firewall-cmd

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

Wat het doet

firewall-cmd talks to the firewalld service. Changes without --permanent work at once but are lost at reload or reboot; with --permanent they are saved but only active after --reload. Most options follow one pattern: --add-X, --remove-X, --query-X, --list-X, optionally with --zone=ZONE (default: the default zone).

Zo schrijf je het

firewall-cmd [--permanent] [--zone=ZONE] OPTION...
firewall-cmd --reload | --state | --list-all

Opties 43

Meest gebruikt

General

--state: Is firewalld running?
--reload: Load the permanent config (runtime-only changes are lost).
--complete-reload: Full reload (drops connections).
--permanent: Change the saved config (needs --reload to apply).
--runtime-to-permanent: Save the current runtime config.
--check-config: Check the saved config for errors.
--reset-to-defaults: Back to the default config.
--get-log-denied, --set-log-denied=all|unicast|broadcast|multicast|off: Log rejected packets.
--timeout=TIME: With --add-…: remove the rule again after TIME (like 10m).
-q, --quiet: No messages.
-h, --help, -V, --version: Help / version.

Zones

--get-default-zone: Show the default zone.
--set-default-zone=ZONE: Change the default zone.
--get-active-zones: Zones that have interfaces or sources.
--get-zones: All zones.
--get-zone-of-interface=IF, --get-zone-of-source=SOURCE: Find the zone.
--list-all [--zone=ZONE]: Everything in a zone.
--list-all-zones: Everything in all zones.
--info-zone=ZONE: Details of a zone.
--zone=ZONE: Work on this zone.
--new-zone=ZONE, --delete-zone=ZONE, --load-zone-defaults=ZONE, --path-zone=ZONE: Create, delete, reset zones (with --permanent).
--get-target, --set-target=default|ACCEPT|DROP|REJECT: Default action of a zone (permanent).
--set-description, --set-short, --get-priority, --set-priority …: Zone details (permanent).

Zone content

--add-service=SERVICE, --remove-service=SERVICE, --query-service=SERVICE, --list-services: Services in the zone.
--add-port=PORT[-PORT]/PROTO, --remove-port=…, --query-port=…, --list-ports: Ports, like 8080/tcp.
--add-source=ADDR[/MASK]|ipset:NAME, --remove-source=…, --query-source=…, --list-sources: Bind source networks to the zone.
--add-interface=IF, --remove-interface=IF, --change-interface=IF, --query-interface=IF, --list-interfaces: Interfaces of the zone.
--add-rich-rule='RULE', --remove-rich-rule='RULE', --query-rich-rule='RULE', --list-rich-rules: Detailed rules.
--add-forward-port=port=P:proto=tcp[:toport=P][:toaddr=A], --remove-forward-port=…, --list-forward-ports: Port forwarding.
--add-masquerade, --remove-masquerade, --query-masquerade: NAT for traffic leaving this zone.
--add-protocol=PROTO, --remove-protocol=…, --list-protocols: Allow a protocol (like gre).
--add-source-port=PORT/PROTO, --remove-source-port=…, --list-source-ports: Allow by source port.
--add-icmp-block=TYPE, --remove-icmp-block=…, --list-icmp-blocks, --add-icmp-block-inversion: Block ICMP types.
--add-forward, --remove-forward, --query-forward: Intra-zone forwarding.

Services, ipsets, helpers, icmptypes

--get-services: All known services.
--info-service=SERVICE: Ports and details of a service.
--new-service=NAME, --delete-service=NAME, --service=NAME --add-port=…: Define your own service (permanent).
--get-ipsets, --new-ipset=NAME --type=TYPE, --ipset=NAME --add-entry=ADDR, --info-ipset=NAME: IP sets (lists of addresses).
--get-helpers, --get-icmptypes, --info-helper=…, --info-icmptype=…: Helpers and ICMP types.
--new-policy=NAME, --policy=NAME …, --get-policies: Policies between zones (newer firewalld).

Emergency and lockdown

--panic-on, --panic-off, --query-panic: Drop all traffic (also your SSH!).
--lockdown-on, --lockdown-off, --query-lockdown, --add-lockdown-whitelist-…: Only allowed programs may change firewalld.
--direct --add-rule …: Old direct rules (deprecated).

Voorbeelden 12

$ als gewone gebruiker# als root (of met sudo)

1What is open?

#firewall-cmd --list-all
public (active)
  interfaces: enp1s0
  services: cockpit dhcpv6-client ssh
  ports:
  rich rules:

The default zone on RHEL.

2Open a service permanently

#firewall-cmd --add-service=http --permanent
#firewall-cmd --reload

Survives reboots.

3Open a port

#firewall-cmd --add-port=82/tcp --permanent; firewall-cmd --reload

For non-standard ports (also fix SELinux!).

4Close a service

#firewall-cmd --remove-service=cockpit --permanent; firewall-cmd --reload

Smaller attack surface.

5Test a rule for 5 minutes
```
#firewall-cmd --add-port=9090/tcp --timeout=5m
```
Removed automatically.

6Trust an admin network

#firewall-cmd --zone=trusted --add-source=192.168.122.0/24 --permanent; firewall-cmd --reload

Everything from that network is allowed.

7Service only for one network

#firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/24" service name="ssh" accept'

Combine with removing ssh from the zone.

8Block one address

#firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.50" drop'; firewall-cmd --reload

An attacker from the logs.

9Port forwarding

#firewall-cmd --permanent --add-forward-port=port=80:proto=tcp:toport=8080; firewall-cmd --reload

Port 80 goes to 8080 on the same host.

10Save runtime changes
```
#firewall-cmd --runtime-to-permanent
```
When you tested without --permanent.
11Which ports does a service open?
```
$firewall-cmd --info-service=samba
```
ports: 139/tcp 445/tcp …

12Log denied packets (security)

#firewall-cmd --set-log-denied=all
#journalctl -k -f | grep REJECT

See what is blocked.

Let op

--permanent changes are not active until --reload; runtime changes are lost at reload.
--panic-on cuts your SSH session.

Bestanden

/etc/firewalld/: Your saved config (zones, services).
/usr/lib/firewalld/: Default zones and services.
/etc/firewalld/firewalld.conf: DefaultZone, backend, logging.

Exitcodes

0 :: Done (query: yes). 1 :: Query: no. 2 :: Wrong use. 252 :: firewalld is not running.

`firewall-cmd`

Wat het doet

Zo schrijf je het

Opties 43

General

Zones

Zone content

Services, ipsets, helpers, icmptypes

Emergency and lockdown

Voorbeelden 12

1What is open?

2Open a service permanently

3Open a port

4Close a service

5Test a rule for 5 minutes

6Trust an admin network

7Service only for one network

8Block one address

9Port forwarding

10Save runtime changes

11Which ports does a service open?

12Log denied packets (security)

Let op

Bestanden

Exitcodes

Volledige handleiding

Wat het doet

Zo schrijf je het

Opties 43

General

Zones

Zone content

Services, ipsets, helpers, icmptypes

Emergency and lockdown

Voorbeelden 12

1What is open?

2Open a service permanently

3Open a port

4Close a service

5Test a rule for 5 minutes

6Trust an admin network

7Service only for one network

8Block one address

9Port forwarding

10Save runtime changes

11Which ports does a service open?

12Log denied packets (security)

Let op

Bestanden

Exitcodes

Verwante commando's

Gebruikt in deze lessen

Gebruikt in deze labs

Volledige handleiding

`firewall-cmd`