Procedure

1. Verify the permanent configuration of the firewalld service:

   # firewall-cmd --check-config
   success

   If the permanent configuration is valid, the command returns success. In other cases, the command returns an error with further details, such as the following:

   # firewall-cmd --check-config
   Error: INVALID_PROTOCOL: 'public.xml': 'tcpx' not from {'tcp'|'udp'|'sctp'|'dccp'}

Procedure

1. To see the status of the service:

   # firewall-cmd --state

2. For more information about the service status, use the systemctl status sub-command:

   # systemctl status firewalld
   firewalld.service - firewalld - dynamic firewall daemon
      Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor pr
      Active: active (running) since Mon 2017-12-18 16:05:15 CET; 50min ago
        Docs: man:firewalld(1)
    Main PID: 705 (firewalld)
       Tasks: 2 (limit: 4915)
      CGroup: /system.slice/firewalld.service
              └─705 /usr/bin/python3 -Es /usr/sbin/firewalld --nofork --nopid

Procedure

1. To immediately disable networking traffic, switch panic mode on:

   # firewall-cmd --panic-on

   Important

   Enabling panic mode stops all networking traffic. For this reason, it should be used only when you have the physical access to the machine or if you are logged in using a serial console.

2. Switching off panic mode reverts the firewall to its permanent settings. To switch panic mode off, enter:

   # firewall-cmd --panic-off

Procedure

1. Check that the service is not already allowed:

   # firewall-cmd --list-services
   ssh dhcpv6-client

2. List all predefined services:

   # firewall-cmd --get-services
   RH-Satellite-6 amanda-client amanda-k5-client bacula bacula-client bitcoin bitcoin-rpc bitcoin-testnet bitcoin-testnet-rpc ceph ceph-mon cfengine condor-collector ctdb dhcp dhcpv6 dhcpv6-client dns docker-registry ...
   [trimmed for clarity]

3. Add the service to the allowed services:

   # firewall-cmd --add-service=<service-name>

4. Make the new settings persistent:

   # firewall-cmd --runtime-to-permanent

Procedure

1. To enable or disable a predefined or custom service:

   1. Start the firewall-config tool and select the network zone whose services are to be configured.
   2. Select the Zones tab and then the Services tab below.
   3. Select the check box for each type of service you want to trust or clear the check box to block a service in the selected zone.

2. To edit a service:

   1. Start the firewall-config tool.
   2. Select Permanent from the menu labeled Configuration. Additional icons and menu buttons appear at the bottom of the Services window.
   3. Select the service you want to configure.

1. Enter the following command to add a new and empty service:

   $ firewall-cmd --new-service=service-name --permanent

2. To add a new service using a local file, use the following command:

   $ firewall-cmd --new-service-from-file=service-name.xml --permanent

   You can change the service name with the additional --name=service-name option.

3. As soon as service settings are changed, an updated copy of the service is placed into /etc/firewalld/services/.

   As root, you can enter the following command to copy a service manually:

   # cp /usr/lib/firewalld/services/service-name.xml /etc/firewalld/services/service-name.xml

Procedure

1. Start the firewall-config tool and select the network zone whose settings you want to change.
2. Select the Ports tab and click the Add button on the right-hand side. The Port and Protocol window opens.
3. Enter the port number or range of ports to permit.
4. Select tcp or udp from the list.

Procedure

1. Start the firewall-config tool and select the network zone whose settings you want to change.
2. Select the Protocols tab and click the Add button on the right-hand side. The Protocol window opens.
3. Either select a protocol from the list or select the Other Protocol check box and enter the protocol in the field.

Procedure

1. Start the firewall-config tool and select the network zone whose settings you want to change.
2. Select the Source Port tab and click the Add button on the right-hand side. The Source Port window opens.
3. Enter the port number or range of ports to permit. Select tcp or udp from the list.

1. List all allowed ports:

   # firewall-cmd --list-ports

2. Add a port to the allowed ports to open it for incoming traffic:

   # firewall-cmd --add-port=port-number/port-type

   The port types are either tcp, udp, sctp, or dccp. The type must match the type of network communication.

3. Make the new settings persistent:

   # firewall-cmd --runtime-to-permanent

   The port types are either tcp, udp, sctp, or dccp. The type must match the type of network communication.

