Firewalld : Basic Operation2025/01/02 |
|
This is the Basic Operation of Firewalld.
The definition of services is set to zones on Firewalld. |
|
| [1] | To use Firewalld, start the Service. |
|
[root@dlp ~]# systemctl enable --now firewalld |
| [2] | By default, [public] zone is applied with a NIC, and cockpit, dhcpv6-client, ssh are allowed. When operating with [firewall-cmd] command, if you input the command without [--zone=***] specification, then, configuration is set to the default zone. |
|
# display the default zone [root@dlp ~]# firewall-cmd --get-default-zone public # display current settings [root@dlp ~]# firewall-cmd --list-all public (default, active) target: default ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: enp1s0 sources: services: cockpit dhcpv6-client ssh ports: protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: # display all zones defined by default [root@dlp ~]# firewall-cmd --list-all-zones block target: %%REJECT%% ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: sources: services: ports: protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: ..... ..... # display allowed services on a specific zone [root@dlp ~]# firewall-cmd --list-service --zone=external ssh # change default zone [root@dlp ~]# firewall-cmd --set-default-zone=external success # change zone for an interface [root@dlp ~]# firewall-cmd --change-interface=enp1s0 --zone=external success [root@dlp ~]# firewall-cmd --list-all --zone=external external (default, active) target: default ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: enp1s0 sources: services: ssh ports: protocols: forward: yes masquerade: yes forward-ports: source-ports: icmp-blocks: rich rules: |
| [3] | Display services defined by default. |
|
[root@dlp ~]# firewall-cmd --get-services 0-AD RH-Satellite-6 RH-Satellite-6-capsule afp alvr amanda-client amanda-k5-client amqp amqps anno-1602 anno-1800 apcupsd aseqnet audit ausweisapp2 bacula bacula-client bareos-director bareos-filedaemon bareos-storage bb bgp bitcoin bitcoin-rpc bitcoin-testnet bitcoin-testnet-rpc bittorrent-lsd ceph ceph-exporter ceph-mon cfengine checkmk-agent civilization-iv civilization-v cockpit collectd condor-collector cratedb ctdb dds dds-multicast dds-unicast dhcp dhcpv6 dhcpv6-client distcc dns dns-over-quic dns-over-tls docker-registry docker-swarm dropbox-lansync elasticsearch etcd-client etcd-server factorio finger foreman foreman-proxy freeipa-4 freeipa-ldap freeipa-ldaps freeipa-replication freeipa-trust ftp galera ganglia-client ganglia-master git gpsd grafana gre high-availability http http3 https ident imap imaps iperf2 iperf3 ipfs ipp ipp-client ipsec irc ircs iscsi-target isns jenkins kadmin kdeconnect kerberos kibana klogin kpasswd kprop kshell kube-api kube-apiserver kube-control-plane kube-control-plane-secure kube-controller-manager kube-controller-manager-secure kube-nodeport-services kube-scheduler kube-scheduler-secure kube-worker kubelet kubelet-readonly kubelet-worker ldap ldaps libvirt libvirt-tls lightning-network llmnr llmnr-client llmnr-tcp llmnr-udp managesieve matrix mdns memcache minecraft minidlna mndp mongodb mosh mountd mpd mqtt mqtt-tls ms-wbt mssql murmur mysql nbd nebula need-for-speed-most-wanted netbios-ns netdata-dashboard nfs nfs3 nmea-0183 nrpe ntp nut opentelemetry openvpn ovirt-imageio ovirt-storageconsole ovirt-vmconsole plex pmcd pmproxy pmwebapi pmwebapis pop3 pop3s postgresql privoxy prometheus prometheus-node-exporter proxy-dhcp ps2link ps3netsrv ptp pulseaudio puppetmaster quassel radius radsec rdp redis redis-sentinel rootd rpc-bind rquotad rsh rsyncd rtsp salt-master samba samba-client samba-dc sane settlers-history-collection sip sips slimevr slp smtp smtp-submission smtps snmp snmptls snmptls-trap snmptrap spideroak-lansync spotify-sync squid ssdp ssh statsrv steam-lan-transfer steam-streaming stellaris stronghold-crusader stun stuns submission supertuxkart svdrp svn syncthing syncthing-gui syncthing-relay