资讯详情

RHEL7: How to get started with Firewalld.

https://www.certdepot.net/rhel7-get-started-firewalld/

Last updated on February 13, 2017

Note: This is anRHCSA 7 exam objective and anRHCE 7 exam objective.

Presentation

is the new userland interface in. It replaces theinterface and connects to the kernel code. It mainly improves the security rules managementby allowing configurationchanges without stopping the current connections.

To know if is running, type:

#  firewalld.service - firewalld - dynamic firewall daemon    Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled)    Active:  (running) since Tue 2014-06-17 11:14:49 CEST; 5 days ago    ...

or alternatively:

#  running

Note: If is not running, the command displays .

If you’ve got several network interfaces in , you will have to activate . To do that, paste the following line into the file:

Then, activate the configuration:

#

Note: If you interested in kernel parameter configuration, there is a tutorial about the sysctl command.

Although is theway to deal with firewalls and provides many improvements, iptables can still be used (but both shouldn’t run at the same time).

You can also look at the iptables rules created by with the command.

Zone Management

Also, a new concept of zone appears: all network interfaces can be located in the same default zone ordividedintodifferent ones according to the levels of trust defined. In the latter case, this allows to restrict traffic based on origin zone (read this article from for more details). Note: Without any configuration, everything is done by default in the zone. If you’ve got more than one network interface or use (see section below), you will be able to restrict traffic between zones.

To get the default zone, type:

#  public

To getthe list of zones where you’ve got network interfaces or sources assigned to, type:

#  public   interfaces: eth0

Note: You can have more than one active zone at a time.

To get the list of all the available zones, type:

#  block dmz drop external home internal public trusted work

To change the default zone to permanently, type:

#  success

Note: This information is stored in the file.

Network interfaces can be assigned to a zone in a way. To assign the network interface to the zone (a file called is created in the directory), type:

#  success #  System eth0 4de55c952368-429b-be65-8f7b1a357e3f  802-3-ethernet  eth0
# 
# 
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/1)

Note1: This operation can also be done by editing the file and add followed by # Note2: More information about the command is available at the page dedicated to nmcli or at the IPV4 configuration page. Note3: The release improves the way handles zones (v0.3.9 -> v0.4.3.2: BZ#1302802).

To know which zone is associated with the interface, type:

# 
internal

To get the configuration of the zone, type:

# 
public (default, active)
  interfaces: eth0
  sources: 
  services: dhcpv6-client ssh
  ports: 
  masquerade: no
  forward-ports: 
  icmp-blocks: 
  rich rules:

It is also possible to create new zones. To create a new zone (here ), type:

# success
# success

Note: Only zones can be created.

Source Management

A zone can be bound to a network interface (see above) and/or to a network addressing (called here a ). Any network packet entering in the network stack is associated with a zone. The association is done according to the following pattern: – is the packet coming from a source already bound to a zone? (if yes, it is associated with this zone), – if not, is the packet coming from a network interface already bound to a zone? (if yes, it is associated with this zone), – if not, the packet is associated with the default zone.

This way, multiple zones can be defined even on a server with only one network interface!

: To get this feature, relies on (see reference). This means that if you plan to stop for any reason (for example when building a host), you will have to stop Firewalld and use Iptables instead! Note: With the release, robustness has been improved in regard to  (see details here).

To add a source (here ) to a zone (here ) , type:

# 
success
# 
success

Note1: Use the option to delete a previous assigned source. Note2: Use the option to move the source to the new specified zone. Note3: If you want to add a source to a zone, don’t use the option and don’t the firewall configuration. If you the firewall configuration, this will all the operation. Note4: You can also make some changes and when you like your new configuration, have it become your permanent configuration with the command.

With the release, you can add a source based on a address (here ) to a zone (here ) :

# 
success
# 
success

With the release, you can create an (a set of IP addresses or networks, see below) and add a source based on it:

# 
success
# 
success
# 
success
# 
success
# 
success
# 
success

To get the list of the sources bound to a zone (here ), type:

# 
192.168.2.0/24 00:11:22:33:44:55 ipset:iplist

Note: Remove the option if you only want to display  settings.

To keep track of your configuration ( zones are zones that have a binding to an interface or source), type:

# public
  interfaces: eth0
trusted
  sources: 192.168.2.0/24

As an exemple of source management, let’s assume you want to only allow connections to your server from a specific IP address (here ).

# 
success
# 
success
# 
success
# 
success

Source: Serverfault website.

With , a new option called is available. To get the detail of a zone called , type:

#

Note: You can also add the option.

Service Management

After assigning each network interface to a zone, it is now possible to add services to each zone. To allow the service in the zone, type:

# 
success
# success

Note1: Type to deny the service. Note2: The  command is necessary to activate the change. Contrary to the option, current connections are not stopped. Note3: If you only want to add a service, don’t use the option and don’t the firewall configuration. If you the firewall configuration, you all the operation.

If you want to temporary add several services (here , , and ) at the same time in the zone, type:

# 
success

To get the list of services in the default zone, type:

# 
dhcpv6-client ssh

Note: To get the list of the services in a particular zone, add the option.

With , a new option called is available. To get some information about the service, type:

#

Note: You can also add the option.

Firewall Services Configuration

With the package, the firewall configuration of the main services (ftp, httpd, etc) comes in the directory. But it is still possible to add new ones in the directory. Also, if files exist at both locations for the same service, the file in the  directory takes precedence.