1. List all allowed ports:

   # firewall-cmd --list-ports

   Warning

   This command will only give you a list of ports that have been opened as ports. You will not be able to see any open ports that have been opened as a service. Therefore, you should consider using the --list-all option instead of --list-ports.

2. Remove the port from the allowed ports to close it for the incoming traffic:

   # firewall-cmd --remove-port=port-number/port-type

3. Make the new settings persistent:

   # firewall-cmd --runtime-to-permanent

Procedure

1. To see which zones are available on your system:

   # firewall-cmd --get-zones

   The firewall-cmd --get-zones command displays all zones that are available on the system, but it does not show any details for particular zones.

2. To see detailed information for all zones:

   # firewall-cmd --list-all-zones

3. To see detailed information for a specific zone:

   # firewall-cmd --zone=zone-name --list-all

1. Display the current default zone:

   # firewall-cmd --get-default-zone

2. Set the new default zone:

   # firewall-cmd --set-default-zone zone-name

   Note

   Following this procedure, the setting is a permanent setting, even without the --permanent option.

1. List the active zones and the interfaces assigned to them:

   # firewall-cmd --get-active-zones

2. Assign the interface to a different zone:

   # firewall-cmd --zone=zone_name --change-interface=interface_name --permanent

Procedure

1. Assign the zone to the NetworkManager connection profile:

   # nmcli connection modify profile connection.zone zone_name

2. Activate the connection:

   # nmcli connection up profile

Procedure

1. Create a new zone:

   # firewall-cmd --permanent --new-zone=zone-name

2. Check if the new zone is added to your permanent settings:

   # firewall-cmd --get-zones

3. Make the new settings persistent:

   # firewall-cmd --runtime-to-permanent

1. List the information for the specific zone to see the default target:

   # firewall-cmd --zone=zone-name --list-all

2. Set a new target in the zone:

   # firewall-cmd --permanent --zone=zone-name --set-target=<default|ACCEPT|REJECT|DROP>

Procedure

1. List all available zones:

   # firewall-cmd --get-zones

2. Add the source IP to the trusted zone in the permanent mode:

   # firewall-cmd --zone=trusted --add-source=192.168.2.15

3. Make the new settings persistent:

   # firewall-cmd --runtime-to-permanent

Procedure

1. List allowed sources for the required zone:

   # firewall-cmd --zone=zone-name --list-sources

2. Remove the source from the zone permanently:

   # firewall-cmd --zone=zone-name --remove-source=<source>

3. Make the new settings persistent:

   # firewall-cmd --runtime-to-permanent

Procedure

1. List all available zones:

   # firewall-cmd --get-zones
   block dmz drop external home internal public trusted work

2. Add the IP range to the internal zone to route the traffic originating from the source through the zone:

   # firewall-cmd --zone=internal --add-source=192.0.2.0/24

3. Add the http service to the internal zone:

   # firewall-cmd --zone=internal --add-service=http

4. Make the new settings persistent:

   # firewall-cmd --runtime-to-permanent

Procedure

1. Create a new policy.

   # firewall-cmd --permanent --new-policy podmanToHost

2. Block all traffic.

   # firewall-cmd --permanent --policy podmanToHost --set-target REJECT
   
   # firewall-cmd --permanent --policy podmanToHost --add-service dhcp
   
   # firewall-cmd --permanent --policy podmanToHost --add-service dns

   Note

   Red Hat recommends that you block all traffic to the host by default and then selectively open the services you need for the host.

3. Define the ingress zone to use with the policy.

   # firewall-cmd --permanent --policy podmanToHost --add-ingress-zone podman

4. Define the egress zone to use with the policy.

   # firewall-cmd --permanent --policy podmanToHost --add-egress-zone ANY

Procedure

1. To check if IP masquerading is enabled (for example, for the external zone), enter the following command as root:

   # firewall-cmd --zone=external --query-masquerade

   The command prints yes with exit status 0 if enabled. It prints no with exit status 1 otherwise. If zone is omitted, the default zone will be used.

2. To enable IP masquerading, enter the following command as root:

   # firewall-cmd --zone=external --add-masquerade

3. To make this setting persistent, pass the --permanent option to the command.

4. To disable IP masquerading, enter the following command as root:

   # firewall-cmd --zone=external --remove-masquerade

   To make this setting permanent, pass the --permanent option to the command.