synergy syscomlan syslog syslog-tls telnet tentacle terraria tftp tile38 tinc tor-socks transmission-client turn turns upnp-client vdsm vnc-server vrrp warpinator wbem-http wbem-https wireguard ws-discovery ws-discovery-client ws-discovery-host ws-discovery-tcp ws-discovery-udp wsman wsmans xdmcp xmpp-bosh xmpp-client xmpp-local xmpp-server zabbix-agent zabbix-java-gateway zabbix-server zabbix-trapper zabbix-web-service zero-k zerotier # definition files are placed under the directory like follows # if you'd like to add your original definition, add XML file on there [root@dlp ~]# ls /usr/lib/firewalld/services 0-AD.xml mqtt.xml afp.xml mssql.xml alvr.xml ms-wbt.xml amanda-client.xml murmur.xml amanda-k5-client.xml mysql.xml amqps.xml nbd.xml amqp.xml nebula.xml anno-1602.xml need-for-speed-most-wanted.xml anno-1800.xml netbios-ns.xml apcupsd.xml netdata-dashboard.xml aseqnet.xml nfs3.xml audit.xml nfs.xml ausweisapp2.xml nmea-0183.xml bacula-client.xml nrpe.xml bacula.xml ntp.xml ..... ..... |
| [4] | Add or Remove allowed services. The change will be back after rebooting the system. If you change settings permanently, add the [--permanent] or [--runtime-to-permanent] option. |
|
# for example, add [http] [root@dlp ~]# firewall-cmd --add-service=http success [root@dlp ~]# firewall-cmd --list-service cockpit dhcpv6-client http ssh # for example, remove [http] [root@dlp ~]# firewall-cmd --remove-service=http success [root@dlp ~]# firewall-cmd --list-service cockpit dhcpv6-client ssh # permanent setting : [--permanent] - add setting to the permanent environment [root@dlp ~]# firewall-cmd --add-service=http --permanent success [root@dlp ~]# firewall-cmd --list-service cockpit dhcpv6-client ssh # reload settings from the permanent environment to apply new setting [root@dlp ~]# firewall-cmd --reload success
[root@dlp ~]#
firewall-cmd --list-service cockpit dhcpv6-client http ssh # permanent setting : [--runtime-to-permanent] - save the current runtime environment to the permanent environment [root@dlp ~]# firewall-cmd --add-service=http success [root@dlp ~]# firewall-cmd --list-service cockpit dhcpv6-client http ssh [root@dlp ~]# firewall-cmd --runtime-to-permanent success |
| [5] | Add or remove allowed ports. If you change settings permanently, add the [--permanent] or [--runtime-to-permanent] option like the examples of [4]. |
|
# for example, add [TCP 465] [root@dlp ~]# firewall-cmd --add-port=465/tcp success
[root@dlp ~]#
firewall-cmd --list-port 465/tcp # for example, remove [TCP 465] [root@dlp ~]# firewall-cmd --remove-port=465/tcp success [root@dlp ~]# firewall-cmd --list-port |
| [6] | Add or remove prohibited ICMP types. |
|
# for example, add [echo-request] to prohibit it [root@dlp ~]# firewall-cmd --add-icmp-block=echo-request success [root@dlp ~]# firewall-cmd --list-icmp-blocks echo-request # for example, remove [echo-request] [root@dlp ~]# firewall-cmd --remove-icmp-block=echo-request success [root@dlp ~]# firewall-cmd --list-icmp-blocks # display available ICMP types [root@dlp ~]# firewall-cmd --get-icmptypes address-unreachable bad-header beyond-scope communication-prohibited destination-unreachable echo-reply echo-request failed-policy fragmentation-needed host-precedence-violation host-prohibited host-redirect host-unknown host-unreachable ip-header-bad mld-listener-done mld-listener-query mld-listener-report mld2-listener-report neighbour-advertisement neighbour-solicitation network-prohibited network-redirect network-unknown network-unreachable no-route packet-too-big parameter-problem port-unreachable precedence-cutoff protocol-unreachable redirect reject-route required-option-missing router-advertisement router-solicitation source-quench source-route-failed time-exceeded timestamp-reply timestamp-request tos-host-redirect tos-host-unreachable tos-network-redirect tos-network-unreachable ttl-zero-during-reassembly ttl-zero-during-transit unknown-header-type unknown-option |
| Sponsored Link |
|
|