Firewalld.v7

Installing

New Server

Mrepo

smartd

RAID

Hardening

YUM

Crontabs

LogWatch

systemctl

firewalld

CentOS 7

Packages

Apache

Bind

Cacti

DHCP

mariadb

Samba

Sarg

Sendmail

Smokeping

Rsync

Work Apps

Problems

VPN

VPN Win

Extras

Bash

MailScanner

Horde

Google CE

Wake Up

KVM

Other

Computer Lab

ISO2USB

aiContact

Google CE

Android

USB Live

SRS XML

YUM

yum install firewalld

systemctl

systemctl status firewalld
systemctl start firewalld
systemctl enable firewalld

View Settings

firewall-cmd --state
firewall-cmd --get-active-zones
firewall-cmd --get-zones
firewall-cmd --get-default-zone
firewall-cmd --zone=external --list-all
firewall-cmd --zone=internal --list-all
firewall-cmd --zone=public --list-all
firewall-cmd --list-services

firewall-cmd --get-services
firewall-cmd --get-icmptypes
firewall-cmd --query-panic

Adding

firewall-cmd --zone=home --remove-service=http
firewall-cmd --zone=internal --add-service=https --permanent
firewall-cmd [--zone=<zone>] --add-port=<port>[-<port>]/<protocol> [--timeout=<seconds>]

Removing

firewall-cmd --zone=home --remove-service=http
firewall-cmd --zone=internal --remove-service=https --permanent

Setting Up

For firewalld to work NetworkManager must be running.

In a non router configuration the single NIC will be assigned to public.

firewall-cmd --zone=public --list-all

NIC Setting up

eno1 = internal 192.169.20.1
eno2 = external xx.xx.xx.xx
firewall-cmd  --zone=internal --remove-interface=eno2
firewall-cmd --permanent --zone=internal --change-interface=eno1
firewall-cmd --permanent --zone=external --change-interface=eno2
emacs /etc/sysconfig/network-scripts/ifcfg-eno1
   ZONE=internal
emacs /etc/sysconfig/network-scripts/ifcfg-eno2
   ZONE=external

systemctl restart network.service
systemctl restart firewalld.service
firewall-cmd --get-active-zones

firewall-cmd --set-default-zone=internal
firewall-cmd --get-zone-of-interface=eno1
firewall-cmd --get-zone-of-interface=eno2
firewall-cmd --zone=external --add-masquerade --permanent
firewall-cmd --permanent --direct --passthrough ipv4 -t nat -I POSTROUTING -o eno2 -j MASQUERADE -s 192.168.20.0/24
firewall-cmd --zone=external --query-masquerade

Note eno2 external NIC allowing internal sub 192.168.20.0 to access the Internet

firewall-cmd --zone=external --list-all
firewall-cmd --zone=internal --list-all
netfirewall-cmd --complete-reload
systemctl enable firewalld

need to add

ZONE=internal

to ifcfg-eno1

ZONE=external

to ifcfg-eno2 and restart firewalld also reload does not seem to work, on a reboot firewalld did not have the correct settings.

firewall-cmd --complete-reload

rather use

systemctl restart firewalld

NAT should now work:

external (active)
 interfaces: eno2
 masquerade: yes
external (active)
 interfaces: eno1
 masquerade: no

Incoming rules

Firewall PUBLIC

firewall-cmd --zone=public --add-port=67/upc --permanent
firewall-cmd --zone=public --add-port=68/upc --permanent
firewall-cmd --zone=public --add-port=2022/tcp --permanent
firewall-cmd --zone=public --add-port=873/tcp --permanent
firewall-cmd --zone=public --add-port=3389/tcp --permanent
firewall-cmd --zone=public --add-port=1000/tcp --permanent
firewall-cmd --zone=public --add-port=5901/tcp --permanent
firewall-cmd --zone=public --add-port=873/tcp --permanent
firewall-cmd --zone=public --add-port=8080/tcp --permanent
firewall-cmd --zone=public --add-service=http --permanent
firewall-cmd --zone=public --add-service=https --permanent
firewall-cmd --zone=public --add-service=mysql --permanent
firewall-cmd --zone=public --add-port=10000/tcp --permanent

firewall-cmd --zone=public --add-port=137/tcp --permanent
firewall-cmd --zone=public --add-port=138/tcp --permanent
firewall-cmd --zone=public --add-port=139/tcp --permanent
firewall-cmd --zone=public --add-port=445/tcp --permanent

Firewall INTERNAL

Following firewall rules needed

firewall-cmd --zone=internal --add-port=67/upc --permanent
firewall-cmd --zone=internal --add-port=68/upc --permanent
firewall-cmd --zone=internal --add-port=2022/tcp --permanent
firewall-cmd --zone=internal --add-port=873/tcp --permanent
firewall-cmd --zone=internal --add-port=3389/tcp --permanent
firewall-cmd --zone=internal --add-port=1000/tcp --permanent
firewall-cmd --zone=internal --add-port=5901/tcp --permanent
firewall-cmd --zone=internal --add-port=873/tcp --permanent
firewall-cmd --zone=internal --add-port=8080/tcp --permanent
firewall-cmd --zone=internal --add-service=http --permanent
firewall-cmd --zone=internal --add-service=https --permanent
firewall-cmd --zone=internal --add-service=mysql --permanent

