CentOS Firewall:  firewalld commands

I. Introduction

Centos7 and above releases have tried to bring firewalld firewall, firewalld to bring iptables firewall. The reason is that the firewall policy of iptables is handled by the netfilter network filter at the kernel level, while firewalld is handled by the nftables packet filtering framework at the kernel level. Compared with iptables firewall, firewalld supports dynamic update technology and adds the concept of zone. To put it simply, the area is that firewalld has prepared several sets of firewall policy sets (policy templates) in advance. Users can choose the appropriate policy set according to different production scenarios to achieve rapid switching between firewall policies.

Zone is a major feature for firewalld, but for us, Centos7 is generally on the server, and there is less need to switch zones, so this article will not introduce it. There are more online information. You can go to Baidu to find information.

2. Operation and configuration

1. Service Operation

Start the service:

systemctl start firewalld

There is no need to worry about being unable to remotely pass ssh after the firewall is enabled. By default, port 22 has a permission rule added.

Out of service:

systemctl stop firewalld

Restart the service:

systemctl restart firewalld

View service status:

systemctl status firewalld

2. Configuration file description

firewalld stores configuration files in two directories, /usr/lib/firewalldand the /etc/firewalldformer stores some default files, and the latter mainly stores user-defined data, so the services or rules we add are performed under the latter.

server Folders store service data, which is a set of defined rules.

zones Storage area rules

firewalld.conf The default configuration file, you can set the default zone, the default zone is public, corresponding to the zone public.xml

Three. Command

It should first be noted that, when executing the command, if there is no band --permanentparameter indicates the configuration take effect immediately, but not the configuration storage, equivalent to reboot the server will be lost. If you take will be configured to store the configuration file ,, but this is just the configuration to a file, but did not take effect, we need to execute firewall-cmd --reloadthe command reload configuration takes effect.

1. Overload firewall configuration

firewall-cmd --reload

2. Check the running status of the firewall

firewall-cmd --state

3. View the settings of the default area

firewall-cmd --list-all

4. Emergency order

firewall-cmd --panic-on  
firewall-cmd --panic-off 
firewall-cmd --query-panic

5. Service

firewall-cmd --add-service=<service name> 
firewall-cmd --remove-service=<service name> 

6. Port

firewall-cmd --add-port=<port>/<protocol> 
firewall-cmd --remove-port=<port>/<protocol> 
firewall-cmd --list-ports 

7. Protocol

firewall-cmd --add-protocol=<protocol> 
firewall-cmd --remove-protocol=<protocol> 
firewall-cmd --list-protocols 

8. Allow all traffic of the specified ip

firewall-cmd --add-rich-rule="rule family="ipv4" source address="<ip>" accept"

Example:

firewall-cmd --add-rich-rule="rule family="ipv4" source address="192.168.2.1" accept" 

9. Allow the specified protocol of the specified ip

firewall-cmd --add-rich-rule="rule family="ipv4" source address="<ip>" protocol value="<protocol>" accept"

Example:

firewall-cmd --add-rich-rule="rule family="ipv4" source address="192.168.2.208" protocol value="icmp" accept" 

10. Allow designated ip to access designated services

firewall-cmd --add-rich-rule="rule family="ipv4" source address="<ip>" service name="<service name>" accept"

Example:

firewall-cmd --add-rich-rule="rule family="ipv4" source address="192.168.2.208" service name="ssh" accept" 

11. Allow the specified ip to access the specified port

firewall-cmd --add-rich-rule="rule family="ipv4" source address="<ip>" port protocol="<port protocol>" port="<port>" accept"

Example:

firewall-cmd --add-rich-rule="rule family="ipv4" source address="192.168.2.1" port protocol="tcp" port="22" accept" 

12. Change the designated ip to the network segment

8-11 various commands support source addressto the network segment that this segment of the ip are adapting to this rule:

E.g:

firewall-cmd --zone=drop --add-rich-rule="rule family="ipv4" source address="192.168.2.0/24" port protocol="tcp" port="22" accept"

Indicates that hosts on the 192.168.2.0/24 network segment are allowed to access port 22.

13. It is forbidden to specify ip/net segment

8-12 each command, the acceptset rejectrejected, setting dropa direct discarded (connection timeout returns timeout)

E.g:

firewall-cmd --zone=drop --add-rich-rule="rule family="ipv4" source address="192.168.2.0/24" port protocol="tcp" port="22" reject"

Indicates that hosts on the 192.168.2.0/24 network segment are prohibited from accessing port 22.