Procedure

1. To redirect a port to another port:

   # firewall-cmd --add-forward-port=port=port-number:proto=tcp|udp|sctp|dccp:toport=port-number

2. To redirect a port to another port at a different IP address:

   1. Add the port to be forwarded:

      # firewall-cmd --add-forward-port=port=port-number:proto=tcp|udp:toport=port-number:toaddr=IP

   2. Enable masquerade:

      # firewall-cmd --add-masquerade

Procedure

1. Redirect the port 80 to port 88 for TCP traffic:

   # firewall-cmd --add-forward-port=port=80:proto=tcp:toport=88

2. Make the new settings persistent:

   # firewall-cmd --runtime-to-permanent

3. Check that the port is redirected:

   # firewall-cmd --list-all

Procedure

1. To remove a redirected port:

   # firewall-cmd --remove-forward-port=port=port-number:proto=<tcp|udp>:toport=port-number:toaddr=<IP>

2. To remove a forwarded port redirected to a different address:

   1. Remove the forwarded port:

      # firewall-cmd --remove-forward-port=port=port-number:proto=<tcp|udp>:toport=port-number:toaddr=<IP>

   2. Disable masquerade:

      # firewall-cmd --remove-masquerade

Procedure

1. List redirected ports:

   ~]# firewall-cmd --list-forward-ports
   port=80:proto=tcp:toport=88:toaddr=

2. Remove the redirected port from the firewall::

   ~]# firewall-cmd  --remove-forward-port=port=80:proto=tcp:toport=88:toaddr=

3. Make the new settings persistent:

   ~]# firewall-cmd --runtime-to-permanent

1. Set the target of your zone to DROP:

   # firewall-cmd --permanent --set-target=DROP

2. Add the ICMP block inversion to block all ICMP requests at once:

   # firewall-cmd --add-icmp-block-inversion

3. Add the ICMP block for those ICMP requests that you want to allow:

   # firewall-cmd --add-icmp-block=<icmptype>

4. Make the new settings persistent:

   # firewall-cmd --runtime-to-permanent

1. Set the target of your zone to default or ACCEPT:

   # firewall-cmd --permanent --set-target=default

2. Remove all added blocks for ICMP requests:

   # firewall-cmd --remove-icmp-block=<icmptype>

3. Remove the ICMP block inversion:

   # firewall-cmd --remove-icmp-block-inversion

4. Make the new settings persistent:

   # firewall-cmd --runtime-to-permanent

Procedure

1. Add a rich rule with a very low precedence to log all traffic that has not been matched by other rules:

   # firewall-cmd --add-rich-rule='rule priority=32767 log prefix="UNEXPECTED: " limit value="5/m"'

   The command additionally limits the number of log entries to 5 per minute.

2. Optionally, display the nftables rule that the command in the previous step created:

   # nft list chain inet firewalld filter_IN_public_post
   table inet firewalld {
     chain filter_IN_public_post {
       log prefix "UNEXPECTED: " limit rate 5/minute
     }
   }

Procedure

1. Enable packet forwarding in the kernel:

   # echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf
   
   # sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf

2. Ensure that interfaces between which you want to enable intra-zone forwarding are not assigned to a zone different than the internal zone:

   # firewall-cmd --get-active-zones

3. If the interface is currently assigned to a zone other than internal, reassign it:

   # firewall-cmd --zone=internal --change-interface=interface_name --permanent

4. Add the enp1s0 and wlp0s20 interfaces to the internal zone:

   # firewall-cmd --zone=internal --add-interface=enp1s0 --add-interface=wlp0s20

5. Enable intra-zone forwarding:

   # firewall-cmd --zone=internal --add-forward

1. Log in to a host that is in the same network as the enp1s0 interface of the host you enabled zone forwarding on.

2. Start an echo service with ncat to test connectivity:

   # ncat -e /usr/bin/cat -l 12345

3. Log in to a host that is in the same network as the wlp0s20 interface.

4. Connect to the echo server running on the host that is in the same network as the enp1s0:

   # ncat <other host> 12345

5. Type something and press Enter, and verify the text is sent back.

Procedure

1. Create the ~/port_forwarding.yml file and add the following content:

   ---
   - name: Forward incoming traffic on port 8080 to 443
     hosts: testingservers
   
     tasks:
       - include_role:
           name: rhel-system-roles.firewall
   
     vars:
       firewall:
         - { forward_port: 8080/tcp;443;, state: enabled, runtime: true, permanent: true }

   This file represents a playbook and usually contains an ordered list of tasks, also called plays, that are run against specific managed hosts selected from your inventory file. In this case, the playbook will run against the testingservers group of managed hosts.

