Hi everyone,
today I want to go through some firewalld commands. The basic ones and some obscure. This will be more of a cheat sheet than anything else, since I don’t have an exact use case for this post.
Almost every basic command (add, remove) is added to the current runtime and is lost after a reload. For most commands we can either just add –permanent or we execute the –runtime-to-permanent option to make the current runtime permanent.
Let’s begin.
Firewalld Examples
Start, Stop and Firewalld service
# Start the service
sudo systemctl start firewalld.service
# Stop the service
sudo systemctl stop firewalld.service
# Restart the service
sudo systemctl restart firewalld.service
Reload the firewalld configuration without restarting the service
# Reload the configuration
sudo firewall-cmd --reload
List the current configuration
# List default zone
sudo firewall-cmd --list-all
# List specific zone
sudo firewall-cmd --list-all --zone work
# List all zones
sudo firewall-cmd --list-all-zones
# List the current active zone (zones with interfaces assigned)
sudo firewall-cmd --get-active-zones
Add a service by name to the firewall rules
# Add service temporary (until firewalld reload)
sudo firewall-cmd --add-service http
# Add service permanently
sudo firewall-cmd --add-service http --permanent
# Add service permanently and reload service to load it into the running config
sudo firewall-cmd --add-service http --permanent --reload
# Add service to specific zone
sudo firewall-cmd --add-service http --zone work --permanent
Add a service using the port number and protocol
# Add port temporary (until firewalld reload)
sudo firewall-cmd --add-port 8443/tcp
# Add port permanently
sudo firewall-cmd --add-port 8443/tcp --permanent
# Add port to specific zone
sudo firewall-cmd --add-port 8443/tcp --zone work --permanent
Remove service and port
# Remove service
sudo firewall-cmd --remove-service http --permanent --reload
# Remove port
sudo firewall-cmd --remove-port 8443/tcp --permanent --reload
Move a interface to another zone
# Moving interfaces to different zones
sudo firewall-cmd --add-interface wwan0 --zone work
# Add it permanently
sudo firewall-cmd --add-interface wwan0 --zone work --permanent
## Once assigned you have to remove the interface to add it to another
# Remove interface from zone
sudo firewall-cmd --remove-interface wwan0 --zone work --permanent
Zones: get/set default
# Get the current default zone
sudo firewall-cmd --get-default-zone
# Set the current default zone
sudo firewall-cmd --set-default-zone=work
Panic mode (blocks all traffic immediately)
# enable panic mode
sudo firewall-cmd --panic-on
# disable panic mode
sudo firewall-cmd --panic-off
# check the current status
sudo firewall-cmd --query-panic
Now, lets list a few more advanced options.
advanced options
# Fine-grained control (rich rules). Allow traffic from a specific network
sudo firewall-cmd --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" accept' --permanent
# Port forwarding
sudo firewall-cmd --add-forward-port=port=80:proto=tcp:toport=8080 --permanent
# Create a custom zone
sudo firewall-cmd --new-zone=<my-zone> --permanent
ICMP traffic (depends on the inversion state)
# List ICMP types
sudo firewall-cmd --get-icmptypes
# Deny ICMP (invert the current setting)
sudo firewall-cmd --add-icmp-block-inversion
# Allows echo reply (When the inversion is active)
sudo firewall-cmd --add-icmp-block=echo-reply
# Allows echo request (When the inversion is active)
sudo firewall-cmd --add-icmp-block=echo-request
Next, we have a list of logging commands.
Logging
# Verbose logs for every denied packet
sudo firewall-cmd --set-log-denied=all
# Log only unicast
sudo firewall-cmd --set-log-denied=unicast
# Disable denied-packet logging
sudo firewall-cmd --set-log-denied=off
# Get the current setting for denied logging
sudo firewall-cmd --get-log-denied
Alright. That’s it. If I can think of any other commands, I will update this post. Till next time.
Comments