Firewalld: Comprehensive Firewall Management Guide
Introduction to Firewalld
Firewalld is a dynamic firewall management tool for Linux systems that provides a high-level interface for managing netfilter (iptables/nftables) rules. It was designed to simplify firewall configuration while providing advanced features for network security management. Unlike traditional iptables configurations, firewalld allows for runtime changes without breaking existing connections and provides a more user-friendly approach to firewall management.
Architecture and Core Concepts
Dynamic Firewall Management
Firewalld operates as a daemon that manages firewall rules dynamically. This means you can modify firewall rules without restarting the firewall service or losing existing network connections. The daemon communicates with the kernel's netfilter framework through either iptables or nftables backends.
Zones
Zones are the fundamental concept in firewalld that define trust levels for network connections. Each zone has specific rules about what traffic is allowed or denied. Network interfaces and source addresses are assigned to zones, and the zone determines the firewall behavior.
| Zone Name | Description | Default Behavior | |-----------|-------------|------------------| | drop | Lowest trust level | All incoming packets dropped without reply | | block | Low trust level | All incoming connections rejected with icmp-host-prohibited | | public | Default zone for public areas | Only selected incoming connections accepted | | external | For external networks with masquerading | Selected incoming connections accepted, NAT enabled | | dmz | For demilitarized zone systems | Only selected incoming connections accepted | | work | For work environments | More services accepted than public | | home | For home networks | More services accepted than work | | internal | For internal networks | Most services accepted | | trusted | Highest trust level | All network connections accepted |
Services
Services are predefined sets of rules that define the ports and protocols needed for specific applications or services. Firewalld includes numerous predefined services, and you can create custom services as needed.
Rich Rules
Rich rules provide advanced firewall configuration options that go beyond simple service and port management. They allow for complex rule definitions including source/destination matching, logging, and custom actions.
Installation and Setup
Installing Firewalld
`bash
On Red Hat/CentOS/Fedora systems
sudo dnf install firewalldOn Ubuntu/Debian systems
sudo apt update sudo apt install firewalldOn SUSE systems
sudo zypper install firewalldStarting and Enabling Firewalld
`bash
Start the firewalld service
sudo systemctl start firewalldEnable firewalld to start at boot
sudo systemctl enable firewalldCheck the status of firewalld
sudo systemctl status firewalldStop firewalld (if needed)
sudo systemctl stop firewalldDisable firewalld from starting at boot
sudo systemctl disable firewalldInitial Configuration Check
`bash
Check if firewalld is running
sudo firewall-cmd --stateGet general information about firewalld configuration
sudo firewall-cmd --list-allCheck the default zone
sudo firewall-cmd --get-default-zoneList all available zones
sudo firewall-cmd --get-zonesList all active zones
sudo firewall-cmd --get-active-zonesCommand-Line Interface: firewall-cmd
The firewall-cmd command is the primary tool for interacting with firewalld. It provides comprehensive functionality for managing firewall rules, zones, services, and advanced configurations.
Basic Command Structure
`bash
firewall-cmd [OPTIONS] [COMMAND]
`
Common Options
| Option | Description |
|--------|-------------|
| --zone= | Specify the zone for the command |
| --permanent | Make changes permanent (survives reboot) |
| --runtime-to-permanent | Save current runtime configuration permanently |
| --reload | Reload firewall rules from permanent configuration |
| --complete-reload | Complete reload of firewall (breaks connections) |
| --timeout= | Set timeout for temporary rules |
Zone Management
Viewing Zone Information
`bash
List all zones with their configurations
sudo firewall-cmd --list-all-zonesShow configuration for a specific zone
sudo firewall-cmd --zone=public --list-allGet the default zone
sudo firewall-cmd --get-default-zoneList active zones (zones with assigned interfaces or sources)
sudo firewall-cmd --get-active-zonesList all available zones
sudo firewall-cmd --get-zonesManaging Default Zone
`bash
Set the default zone
sudo firewall-cmd --set-default-zone=homeThe default zone is automatically assigned to new network interfaces
Interface and Zone Assignment
`bash
List interfaces in a specific zone
sudo firewall-cmd --zone=public --list-interfacesAdd an interface to a zone temporarily
sudo firewall-cmd --zone=home --add-interface=eth0Add an interface to a zone permanently
sudo firewall-cmd --zone=home --add-interface=eth0 --permanentRemove an interface from a zone
sudo firewall-cmd --zone=home --remove-interface=eth0Change interface zone assignment
sudo firewall-cmd --zone=work --change-interface=eth0Source-Based Zone Assignment
`bash
Add a source IP or network to a zone
sudo firewall-cmd --zone=trusted --add-source=192.168.1.0/24Add a source permanently
sudo firewall-cmd --zone=trusted --add-source=10.0.0.100 --permanentRemove a source from a zone
sudo firewall-cmd --zone=trusted --remove-source=192.168.1.0/24List sources assigned to a zone
sudo firewall-cmd --zone=trusted --list-sourcesChange source zone assignment
sudo firewall-cmd --zone=dmz --change-source=192.168.1.100Service Management
Predefined Services
Firewalld comes with many predefined services that correspond to common applications and protocols.