   The hosts key in the play specifies the hosts against which the play is run. You can provide the value or values for this key as individual names of managed hosts or as groups of hosts as defined in the inventory file.

   The tasks section has the include_role key, which specifies what system role is going to configure the parameters and values mentioned in the vars section.

   The vars section contains a role variable called firewall. This variable is a list of dictionary values and specifies parameters that will be applied to firewalld on managed hosts. The example role will forward the traffic coming to port 8080 to port 443. The settings will come to effect immediately and will also persist across reboots.

2. Optionally, verify that the syntax in the playbook is correct:

   # ansible-playbook --syntax-check ~/port_forwarding.yml
   
   playbook: port_forwarding.yml

   This example shows the successful verification of a playbook.

3. Execute the playbook:

   # ansible-playbook ~/port_forwarding.yml

Procedure

1. If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the /etc/ansible/hosts Ansible inventory file:

   node.example.com

2. Create the ~/adding-and-removing-ports.yml playbook with the following content:

   ---
   - name: Allow incoming HTTPS traffic to the local host
     hosts: node.example.com
     become: true
   
     tasks:
       - include_role:
           name: linux-system-roles.firewall
   
         vars:
           firewall:
             - port: 443/tcp
               service: http
               state: enabled
               runtime: true
               permanent: true

   The permanent: true option makes the new settings persistent across reboots.

3. Run the playbook:

   • To connect as root user to the managed host, enter:

     # ansible-playbook -u root ~/adding-and-removing-ports.yml

   • To connect as a user to the managed host, enter:

     # ansible-playbook -u user_name --ask-become-pass ~/adding-and-removing-ports.yml

     The --ask-become-pass option makes sure that the ansible-playbook command prompts for the sudo password of the user defined in the -u user_name option.

   If you do not specify the -u user_name option, ansible-playbook connects to the managed host as the user that is currently logged in to the control node.

Verification

1. Connect to the managed node:

   $ ssh user_name@node.example.com

2. Verify that the 443/tcp port associated with the HTTPS service is open:

   $ sudo firewall-cmd --list-ports
   443/tcp

Procedure

1. Create the ~/configuring-a-dmz-using-the-firewall-system-role.yml playbook with the following content:

   ---
   - name: Creating a DMZ with access to HTTPS port and masquerading for hosts in DMZ
     hosts: node.example.com
     become: true
   
     tasks:
       - include_role:
           name: linux-system-roles.firewall
   
         vars:
           firewall:
             - zone: dmz
               interface: enp1s0
               service: https
               state: enabled
               runtime: true
               permanent: true

2. Run the playbook:

   • To connect as root user to the managed host, enter:

     $ ansible-playbook -u root ~/configuring-a-dmz-using-the-firewall-system-role.yml

   • To connect as a user to the managed host, enter:

     $ ansible-playbook -u user_name --ask-become-pass ~/configuring-a-dmz-using-the-firewall-system-role.yml

     The --ask-become-pass option makes sure that the ansible-playbook command prompts for the sudo password of the user defined in the -u user_name option.

   If you do not specify the -u user_name option, ansible-playbook connects to the managed host as the user that is currently logged in to the control node.

Procedure

1. Edit the /etc/sysconfig/nftables.conf file.

   • If you enhance *.nft scripts created in /etc/nftables/ when you installed the nftables package, uncomment the include statement for these scripts.

   • If you write scripts from scratch, add include statements to include these scripts. For example, to load the /etc/nftables/example.nft script when the nftables service starts, add:

     include "/etc/nftables/example.nft"

2. Optionally, start the nftables service to load the firewall rules without rebooting the system:

   # systemctl start nftables

3. Enable the nftables service.

   # systemctl enable nftables

Procedure

1. Use the nft add table command to create a new table. For example, to create a table named example_table that processes IPv4 and IPv6 packets:

   # nft add table inet example_table

2. Optionally, list all tables in the rule set:

   # nft list tables
   table inet example_table

Procedure

1. Use the nft add chain command to create a new chain. For example, to create a chain named example_chain in example_table:

   # nft add chain inet example_table example_chain { type filter hook input priority 0 \; policy accept \; }

   Important

   To avoid that the shell interprets the semicolons as the end of the command, prepend the semicolons the \ escape character.

