{"id":6750,"date":"2024-02-22T23:45:50","date_gmt":"2024-02-22T22:45:50","guid":{"rendered":"https:\/\/swissmakers.ch\/?p=6750"},"modified":"2024-04-24T12:32:02","modified_gmt":"2024-04-24T10:32:02","slug":"firewall-basics","status":"publish","type":"post","link":"https:\/\/swissmakers.ch\/en\/firewalld-basics\/","title":{"rendered":"Firewalld: Dynamic firewall management under Rocky Linux"},"content":{"rendered":"<p>Firewalld is a firewall service that is used on modern Linux distributions such as Rocky Linux or Red Hat Enterprise. Firewalld offers flexible management via zones and service definitions, without the need for traditional and manual creation of long iptable rules. Firewalld automatically abstracts the necessary iptable rules and sets them conveniently via Firewalld service on the respective system (netfilter kernel module). The focus here is on simple administration and rapid adaptability.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Basic knowledge and concept of firewalld<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Zones:<\/strong> <code>zones<\/code> define the trust level of the network connections \/ interfaces connected to the server. They enable differentiated handling of incoming and outgoing traffic based on the assigned security level.<br>The public zone is considered to be particularly restrictive and is intended for untrusted networks.<\/li>\n\n\n\n<li><strong>Services:<\/strong> The <code>services<\/code> in Firewalld represent predefined rule sets to control access to certain network services \/ ports in a standardised way. This includes frequently used protocols and application ports such as <code>HTTP<\/code>, <code>SSH<\/code>etc.<\/li>\n<\/ul>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\" style=\"font-size:16px\">\n<h5 class=\"wp-block-heading\">General use of the public zone for increased security<\/h5>\n<cite>As already mentioned, the <strong>Public Zone<\/strong> for the <strong>Intended for use in insecure or public networks<\/strong> and offers the <strong>most restrictive configuration<\/strong>. This minimises the risk of unwanted access and is particularly important for interfaces that are directly connected to the Internet. The assignment of an interface to the public zone and the subsequent careful configuration of the permitted services and ports is generally recommended - even in apparently secure, internal server networks (<strong>Zero trust approach<\/strong>).<\/cite><\/blockquote>\n\n\n\n<h4 class=\"wp-block-heading\">Zone management<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>List active zones:<\/strong> <code># firewall-cmd --list-all-zones<\/code> shows all configured zones and their settings.<\/li>\n\n\n\n<li><strong>Change the zone for an interface:<\/strong> With <code># firewall-cmd --zone=public --change-interface=eth0<\/code> the network interface can be <strong>eth0<\/strong> the <strong>Public Zone<\/strong> can be assigned.<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Managing services<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Add a service (service):<\/strong> <code># firewall-cmd --zone=public --add-service=http<\/code> allows HTTP traffic (<strong>Port 80\/TCP<\/strong>) in the Public Zone. For <strong>persistent changes<\/strong> is additionally assigned to the command \"<code>--permanent<\/code>\" attached.<\/li>\n\n\n\n<li><strong>Remove service:<\/strong> <code># firewall-cmd --zone=public --remove-service=http<\/code> removes the release again. Persistent changes also require the \"<code>--permanent<\/code>\" Flag.<\/li>\n\n\n\n<li><strong>Display of all currently authorised services<\/strong>: <code># firewall-cmd --list-services<\/code><\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Adding and removing new ports<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Add custom port:<\/strong> <code># firewall-cmd --zone=public --add-port=5000\/tcp<\/code> opens TCP port 5000 in the public zone.<br>For a permanent change also here \"<code>--permanent<\/code>\" do not forget.<\/li>\n\n\n\n<li><strong>Close custom port:<\/strong> <code># firewall-cmd --zone=public --remove-port=5000\/tcp<\/code> closes the port again.