`bash
List all available services
sudo firewall-cmd --get-servicesGet information about a specific service
sudo firewall-cmd --info-service=sshList services allowed in the default zone
sudo firewall-cmd --list-servicesList services in a specific zone
sudo firewall-cmd --zone=public --list-servicesManaging Services in Zones
`bash
Add a service to the default zone temporarily
sudo firewall-cmd --add-service=httpAdd a service permanently
sudo firewall-cmd --add-service=https --permanentAdd a service to a specific zone
sudo firewall-cmd --zone=public --add-service=ssh --permanentRemove a service from a zone
sudo firewall-cmd --zone=public --remove-service=sshAdd multiple services at once
sudo firewall-cmd --add-service=http --add-service=https --permanentCheck if a service is allowed
sudo firewall-cmd --query-service=sshCommon Service Examples
| Service Name | Description | Default Ports | |--------------|-------------|---------------| | ssh | Secure Shell | 22/tcp | | http | HTTP Web Server | 80/tcp | | https | HTTPS Web Server | 443/tcp | | ftp | File Transfer Protocol | 21/tcp | | smtp | Simple Mail Transfer Protocol | 25/tcp | | dns | Domain Name System | 53/tcp, 53/udp | | nfs | Network File System | 2049/tcp | | samba | Samba File Sharing | 139/tcp, 445/tcp | | mysql | MySQL Database | 3306/tcp | | postgresql | PostgreSQL Database | 5432/tcp |
Port and Protocol Management
Managing Individual Ports
`bash
Add a port temporarily
sudo firewall-cmd --add-port=8080/tcpAdd a port permanently
sudo firewall-cmd --add-port=9000/tcp --permanentAdd a port to a specific zone
sudo firewall-cmd --zone=public --add-port=3000/tcp --permanentAdd multiple ports
sudo firewall-cmd --add-port=8000-8010/tcp --permanentAdd UDP port
sudo firewall-cmd --add-port=1194/udp --permanentRemove a port
sudo firewall-cmd --remove-port=8080/tcpList open ports
sudo firewall-cmd --list-portsQuery if a port is open
sudo firewall-cmd --query-port=22/tcpPort Range Management
`bash
Add a range of ports
sudo firewall-cmd --add-port=5000-5010/tcp --permanentAdd multiple port ranges
sudo firewall-cmd --add-port=6000-6100/tcp --add-port=7000-7100/udp --permanentRemove a port range
sudo firewall-cmd --remove-port=5000-5010/tcpRich Rules
Rich rules provide advanced firewall functionality with detailed control over packet filtering, logging, and actions.
Rich Rule Syntax
`bash
rule [family="`
Rich Rule Examples
`bash
Allow SSH from specific IP
sudo firewall-cmd --add-rich-rule='rule family="ipv4" source address="192.168.1.100" service name="ssh" accept' --permanentBlock specific IP address
sudo firewall-cmd --add-rich-rule='rule family="ipv4" source address="192.168.1.50" drop' --permanentAllow HTTP from specific network with logging
sudo firewall-cmd --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" service name="http" log prefix="HTTP-ACCESS" level="info" accept' --permanentRate limit SSH connections
sudo firewall-cmd --add-rich-rule='rule service name="ssh" log prefix="SSH-Attempt" level="info" limit value="3/m" accept' --permanentAllow specific port from specific source
sudo firewall-cmd --add-rich-rule='rule family="ipv4" source address="172.16.0.0/12" port protocol="tcp" port="8080" accept' --permanentReject with ICMP response
sudo firewall-cmd --add-rich-rule='rule family="ipv4" source address="203.0.113.0/24" reject type="icmp-host-prohibited"' --permanentTime-based rule (temporary)
sudo firewall-cmd --add-rich-rule='rule family="ipv4" source address="192.168.1.200" service name="http" accept' --timeout=3600Managing Rich Rules
`bash
List all rich rules
sudo firewall-cmd --list-rich-rulesList rich rules for specific zone
sudo firewall-cmd --zone=public --list-rich-rulesRemove a rich rule
sudo firewall-cmd --remove-rich-rule='rule family="ipv4" source address="192.168.1.100" service name="ssh" accept'Query a rich rule
sudo firewall-cmd --query-rich-rule='rule family="ipv4" source address="192.168.1.100" service name="ssh" accept'Advanced Features
Port Forwarding
Port forwarding allows redirecting traffic from one port to another, either locally or to a different host.
