An introduction to firewalld rules and scenarios
A firewall is similar to a gatekeeper that prevents unwanted traffic from the outside network from reaching your system. The firewall rules decide which traffic to allow in or out. In Linux firewalls, there is a concept called zones. Sysadmins can configure each zone with its own firewall rules, which allow or deny incoming traffic into the system. Imagine a home security system that states which person should be allowed to visit which rooms inside your house.
[ You might also like: A beginner's guide to firewalld in Linux ]
Diagram via: Getting Started with firewalld (Red Hat Customer Portal)
firewalld is a firewall service that provides a host-based customizable firewall via the D-bus interface. As mentioned above, firewalls use zones with a predefined set of rules, and each service uses ports. We can allow/block any incoming traffic to a particular service based on its port. For example, if you don’t want anyone to SSH into your system, you can block port 22, and this makes sure that no one can access your system from outside via SSH.
firewalld service uses a concept of zones. We can assign network interfaces to these zones and decide which kind of traffic can enter that network. We can use Network Manager to assign interfaces to particular zones using the
firewall-cmd command, a widely known command-line tool. The default zones are stored under the
/usr/lib/firewalld/zones/ directory. Now let’s learn about some of the pre-defined zones available in
- Block: In this zone, any incoming connections are rejected with an icmp-host-prohibited message, and only connections initiated from within the system are allowed.
- DMZ: For systems that need limited internal network connections, it accepts only selected incoming connections. Also known as a demilitarized zone.
- Drop: Connections are dropped without any notifications. Outgoing connections are possible.
- Public: This zone is used for devices on the untrusted public network.
- Trusted: All network connections are accepted.
One of these zones can be set as default per the user's needs. After the installation, the public zone is set as the default, which you can change later.
Firewall rules in Red Hat Enterprise Linux
Now that we know the basics of
firewalld, we can explore how to use the commands to add or remove different services.
To view whether the firewall is running, use the following commands:
systemctl status firewalld firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled) Active: active (running) since Fri 2020-11-13 18:19:05 CET; 4 months 4 days ago
You can also type:
firewall-cmd --state running
To list the information about the default zone:
firewall-cmd --list-all public (active) target: default icmp-block-inversion: no interfaces: baremetal cni-podman0 eno1 eno2 eno3 provisioning sources: services: cockpit dhcpv6-client http ssh ports: 8080/tcp 80/tcp 80/udp 67/udp 68/udp protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules:
As you can see above, the public zone is set as default. The output displays the interfaces assigned to this zone and which services and ports are enabled/allowed.
Select a particular zone:
firewall-cmd --list-all --zone=home home target: default icmp-block-inversion: no interfaces: sources: services: cockpit dhcpv6-client mdns samba-client ssh
firewalld service upon system start:
systemctl enable firewalld systemctl start firewalld
firewalld service upon system start:
systemctl disable firewalld systemctl stop firewalld
List all the zones:
Add ports and services to zones and make them permanent
Next, let’s see some of the commands to add new services and ports to a particular zone and make them permanent (remain even after system reboot).
To open up or block ports on
firewall-cmd --list-ports firewall-cmd --add-port <port-number/port-type> --permanent firewall-cmd --reload
Ports are logical devices that enable an operating system to receive incoming traffic and forward it to system services. Usually, those services listen on standard ports. For example, HTTP listens on port 80 and HTTPS listens on port 443.
Usually port-type means
Next is an example that adds port 443 on the default zone permanently:
firewall-cmd --add-port 443/tcp --zone=public --permanent firewall-cmd --reload
We can also remove the port by using
Rich rules in firewalld
We can also use rich rules, which have some advanced filtering capabilities in
firewalld. The syntax for these is below. These rich rules are helpful when we want to block or allow a particular IP address or address range.
Use the following command to display the current rich rule settings:
We can control a particular IP of the host and ports using rich rules.
The following rule accepts SSH connections only from the host with IP 10.1.111.21 and drops other connections:
firewall-cmd --add-rich-rule='rule family=ipv4 source address=10.1.111.21/24 service name=ssh log prefix="SSH Logs" level="notice" accept'
This example rejects
ping requests from all hosts with an error message:
firewall-cmd --add-rich-rule='rule protocol value=icmp reject'
The following rule rejects requests coming from IP 220.127.116.11/32 port 21 and accepts every other connection:
firewall-cmd --add-rich-rule='rule family=ipv4 source address=18.104.22.168/32 port port=21 protocol=tcp reject'
[ Thinking about security? Check out this free guide to boosting hybrid cloud security and protecting your business. ]
firewalld lets the user allow or restrict incoming connections and selectively secure their system from unwanted network traffic. Remember that firewall rules decide which traffic to allow in or out of a system. You can configure a zone with its own firewall rules, which allows or denies incoming traffic into the system. But also remember that allowing any traffic or port access to your system makes it vulnerable to security breaches and potential attacks.