   This chain filters incoming packets. The priority parameter specifies the order in which nftables processes chains with the same hook value. A lower priority value has precedence over higher ones. The policy parameter sets the default action for rules in this chain. Note that if you are logged in to the server remotely and you set the default policy to drop, you are disconnected immediately if no other rule allows the remote access.

2. Optionally, display all chains:

   # nft list chains
   table inet example_table {
     chain example_chain {
       type filter hook input priority filter; policy accept;
     }
   }

Procedure

1. To add a new rule, use the nft add rule command. For example, to add a rule to the example_chain in the example_table that allows TCP traffic on port 22:

   # nft add rule inet example_table example_chain tcp dport 22 accept

   Instead of the port number, you can alternatively specify the name of the service. In the example, you could use ssh instead of the port number 22. Note that a service name is resolved to a port number based on its entry in the /etc/services file.

2. Optionally, display all chains and their rules in example_table:

   # nft list table inet example_table
   table inet example_table {
     chain example_chain {
       type filter hook input priority filter; policy accept;
       ...
       tcp dport ssh accept
     }
   }

Procedure

1. To insert a new rule, use the nft insert rule command. For example, to insert a rule to the example_chain in the example_table that allows TCP traffic on port 22:

   # nft insert rule inet example_table example_chain tcp dport 22 accept

   You can alternatively specify the name of the service instead of the port number. In the example, you could use ssh instead of the port number 22. Note that a service name is resolved to a port number based on its entry in the /etc/services file.

2. Optionally, display all chains and their rules in example_table:

   # nft list table inet example_table
   table inet example_table {
     chain example_chain {
       type filter hook input priority filter; policy accept;
       tcp dport ssh accept
       ...
     }
   }

Procedure

1. Use the nft -a list ruleset command to display all chains and their rules in the example_table including their handle:

   # nft -a list table inet example_table
   table inet example_table { # handle 1
     chain example_chain { # handle 1
       type filter hook input priority filter; policy accept;
       tcp dport 22 accept # handle 2
       tcp dport 443 accept # handle 3
       tcp dport 389 accept # handle 4
     }
   }

   Using the -a displays the handles. You require this information to position the new rules in the next steps.

2. Insert the new rules to the example_chain chain in the example_table:

   • To insert a rule that allows TCP traffic on port 636 before handle 3, enter:

     # nft insert rule inet example_table example_chain position 3 tcp dport 636 accept

   • To add a rule that allows TCP traffic on port 80 after handle 3, enter:

     # nft add rule inet example_table example_chain position 3 tcp dport 80 accept

3. Optionally, display all chains and their rules in example_table:

   # nft -a list table inet example_table
   table inet example_table { # handle 1
     chain example_chain { # handle 1
       type filter hook input priority filter; policy accept;
       tcp dport 22 accept # handle 2
       tcp dport 636 accept # handle 5
       tcp dport 443 accept # handle 3
       tcp dport 80 accept # handle 6
       tcp dport 389 accept # handle 4
     }
   }

Procedure

1. Create a table:

   # nft add table nat

2. Add the prerouting and postrouting chains to the table:

   # nft -- add chain nat prerouting { type nat hook prerouting priority -100 \; }
   # nft add chain nat postrouting { type nat hook postrouting priority 100 \; }

   Important

   Even if you do not add a rule to the prerouting chain, the nftables framework requires this chain to match incoming packet replies.

   Note that you must pass the -- option to the nft command to avoid that the shell interprets the negative priority value as an option of the nft command.

3. Add a rule to the postrouting chain that matches outgoing packets on the ens3 interface:

   # nft add rule nat postrouting oifname "ens3" masquerade

Procedure

1. Create a table:

   # nft add table nat

2. Add the prerouting and postrouting chains to the table:

   # nft -- add chain nat prerouting { type nat hook prerouting priority -100 \; }
   # nft add chain nat postrouting { type nat hook postrouting priority 100 \; }

   Important

   Even if you do not add a rule to the postrouting chain, the nftables framework requires this chain to match outgoing packet replies.

   Note that you must pass the -- option to the nft command to avoid that the shell interprets the negative priority value as an option of the nft command.

3. Add a rule to the postrouting chain that replaces the source IP of outgoing packets through ens3 with 192.0.2.1:

   # nft add rule nat postrouting oifname "ens3" snat to 192.0.2.1