited) since Thu 2019-11-07 04:09:20 EST; 24s ago Process: 85040 ExecStart=/usr/libexec/iptables/iptables.init start (code=exited, status=0/SUCCESS) Main PID: 85040 (code=exited, status=0/SUCCESS) Nov 07 04:09:20 test systemd[1]: Starting IPv4 firewall with iptables... Nov 07 04:09:20 test iptables.init[85040]: iptables: Applying firewall rules: [ OK ] Nov 07 04:09:20 test systemd[1]: Started IPv4 firewall with iptables.
注意： firewalld 和 iptables 两种不同的防火墙规则的配置方式，不能同时启动。
示例1： 使用 systemctl start firewalld 启动的防火墙
[root@docker01 ~]# systemctl status firewalld ● firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled) Active: active (running) since Thu 2019-11-07 04:20:58 EST; 2min 5s ago Docs: man:firewalld(1) Main PID: 86122 (firewalld) Tasks: 2 Memory: 21.6M CGroup: /system.slice/firewalld.service └─86122 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid Nov 07 04:21:00 docker01 firewalld[86122]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C FORWARD -i docker0 ! -o docker0 -j ACCEPT' failed...t chain?). Nov 07 04:21:00 docker01 firewalld[86122]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t nat -C PREROUTING -m addrtype --dst-type LOCAL -j DOCKER' f...that name. Nov 07 04:21:00 docker01 firewalld[86122]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t nat -C OUTPUT -m addrtype --dst-type LOCAL -j DOCKER ! --ds...that name. Nov 07 04:21:00 docker01 firewalld[86122]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C FORWARD -o docker0 -j DOCKER' failed: iptables: N...that name. Nov 07 04:21:00 docker01 firewalld[86122]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C FORWARD -o docker0 -m conntrack --ctstate RELATED...t chain?). Nov 07 04:21:00 docker01 firewalld[86122]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C FORWARD -j DOCKER-ISOLATION-STAGE-1' failed: ipta...that name. Nov 07 04:21:00 docker01 firewalld[86122]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -D FORWARD -i docker0 -o docker0 -j DROP' failed: iptables: Ba...t chain?). Nov 07 04:21:00 docker01 firewalld[86122]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -n -L DOCKER-USER' failed: iptables: No chain/target...that name. Nov 07 04:21:00 docker01 firewalld[86122]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C DOCKER-USER -j RETURN' failed: iptables: Bad rule...t chain?). Nov 07 04:21:01 docker01 firewalld[86122]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C FORWARD -j DOCKER-USER' failed: iptables: No chai...that name. Hint: Some lines were ellipsized, use -l to show in full. [root@docker01 ~]# service iptables status Redirecting to /bin/systemctl status iptables.service ● iptables.service - IPv4 firewall with iptables Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled; vendor preset: disabled) Active: inactive (dead) since Thu 2019-11-07 04:20:57 EST; 3min 23s ago Process: 86123 ExecStop=/usr/libexec/iptables/iptables.init stop (code=exited, status=0/SUCCESS) Process: 85907 ExecStart=/usr/libexec/iptables/iptables.init start (code=exited, status=0/SUCCESS) Main PID: 85907 (code=exited, status=0/SUCCESS) Nov 07 04:18:38 docker01 systemd[1]: Starting IPv4 firewall with iptables... Nov 07 04:18:38 docker01 systemd[1]: Started IPv4 firewall with iptables. Nov 07 04:20:57 docker01 systemd[1]: Stopping IPv4 firewall with iptables... Nov 07 04:20:57 docker01 iptables.init[86123]: iptables: Setting chains to policy ACCEPT: filter [ OK ] Nov 07 04:20:57 docker01 iptables.init[86123]: iptables: Flushing firewall rules: [ OK ] Nov 07 04:20:57 docker01 systemd[1]: Stopped IPv4 firewall with iptables.
示例2： 使用 service iptables start 启动的防火墙
[root@docker01 ~]# service iptables start Redirecting to /bin/systemctl start iptables.service [root@docker01 ~]# service iptables status Redirecting to /bin/systemctl status iptables.service ● iptables.service - IPv4 firewall with iptables Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled; vendor preset: disabled) Active: active (exited) since Thu 2019-11-07 04:31:00 EST; 5s ago Process: 87000 ExecStop=/usr/libexec/iptables/iptables.init stop (code=exited, status=0/SUCCESS) Process: 87101 ExecStart=/usr/libexec/iptables/iptables.init start (code=exited, status=0/SUCCESS) Main PID: 87101 (code=exited, status=0/SUCCESS) Nov 07 04:31:00 docker01 systemd[1]: Starting IPv4 firewall with iptables... Nov 07 04:31:00 docker01 iptables.init[87101]: iptables: Applying firewall rules: [ OK ] Nov 07 04:31:00 docker01 systemd[1]: Started IPv4 firewall with iptables. [root@docker01 ~]# systemctl status firewalld ● firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled) Active: inactive (dead) since Thu 2019-11-07 04:29:12 EST; 2min 7s ago Docs: man:firewalld(1) Process: 86122 ExecStart=/usr/sbin/firewalld --nofork --nopid $FIREWALLD_ARGS (code=exited, status=0/SUCCESS) Main PID: 86122 (code=exited, status=0/SUCCESS) Nov 07 04:21:00 docker01 firewalld[86122]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t nat -C OUTPUT -m addrtype --dst-type LOCAL -j DOCKER ! --ds...that name. Nov 07 04:21:00 docker01 firewalld[86122]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C FORWARD -o docker0 -j DOCKER' failed: iptables: N...that name. Nov 07 04:21:00 docker01 firewalld[86122]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C FORWARD -o docker0 -m conntrack --ctstate RELATED...t chain?). Nov 07 04:21:00 docker01 firewalld[86122]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C FORWARD -j DOCKER-ISOLATION-STAGE-1' failed: ipta...that name. Nov 07 04:21:00 docker01 firewalld[86122]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -D FORWARD -i docker0 -o docker0 -j DROP' failed: iptables: Ba...t chain?). Nov 07 04:21:00 docker01 firewalld[86122]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -n -L DOCKER-USER' failed: iptables: No chain/target...that name. Nov 07 04:21:00 docker01 firewalld[86122]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C DOCKER-USER -j RETURN' failed: iptables: Bad rule...t chain?). Nov 07 04:21:01 docker01 firewalld[86122]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C FORWARD -j DOCKER-USER' failed: iptables: No chai...that name. Nov 07 04:29:11 docker01 systemd[1]: Stopping firewalld - dynamic firewall daemon... Nov 07 04:29:12 docker01 systemd[1]: Stopped firewalld - dynamic firewall daemon. Hint: Some lines were ellipsized, use -l to show in full.