For example, it is the case of the  service. There is no firewall configuration associated. Create the and paste the following lines:

<?xml version="1.0" encoding="utf-8"?>
<service>
 <short>HAProxy</short>
 <description>HAProxy load-balancer</description>
 <port protocol="tcp" port="80"/>
</service>

Note: You can use the command to quickly create a configuration file skeleton.

Assign the correct context and file permissions to the file:

# 
# 
#

Add the service to the default zone and the firewall configuration:

# success
# success

Note: According to , it is possible to go quicker by using the command history (see details here):

# 
success
# 
success

In (, there were firewall services configured: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , . In (, the service was added. In (), the , , , , and services were added. In (), the , , , , , , , , , , , , , , , , , , , , , , , , , and services have been added for a total of services.

Port Management

Port management follows the same model as service management.

To allow the port in the zone, type:

# 
success

Note1: To make the configuration , add the option and the firewall configuration. Note2: Type to deny the port.

To get the list of ports open in the zone, type:

# 
443/tcp

Note: To only get the list of ports open, add the option. Here, you will not get anything.

Rich Rules

As the syntax used by the rich rules are somehow difficult to remember, keep in mind the command and the section at the end.

Here is the format of a rich rule:

#

To allow all connections from , type:

#

Note1: The option writes coming packets into the file. Note2: Use the option instead of the option if you want to delete an already existing rule.

To list the rich rules set in the default zone, type:

# 
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources:
  services: dhcpv6-client ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  sourceports:
  icmp-blocks:
  rich rules:

Direct Rules

It is still possible to set specific rules by using the mode (here to open the tcp port ) that by-passes the interface:

# 
success

Note1: This example has been borrowed from Khosro Taraghi’s blog. Note2: Use the same command with the instead of to delete the rule. Note3: The configuration is except if you add the option just after the option. Note4: It is not necessary to the firewall configuration, all commands are activated.

To display all the direct rules added, type:

#

Note1: For information, the configuration is written into the file. Note2: are not part of the / exam objectives.

IP Set Management

With the comes the ability to create . An is a set of IP addresses or networks. The different categories belong to or .

To create a permanent IPv4  containing two IP addresses and drop packets coming from these addresses, type:

# 
success
# 
success
# 
success
# 
success
# 
success

Note: Add to create an ipset.

To get the content of the ipset, type:

# 
blacklist
type: hash:ip
options:
entries: 192.168.1.11 192.168.1.12

To remove the entry from the ipset, type:

# success
# 
192.168.1.11

To create a permanent IPv4 ipset containing two networks, type:

# 
success
# 
success
# 
success
# 
success
# 
netlist
 type: hash:net
 options: 
 entries: 192.168.1.0/24 192.168.2.0/24

To remove the  ipset, type: 
# success
# success
# blacklist

It is also possible to download the content of an ipset from a file ( option) or store it with the name  in the 
or  files according to the following format:
<?xml version="1.0" encoding="utf-8"?>
<ipset type="hash:ip">
  <short>My Ipset</short>
  <description>description</description>
  <entry>192.168.1.11</entry>
  <entry>192.168.1.12</entry>
</ipset>

To load this ipset, type:

#

Masquerading

If your firewall is your network gateway and you don’t want everybody to know your internal addresses, you can set up two zones, one called , the other , and configure on the zone. This way, all packets will get your firewall ip address as source address.

To set up on the zone in a temporary way, type:

# success

Note1: To remove , use the option. Note2: To know if  is active in a zone, use the  option. Note3: To get the configuration , add the option and the firewall configuration.

Port Forwarding

is a way to forward inbound network traffic for a specific port to another internal address or an alternative port.

(source). This point is a classical mistake made during the exam.

So, you need to enable before anything else:

# success

If you want all packets intended for port to be now forwarded to port , type:

# success

Note1: To remove , use the  option. Note2: To know if  is active in a zone, use the  option. Note3: If you want to make the configuration , add the option and reload the firewall configuration.

Also, if you want to define the destination ip address, this time in a way, type:

# success
# 
success

Special Modules

Sometimes it is required to download specific modules. Instead of using a rc.local file, it is better to notify  through the directory. In this example we want to add the and modules to follow connections. We only need to choose a filename (here ) and type these instructions:

# 
#

Source: StackExchange website.

Offline Configuration

In some cases (installations through or for example), you need to set up firewall rules when is not running. The command has just been created for this purpose. For instance, to open the , you would type in the file:

Instead, you can now execute the following command:

#

Configuration Backup

To store the current configuration into files, type:

# 
#

Debugging Tips

To better understand how works, assign the  value to the  variable in the file:

# firewalld command line args
# possile values: --debug
FIREWALLD_ARGS='--debug'

Restart the daemon:

#

Note: Messages will be written into the file.

Also, with the release comes the directive in the file. This directive adds logging rules right before reject and drop rules in the , and chains for the default rules and also final reject and drop rules in zones. Possible values are: , , , and (value by default).

Reload the configuration:

#

Note: Messages will be written into the file. If you also want messages to be written in a file called , edit the file, add the line and restart the configuration with

Additional Resources

In addition, you can:

Sources: RHEL7 Security Guide, wiki Fedora project.

Test yourself!

标签： woerner传感器vpb

锐单商城拥有海量元器件数据手册、 IC替代型号，打造 电子元器件IC百科大全！

 锐单商城 - 一站式电子元器件采购平台  

 深圳锐单电子有限公司