What is Firewalld?

Linux, Security
Fadıl

Who is using it?

Firewalld is used in the following Linux distributions as the default firewall management tool:

  • RHEL 7, CentOS 7
  • Fedora 18 and newer
  • Available for several other distributions

The most distinctive feature of Firewalld compared to IPTables is that it uses zones. Zone rules apply. Each zone can use different configurations. You can change all the rules that you apply by changing these zones.

Firewall-cmd is the most basic command we will use.

The following command displays the details of all configurations. Many details are available, such as whether it is active or not.

firewall-cmd –list-all

You can also use the command below to list all available zones.

firewall-cmd –get-zones

You can also use the following commands to display the region used in the default (factory setting).

firewall-cmd –get-default-zone

or

firewall-cmd –get-active-zones

If the following command is used, you can change the default zone(Factory Outlet Zone).

NOTE 1: After creating rules in Firewalld, you must run the firewall-cmd –reload için command to take effect without restarting the machine.

firewall-cmd –set-default-zone=home

firewall-cmd –reload

The command below allows access to the service from outside.

NOTE 2: The permanent parameter makes the rule permanent.

firewall-cmd –zone=public –add-service=http –permanent

firewall-cmd –reload

Or existing rules can be deleted.

firewall-cmd –zone=public –remove-service=http –permanent

firewall-cmd –reload

With the command below, port-based access permission can be granted, not service.

firewall-cmd –zone=public –add-port=443/tcp –permanent

firewall-cmd –zone=public –add-port=53/udp –permanent

firewall-cmd –reload

Or existing rules can be deleted.

firewall-cmd –zone=public –remove-port=443/tcp –permanent

firewall-cmd –zone=public –remove-port=53/udp –permanent

firewall-cmd –reload

There are also rich rules. As the name suggests, there are rules that can be created on a special, rope-based basis. This issue should also be addressed.

Only the rule that accepts all requests from IP 192.168.1.25 is created.

firewall-cmd –zone=public –add-rich-rule=’rule family=”ipv4″ source address=192.168.1.25 accept’

firewall-cmd –reload

Below, it rejects 22 requests from 192.168.1.25 IP.

firewall-cmd –zone=public –add-rich-rule=‘rule family=”ipv4” source address=”192.168.1.25” port port=22 protocol=tcp reject’

firewall-cmd –reload

Rich rules can also be viewed with the following command.

firewall-cmd –list-rich-rules

Now all rules made so far can be viewed with the “firewall-cmd – list-all” command.