<\/li>\n\n\n\n<li><strong>Display all authorised ports<\/strong>: <code># firewall-cmd --list-ports<\/code><\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-verse\"><strong>Pro tip<\/strong>: To keep all current <strong>allowed services or ports<\/strong> is the easiest way to display <code># firewall-cmd --list-all<\/code> used.<\/pre>\n\n\n\n<pre class=\"wp-block-code has-base-2-color has-contrast-background-color has-text-color has-background has-link-color wp-elements-2c81df2b65102eaa152f9a77c296e0a2\"><code lang=\"basic\" class=\"language-basic\"># firewall-cmd --list-all\npublic (active)\n  target: default\n  icmp-block-inversion: no\n  interfaces: bridge0_to_LAN bridge1_to_RP enp1s0f0 enp1s0f1 enp1s0f2 enp1s0f3 storage-bond0\n  sources:\n  services: cockpit dhcpv6-client http https plex ssh\n  ports: 6060\/tcp 6062\/tcp 6063\/tcp 6064\/tcp 6065\/tcp 8080\/tcp 6061\/tcp 7020\/tcp 7015\/tcp 7030\/tcp 7040\/tcp 6066\/tcp 5601\/tcp 9200\/tcp 19999\/tcp 32401\/tcp 5044\/tcp 7041\/tcp 3000\/tcp 6067\/tcp 81\/tcp 6070\/tcp 8443\/tcp 9300\/tcp 6071\/tcp 6622\/tcp 2342\/tcp 6072\/tcp 7031\/tcp 7042\/tcp 3005\/tcp 7043\/tcp 7029\/tcp 9003\/tcp 8000\/tcp\n  protocols:\n  forward: no\n  masquerade: no\n  forward-ports:\n  source-ports:\n  icmp-blocks:\n  rich rules:<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Create customised services<\/h3>\n\n\n\n<p>If, for example, you deploy your own software that requires several ports via different protocols such as TCP or UDP, it makes sense that all ports belonging to the service in question can also be defined and maintained uniformly on the Linux system. The procedure is quite simple:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Define new service:<\/strong> Under \"<code>\/etc\/firewalld\/services\/<\/code>\" a new <strong>XML file<\/strong> for the service to be defined.<\/li>\n<\/ul>\n\n\n\n<p>An example of such a definition could look like this:<\/p>\n\n\n\n<pre title=\"\" class=\"wp-block-code has-base-2-color has-contrast-background-color has-text-color has-background has-link-color wp-elements-7a2533bc38d813d8df9a661e4c18fc35\"><code lang=\"xml\" class=\"language-xml line-numbers\">plex\n  Needed Ports for Plex Server<\/code><\/pre>\n\n\n\n<p>After creating a new service definition, in our case \"plex\", under the specified path, Firewalld must be reloaded before the newly defined service can then be started with <br><code># firewall-cmd --zone=public --add-service=plex<\/code> can be activated.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Re-read service files:<\/strong> With <code># firewall-cmd --reload<\/code> all changes are read in again by Firewalld and the new services can then be added to the zone.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Important details about the persistent rules<\/h3>\n\n\n\n<p><strong>Persistent rules are used when defining<\/strong> from Firewalld <strong>exclusively in the configuration<\/strong>in the example of the public zone under \"<code>\/etc\/firewalld\/zones\/public.xml<\/code>\u00ab, <strong>written<\/strong>. This allows them to be loaded automatically when the system is restarted. <strong>Important<\/strong>But that means, <strong>that newly defined persistent rules are not applied immediately.<\/strong> Therefore, the definition in the Runtime, i.e. either again without \"<code>--persistant<\/code>\" necessary, <strong>or the simpler variant<\/strong>by reloading the firewall configuration with <code># firewall-cmd --reload<\/code>.<br>This ensures that all changes to the persistant configuration are active (reloaded) and can also be used as a test to see whether all connections still work as they should after a reboot.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Summary<\/h3>\n\n\n\n<p>Firewalld provides an advanced and scalable solution for firewall management on Rocky Linux or Red Hat based systems. By using zones and services, administrators can effectively plan and control network traffic and generally increase transparency and security. Observing best practices, such as using the public zone not only for insecure networks, as well as testing persistent changes or restrictive rules, are important first steps towards a secure IT landscape in your organisation.