`bash
Forward local port to another local port
sudo firewall-cmd --add-forward-port=port=80:proto=tcp:toport=8080 --permanentForward port to different host
sudo firewall-cmd --add-forward-port=port=80:proto=tcp:toaddr=192.168.1.100:toport=80 --permanentForward with rich rule (more control)
sudo firewall-cmd --add-rich-rule='rule family=ipv4 source address=192.168.1.0/24 forward-port port=80 protocol=tcp to-port=8080' --permanentList port forwards
sudo firewall-cmd --list-forward-portsRemove port forward
sudo firewall-cmd --remove-forward-port=port=80:proto=tcp:toport=8080Masquerading (NAT)
Masquerading enables Network Address Translation, allowing internal networks to access external networks through the firewall.
`bash
Enable masquerading for a zone
sudo firewall-cmd --zone=external --add-masquerade --permanentDisable masquerading
sudo firewall-cmd --zone=external --remove-masqueradeCheck if masquerading is enabled
sudo firewall-cmd --zone=external --query-masqueradeList zones with masquerading enabled
sudo firewall-cmd --list-all-zones | grep -A 10 -B 2 masqueradeICMP Filtering
Internet Control Message Protocol (ICMP) filtering allows control over ping and other ICMP traffic.
`bash
List available ICMP types
sudo firewall-cmd --get-icmptypesBlock ping (echo-request)
sudo firewall-cmd --add-icmp-block=echo-request --permanentAllow ping in specific zone
sudo firewall-cmd --zone=home --remove-icmp-block=echo-request --permanentBlock all ICMP except specific types
sudo firewall-cmd --add-icmp-block-inversion --permanent sudo firewall-cmd --add-icmp-block=echo-request --permanentList blocked ICMP types
sudo firewall-cmd --list-icmp-blocksCustom Services
Creating Custom Services
`bash
Create a new service definition
sudo firewall-cmd --permanent --new-service=myappSet description for the service
sudo firewall-cmd --permanent --service=myapp --set-description="My Custom Application"Set short description
sudo firewall-cmd --permanent --service=myapp --set-short="MyApp"Add ports to the service
sudo firewall-cmd --permanent --service=myapp --add-port=8080/tcp sudo firewall-cmd --permanent --service=myapp --add-port=8443/tcpAdd protocols if needed
sudo firewall-cmd --permanent --service=myapp --add-protocol=tcpReload to make the service available
sudo firewall-cmd --reloadAdd the custom service to a zone
sudo firewall-cmd --zone=public --add-service=myapp --permanentManaging Custom Services
`bash
Get information about custom service
sudo firewall-cmd --info-service=myappModify existing service
sudo firewall-cmd --permanent --service=myapp --add-port=9000/tcpRemove port from service
sudo firewall-cmd --permanent --service=myapp --remove-port=8080/tcpDelete custom service
sudo firewall-cmd --permanent --delete-service=myappService Definition Files
Custom services are stored as XML files in /etc/firewalld/services/. Here's an example service definition:
`xml
`
Configuration Management
Runtime vs Permanent Configuration
Firewalld maintains two configuration sets: runtime (temporary) and permanent. Understanding the difference is crucial for proper firewall management.