Firewall EXTERNAL

# Check samba with
netstat -tulpn | egrep "samba|smbd|nmbd|winbind"
firewall-cmd --zone=external --add-port=137/tcp --permanent
firewall-cmd --zone=external --add-port=138/tcp --permanent
firewall-cmd --zone=external --add-port=139/tcp --permanent
firewall-cmd --zone=external --add-port=445/tcp --permanent

firewall-cmd --zone=external --add-port=2022/tcp --permanent
firewall-cmd --zone=external --add-port=873/tcp --permanent
firewall-cmd --zone=external --add-port=3389/tcp --permanent
firewall-cmd --zone=external --add-port=10000/tcp --permanent
firewall-cmd --zone=external --add-port=5901/tcp --permanent

firewall-cmd --zone=external --add-port=3306/tcp --permanent #mysql

firewall-cmd --zone=external --add-service=http --permanent
firewall-cmd --zone=external --add-service=https --permanent
firewall-cmd --zone=external --add-service=ftp --permanent
firewall-cmd --zone=external --add-service=samba --permanent
firewall-cmd --zone=external --add-service=samba-client --permanent

systemctl restart firewalld
firewall-cmd --zone=public --list-all

Allow an IP address in

firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="11.22.33.44" accept' --permanent

Block IP

Block

firewall-cmd --zone=trusted --list-all
firewall-cmd --permanent --add-rich-rule="rule family='ipv4' source address='192.168.101.111' reject"
systemctl restart firewalld
firewall-cmd --zone=trusted --list-all

Allow

firewall-cmd --zone=trusted --list-all
firewall-cmd --permanent --remove-rich-rule="rule family='ipv4' source address='192.168.101.111' reject"
systemctl restart firewalld
firewall-cmd --zone=trusted --list-all

Only on an email server

firewall-cmd --zone=external --add-port=25/tcp  --permanent
firewall-cmd --zone=external --add-port=110/tcp  --permanent
firewall-cmd --zone=external --add-port=143/tcp  --permanent
firewall-cmd --zone=external --add-port=587/tcp  --permanent
firewall-cmd --zone=external --add-port=465/tcp  --permanent
firewall-cmd --zone=external --add-port=993/tcp  --permanent
firewall-cmd --zone=external --add-port=995/tcp  --permanent

OR

firewall-cmd --zone=public --add-port=25/tcp  --permanent
firewall-cmd --zone=public --add-port=110/tcp  --permanent
firewall-cmd --zone=public --add-port=143/tcp  --permanent
firewall-cmd --zone=public --add-port=587/tcp  --permanent
firewall-cmd --zone=public --add-port=465/tcp  --permanent
firewall-cmd --zone=public --add-port=993/tcp  --permanent
firewall-cmd --zone=public --add-port=995/tcp  --permanent
systemctl restart firewalld

Port forwarding

firewall-cmd --zone=external --add-forward-port=port=22:proto=tcp:toport=3753

firewall-cmd --zone=external --add-forward-port=port=22:proto=tcp:toport=3753:toaddr=10.0.0.1

Direct Rules

firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -p tcp --dport 9000 -j ACCEPT

Simple Server

firewall-cmd --get-active-zones
 public
  interfaces: enp3s0

firewall-cmd --get-default-zone
 public

firewall-cmd --get-services
  RH-Satellite-6 amanda-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns ftp high-availability 
  http https imaps ipp ipp-client ipsec kerberos kpasswd ldap ldaps libvirt libvirt-tls mdns mountd 
  ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s postgresql proxy-dhcp radius 
  rpc-bind samba samba-client smtp ssh telnet tftp tftp-client transmission-client vnc-server wbem-https

firewall-cmd --zone=public --add-port=2022/tcp --permanent
firewall-cmd --zone=public --add-port=873/tcp --permanent
firewall-cmd --zone=public --add-port=3389/tcp --permanent
firewall-cmd --zone=public --add-port=1000/tcp --permanent
firewall-cmd --zone=public --add-port=5901/tcp --permanent
firewall-cmd --zone=public --add-port=873/tcp --permanent
firewall-cmd --zone=public --add-service=http --permanent
firewall-cmd --zone=public --add-service=https --permanent

systemctl restart firewalld

/usr/lib/firewalld

https://fedoraproject.org/wiki/FirewallD

• Did you find this page useful?
• Do you have an issue that you have not yet fixed?

We can do this for you.

I am available for technical support. Please follow this link. Tech Support Request.
+64-6-880-0000 : ++1-808-498-7146 : help@ai.net.nz
Getting us to help you