<\/p>","protected":false},"excerpt":{"rendered":"<p>Firewalld is a firewall service that runs on modern Linux distributions such as Rocky Linux or Red Hat Enterprise ... <\/p>\n<p class=\"read-more-container\"><a title=\"Firewalld: Dynamic firewall management under Rocky Linux\" class=\"read-more button\" href=\"https:\/\/swissmakers.ch\/en\/firewalld-basics\/#more-6750\" aria-label=\"Read more about Firewalld: Dynamic firewall management under Rocky Linux\">Read more<\/a><\/p>","protected":false},"author":2,"featured_media":6759,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_eb_attr":"","_kad_blocks_custom_css":"","_kad_blocks_head_custom_js":"","_kad_blocks_body_custom_js":"","_kad_blocks_footer_custom_js":"","footnotes":""},"categories":[15,26,55,17],"tags":[56,33,41],"class_list":["post-6750","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-itsecurity","category-enginering","category-linux","category-network","tag-firewall","tag-linux","tag-rocky-linux","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"taxonomy_info":{"category":[{"value":15,"label":"IT-Security"},{"value":26,"label":"Engineering"},{"value":55,"label":"Linux"},{"value":17,"label":"Network"}],"post_tag":[{"value":56,"label":"firewall"},{"value":33,"label":"linux"},{"value":41,"label":"rocky linux"}]},"featured_image_src_large":["https:\/\/swissmakers.ch\/wp-content\/uploads\/2024\/02\/DALL\u00b7E-2024-02-22-18.44.06-Create-a-wide-image-featuring-a-firewall-represented-as-a-towering-unscalable-wall-of-flames-with-a-Tux-penguin-standing-in-front-of-it.-The-wall-sh-1024x585.webp",1024,585,true],"author_info":{"display_name":"Michael Reber","author_link":"https:\/\/swissmakers.ch\/en\/author\/michael\/"},"comment_info":0,"category_info":[{"term_id":15,"name":"IT-Security","slug":"itsecurity","term_group":0,"term_taxonomy_id":15,"taxonomy":"category","description":"","parent":0,"count":9,"filter":"raw","cat_ID":15,"category_count":9,"category_description":"","cat_name":"IT-Security","category_nicename":"itsecurity","category_parent":0},{"term_id":26,"name":"Engineering","slug":"enginering","term_group":0,"term_taxonomy_id":26,"taxonomy":"category","description":"","parent":0,"count":5,"filter":"raw","cat_ID":26,"category_count":5,"category_description":"","cat_name":"Engineering","category_nicename":"enginering","category_parent":0},{"term_id":55,"name":"Linux","slug":"linux","term_group":0,"term_taxonomy_id":55,"taxonomy":"category","description":"","parent":0,"count":10,"filter":"raw","cat_ID":55,"category_count":10,"category_description":"","cat_name":"Linux","category_nicename":"linux","category_parent":0},{"term_id":17,"name":"Network","slug":"network","term_group":0,"term_taxonomy_id":17,"taxonomy":"category","description":"","parent":0,"count":6,"filter":"raw","cat_ID":17,"category_count":6,"category_description":"","cat_name":"Network","category_nicename":"network","category_parent":0}],"tag_info":[{"term_id":56,"name":"firewall","slug":"firewall","term_group":0,"term_taxonomy_id":56,"taxonomy":"post_tag","description":"","parent":0,"count":1,"filter":"raw"},{"term_id":33,"name":"linux","slug":"linux","term_group":0,"term_taxonomy_id":33,"taxonomy":"post_tag","description":"","parent":0,"count":5,"filter":"raw"},{"term_id":41,"name":"rocky linux","slug":"rocky-linux","term_group":0,"term_taxonomy_id":41,"taxonomy":"post_tag","description":"","parent":0,"count":5,"filter":"raw"}],"_links":{"self":[{"href":"https:\/\/swissmakers.ch\/en\/wp-json\/wp\/v2\/posts\/6750","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/swissmakers.ch\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/swissmakers.ch\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/swissmakers.ch\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/swissmakers.ch\/en\/wp-json\/wp\/v2\/comments?post=6750"}],"version-history":[{"count":54,"href":"https:\/\/swissmakers.ch\/en\/wp-json\/wp\/v2\/posts\/6750\/revisions"}],"predecessor-version":[{"id":7055,"href":"https:\/\/swissmakers.ch\/en\/wp-json\/wp\/v2\/posts\/6750\/revisions\/7055"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/swissmakers.ch\/en\/wp-json\/wp\/v2\/media\/6759"}],"wp:attachment":[{"href":"https:\/\/swissmakers.ch\/en\/wp-json\/wp\/v2\/media?parent=6750"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/swissmakers.ch\/en\/wp-json\/wp\/v2\/categories?post=6750"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/swissmakers.ch\/en\/wp-json\/wp\/v2\/tags?post=6750"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}