Deep Dive : firewalld in CentOS 8 / CentOS 7 / RedHat 7 / RedHat 8

Introduction
firewalld (firewall demaon)  is firewall management tool to manage firewall. it is frontend controller for iptables. it is used to implement persistence traffic rules.

It is available in Command Line as well as Graphical Interface.

Note : It is not replacement of iptables, while it is wrapper of iptables, and  provide flexibility to manage iptables.

firewalld architecture

Installing and Managing firewalld

By default firewalld included with CentOS 8 / Redhat 8 / CentOS 7 / RedHat 7,but if it is not installed then we can installed it by following yum / dnf command.

$ sudo yum -y install firewalld

firewalld have two tools
1. Graphical -> firewall-config
2. Command Line -> firewall-cmd


Difference between ip*tables and firewalld

iptables stores configuration in /etc/sysconfig/iptables and /etc/sysconfig/ip6tables while firewalld store it in various xml files  in /usr/lib/firewalld/ and /etc/firewalld/


with iptables service, every single change means flusing all the old rule and reading all new rule from /etc/sysconfig/iptables,while with firewalld there is no recreating of all the rules.


To Start the firewalld

 

$ sudo systemctl start firewalld

To enable firewalld - enable firewalld at boot time

$ sudo systemctl enable firewalld

To Stop and disable firewalld

$ sudo systemctl stop firewalld
$ sudo systemctl disable firewalld

To Check firewalld status 

$ firewall-cmd --state
running

To view status of firewall daemon

$ systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)

   Active: active (running) since Tue 2018-01-02 10:27:26 IST; 1 day 2h ago

     Docs: man:firewalld(1)

 Main PID: 1081 (firewalld)

   CGroup: /system.slice/firewalld.service

           └─1081 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid



Jan 02 10:27:26 dev.driveo.in systemd[1]: Starting firewalld - dynamic firewall daemon...

Jan 02 10:27:26 dev.driveo.in systemd[1]: Started firewalld - dynamic firewall daemon.

Hint: Some lines were ellipsized, use -l to show in full.

To reload firewall configuration

$ firewall-cmd --reload

Configuration of firewalld

firewalld is configured with xml files.

configuration files are located in two directories :

• /usr/lib/firewalld - hold default configuration , like default zones and common services. Avoid updating them because these files are updated each time when firewalld package update
• /etc/firewalld - hold system configuration file. these file overwritten default configuration.

Configuration set

firewalld has two configuration sets : runtime and permanent.

runtime - configurations are volatile in nature at reboot it changed. runtime is default.

permanent - it persistence configuration not change after reboot.

Add rule to permanent or runtime

1 Permanent

$ sudo firewall-cmd --zone=public --add-service=http --permanent

2. Runtime

$ sudo firewall-cmd --zone=public --add-service=http

reload firewalld

reload command drop all runtime configuration

sudo firewall-cmd --reload

Firewall zones

zones are  pre-constructed rule sets for various trust level . After enabling firewalld first time public is default zone.

zones can be applied different network interface cards.

 drop

Any incoming network packets are dropped; there is no reply. Only outgoing network connections are possible.

block

Any incoming network connections are rejected with an icmp-host-prohibited message for IPv4 and icmp6-adm-prohibited for IPv6. Only network connections initiated from within the system are possible.

public

For use in public areas. You do not trust the other computers on the network to not harm your computer. Only selected incoming connections are accepted.

external

For use on external networks with masquerading enabled, especially for routers. You do not trust the other computers on the network to not harm your computer. Only selected incoming connections are accepted.

dmz

For computers in your demilitarized zone that are publicly-accessible with limited access to your internal network. Only selected incoming connections are accepted.

work

For use in work areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.

home

For use in home areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.

internal

For use on internal networks. You mostly trust the other computers on the networks to not harm your computer. Only selected incoming connections are accepted.

trusted

All network connections are accepted.        

The zone names and settings are proposals and can be changed according to the needs. A built-in zone cannot be removed, but it is possible to revert the zone configuration back to the initial defaults by loading the zone defaults either in the permanent configuration of firewall-config or firewall-cmd

To view default zones

sudo fiewall-cmd --get-default-zone

To set default zones

sudo firewall-cmd --set-default-zone=dmz


To view zones used by network interface card

sudo firewall-cmd --get-active-zone

To get all the configuration for a specific zone

sudo firewall-cmd --zone=public --list-all

To get all the configuration for all zones

sudo firewall-cmd --list-all-zones

Predefined Services

A service can be a list of local ports, protocols, source ports, and destinations as well as a list of firewall helper modules automatically loaded if a service is enabled.

To list all services available on the system, enter the following command:

~]$ firewall-cmd --get-services

To get the settings of a service, use the following command:

~]$ firewall-cmd --info-service=service-name 

we can also view available list of services by accessing /usr/lib/firewalld/services directory.

Note : /usr/lib/firewalld/services/ directory must not be edited. only the file inside /etc/firewalld/services should be edited.

Services can be add or edited by firewall-cmd , firewall-offline-cmd, firewall-config tools. alternatively we can edit /etc/firewalld/services/  xml files.

enter the following command to add a new and empty service:

~]$ firewall-cmd --permanent --new-service=service-name

To add a new service using a local file, use the following command:

~]$ firewall-cmd --permanent --new-service-from-file=service-name.xml

As soon as service settings are changed, an updated copy of the service is placed into /etc/firewalld/services/. 
As root, you can enter the following command to copy a service manually

~]# cp /usr/lib/firewalld/services/service-name.xml /etc/firewalld/services/service-name.xml

firewalld loads files from /usr/lib/firewalld/services in the first place. If files are placed in /etc/firewalld/services and they are valid, then these will override the matching files from /usr/lib/firewalld/services. The overriden files in /usr/lib/firewalld/services will be used as soon as the matching files in /etc/firewalld/services have been removed or if firewalld
 has been asked to load the defaults of the services. This applies to 
the permanent environment only. A reload is needed to get these 
fallbacks also in the runtime environment.

Configuring firewalld

firewall service can be configured by firewall-cmd ,firewall-config or firewall-offline-cmd or by editing xml configuration files.

1. firewall-config - it is graphical tool.

to start graphical interface enter following command.

$ firewall-config

Firewall configuration window open, note this command can be run as normal user but administrator password asked for validation.