| Configuration Type | Persistence | Command Usage |
|-------------------|-------------|---------------|
| Runtime | Lost on reload/restart | Default behavior |
| Permanent | Survives reload/restart | Add --permanent flag |
Configuration Workflow
`bash
Make temporary changes for testing
sudo firewall-cmd --add-service=httpTest the configuration
If satisfied, make it permanent
sudo firewall-cmd --add-service=http --permanentAlternative: Save runtime config to permanent
sudo firewall-cmd --runtime-to-permanentReload permanent configuration
sudo firewall-cmd --reloadComplete reload (breaks existing connections)
sudo firewall-cmd --complete-reloadConfiguration Files
Firewalld configuration files are stored in specific directories:
| Directory | Purpose |
|-----------|---------|
| /usr/lib/firewalld/ | Default configurations (system provided) |
| /etc/firewalld/ | Custom configurations (user defined) |
| /etc/firewalld/zones/ | Zone configuration files |
| /etc/firewalld/services/ | Custom service definitions |
Backup and Restore
`bash
Backup firewalld configuration
sudo cp -r /etc/firewalld /etc/firewalld.backup.$(date +%Y%m%d)Export current configuration
sudo firewall-cmd --list-all-zones > firewall-config-backup.txtRestore from backup
sudo systemctl stop firewalld sudo cp -r /etc/firewalld.backup.20231201 /etc/firewalld sudo systemctl start firewalldLogging and Monitoring
Enabling Logging
`bash
Set log level
sudo firewall-cmd --set-log-denied=allAvailable log levels: all, unicast, broadcast, multicast, off
sudo firewall-cmd --get-log-deniedLog specific traffic with rich rules
sudo firewall-cmd --add-rich-rule='rule service name="ssh" log prefix="SSH-LOGIN" level="info" accept' --permanentLog Locations
| Log Type | Location |
|----------|----------|
| Firewalld daemon | /var/log/firewalld |
| Kernel messages | /var/log/messages or /var/log/kern.log |
| Journal | journalctl -u firewalld |
Monitoring Commands
`bash
View firewalld service logs
sudo journalctl -u firewalld -fView recent firewall-related kernel messages
sudo dmesg | grep -i firewallMonitor dropped packets
sudo journalctl -k | grep -i "dropped"Real-time monitoring of firewall logs
sudo tail -f /var/log/messages | grep -i firewallTroubleshooting
Common Issues and Solutions
#### Issue: Service Won't Start
`bash
Check service status
sudo systemctl status firewalldCheck for configuration errors
sudo firewall-cmd --check-configView detailed logs
sudo journalctl -u firewalld -n 50#### Issue: Rules Not Working
`bash
Verify rule is applied
sudo firewall-cmd --list-allCheck if rule is permanent
sudo firewall-cmd --list-all --permanentReload configuration
sudo firewall-cmd --reload#### Issue: Connection Problems After Changes
`bash
Check active zones
sudo firewall-cmd --get-active-zonesVerify interface assignments
sudo firewall-cmd --list-all-zones | grep -A 5 -B 5 interfacesTemporarily disable firewall for testing
sudo systemctl stop firewalldDiagnostic Commands
`bash
Check firewalld state
sudo firewall-cmd --stateVerify configuration syntax
sudo firewall-cmd --check-configGet complete configuration dump
sudo firewall-cmd --list-all-zonesShow panic mode status
sudo firewall-cmd --query-panicEnable panic mode (blocks all traffic)
sudo firewall-cmd --panic-onDisable panic mode
sudo firewall-cmd --panic-offBest Practices
Security Best Practices
1. Principle of Least Privilege: Only open ports and services that are absolutely necessary 2. Regular Auditing: Periodically review firewall rules and remove unused ones 3. Logging: Enable appropriate logging for security monitoring 4. Testing: Always test firewall changes in a non-production environment first 5. Documentation: Document all custom rules and their purposes
Configuration Management Best Practices
1. Use Permanent Rules: Always make production rules permanent 2. Backup Configurations: Regular backups of firewall configurations 3. Version Control: Track changes to custom service definitions 4. Consistent Naming: Use descriptive names for custom services and rules 5. Zone Strategy: Develop a clear zone assignment strategy
Performance Considerations
1. Rule Ordering: More specific rules should be placed before general ones 2. Rich Rule Complexity: Avoid overly complex rich rules that impact performance 3. Regular Cleanup: Remove obsolete rules and services 4. Monitor Resource Usage: Watch for high CPU usage from firewall processing
Integration with Other Tools
Ansible Integration
`yaml
---
- name: Configure firewalld
hosts: all
tasks:
- name: Install firewalld
package:
name: firewalld
state: present
- name: Start and enable firewalld systemd: name: firewalld state: started enabled: yes
- name: Allow SSH firewalld: service: ssh permanent: yes state: enabled immediate: yes
- name: Allow HTTP and HTTPS
firewalld:
service: "#"
permanent: yes
state: enabled
immediate: yes
loop:
- http
- https
`
NetworkManager Integration
Firewalld integrates with NetworkManager to automatically assign network interfaces to appropriate zones based on connection profiles.
`bash
Set zone for NetworkManager connection
sudo nmcli connection modify "Wired connection 1" connection.zone homeView connection zone assignment
sudo nmcli connection show "Wired connection 1" | grep zoneThis comprehensive guide covers the essential aspects of firewalld management, from basic concepts to advanced configurations. Regular practice with these commands and concepts will help you become proficient in managing Linux firewall security with firewalld.