Published on: September 13, 2019 by Albert Reilly
In real life, we can say a firewall is a barrier that’s put in place to limit the damage a fire can cause.
A firewall is a part of a computer system or network that is designed to block unauthorized access while permitting outward communication and to provide important logging and auditing functions.
Types of firewalls include packet-filtering firewalls, stateful inspection firewalls, proxy firewalls and next-generation firewalls (NGFWs).
When a packet passes through the firewall, its source and destination address, protocol and destination port number are checked. The packet is dropped if it does not comply with the firewall’s ruleset. It examines packets in isolation and does not know the packet’s context.
For example, if a firewall is configured with a rule to block Telnet access, then the firewall will drop packets destined for Transmission Control Protocol (TCP) port number 23, the port where a Telnet server application would be listening.
Dynamic packet-filtering firewalls maintain a table that keeps track of all open connections. When new packets arrive, the firewall compares information in the packet header to the state table and determines whether it is part of an established connection, if it is, then the packet is allowed through without further analysis. If the packet doesn’t match an existing connection, it is evaluated according to the rule set for new connections.
Provide application layer filtering and can examine the payload of a packet and distinguish among valid requests, data and malicious code disguised as a valid request or data.
For example, it can allow or deny a specific incoming Telnet command from a particular user, whereas other firewalls can only control general incoming requests from a particular host.
Uses a multi-layered approach and combine the capabilities of traditional enterprise firewalls including network address translation (NAT), Uniform Resource Locator (URL) blocking and virtual private networks (VPNs) with quality of service (QoS) functionality and features not traditionally found in firewall products. These products support intent-based networking by including Secure Sockets Layer (SSL) and Secure Shell (SSH) inspection, deep packet inspection(DPI) and reputation-based malware detection, as well as application awareness.
A properly configured firewall is one of the most important aspects of overall system security. Firewalld is a complete firewall solution that manages the system’s iptables rules. Starting with CentOS 7, firewalld replaces iptables as the default firewall management tool.
Firewalld uses the concepts of zones and services, instead of iptables chain and rules. You can control what traffic is allowed or disallowed to and from the system based on the zones and services you’ll configure. Firewalld can be configured and managed using the
firewall-cmd command line utility.
Installing and enabling Firewalld
Firewalld is installed by default on CentOS 7, but if it is not installed on your system, you can install the package by typing:
# yum install firewalld
Firewalld service is disabled by default. If you just installed or never activated before, the command will print not running otherwise you will see running. You can check the firewall status with:
# firewall-cmd --state
To start the firewalld service and enable it on boot type:
# systemctl start firewalld # systemctl enable firewalld
Zones are predefined sets of rules specifying what traffic should be allowed based on the level of trust on the networks your computer is connected to. You can assign network interfaces and sources to a zone.
Below are the zones provided by firewalld ordered according to the trust level of the zone from untrusted to trusted:
View Default Zone
After enabling the firewalld service for the first time, the public zone is set as a default zone. To view the default zone, type in:
# firewall-cmd --get-default-zone public
List Available Zones
To list all the available zones, use:
# firewall-cmd --get-zones block dmz drop external home internal public trusted work
Zones used by Network Interfaces
By default, all network interfaces are assigned the default zone. To check what zones are used by your network interfaces, type:
# firewall-cmd --get-active-zones public interfaces: eth0 eth1
Print Zone Configuration Settings
To print the zone configuration settings:
# firewall-cmd --zone=public --list-all public (active) target: default icmp-block-inversion: no interfaces: eth1 eth2 sources: services: ssh dhcpv6-client ports: protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules:
We can see that the public zone is active and set as default, used by both eth1 and eth2 interfaces and connections related to the DHCP client and SSH are allowed.
Configurations of all Available Zones
To check the configurations of all available zones type:
# firewall-cmd --list-all-zones
Change the Interface Zone
You can easily change the Interface Zone by using the using
--zone in combination with the
--change-interface. The following command will assign the eth1 interface to the work zone:
# firewall-cmd --zone=work --change-interface=eth1
Verify the changes by typing:
# firewall-cmd --get-active-zones work interfaces: eth1 public interfaces: eth0
Change Default Zone
To change the default zone use
--set-default-zone followed by the name of the zone you want to make default.
# firewall-cmd --set-default-zone=home
Verify the changes with:
# firewall-cmd --get-default-zone home
Firewalld services are predefined rules that apply within a zone and define the necessary settings to allow incoming traffic for a specific service.
Firewalld uses two separated configuration sets, runtime, and permanent configuration.
The runtime configuration is the actual running configuration and it is not persistent on reboots. When the firewalld service starts it loads the permanent configuration which becomes the runtime configuration.
By default, when making changes to the firewalld configuration using the firewall-cmd utility the changes are applied to the runtime configuration, to make the changes permanent you need to use the –permanent flag.
With firewalld you can allow traffic for specific ports based on the services. To get a list of all default available services type:
# firewall-cmd --get-services
You can find more information about each service by opening the associated .xml file within the
/usr/lib/firewalld/services directory. For example, the HTTP service is defined like this:
# cat /usr/lib/firewalld/services/http.xml <?xml version="1.0" encoding="utf-8"?> <service> <short>WWW (HTTP)</short> <description>HTTP is the protocol used to serve Web pages. If you plan to make your Web server publicly available, enable this option. This option is not required for viewing pages locally or developing Web pages.</description> <port protocol="tcp" port="80"/> </service>
To allow incoming HTTP traffic for interfaces in the public zone, only for the current session, type:
# firewall-cmd --zone=public --add-service=http
If you are modifying the default zone you can leave out the
You can verify the service was added successfully use the
# firewall-cmd --zone=public --list-services ssh dhcpv6-client http
Allow Services Permanently
If you want to keep the port 80 open after a reboot you’ll need to type the same command once again but this time with the
# firewall-cmd --permanent --zone=public --add-service=http
--list-services along with the
--permanent flag to verify your changes:
# firewall-cmd --permanent --zone=public --list-services ssh dhcpv6-client http
For removing a service use
--remove-service instead of the
--add-service flag. To remove the http service from the public zone permanent configuration use:
# firewall-cmd --zone=public --remove-service=http --permanent
Open a Port
If you are running an application for which there is no appropriate service available, you have two options – either open up the appropriate ports or define a new firewalld service.
To open port a port, say 2086 in the public zone for the current session which uses TCP, use the
# firewall-cmd --zone=public --add-port=2086/tcp
Protocols can be either TCP or UDP. To keep the port 2086 open after a reboot, add the rule to the permanent settings by running the same command using the
List Added Ports
To verify that the port was added successfully use the
# firewall-cmd --zone=public --list-ports 2086/tcp
Remove Added Ports
The syntax for removing a port is similar to adding a port. Just use
--remove-port instead of the
# firewall-cmd --zone=public --remove-port=2086/tcp
Creating new Firewalld Service
The default services are stored in the
/usr/lib/firewalld/services directory. The easiest way to create a new service is to copy an existing service file to the
/etc/firewalld/services directory which is the location for user-created services and modify the file settings.
/usr/lib/firewalld holds default configurations like default zones and common services. Avoid updating them because those files will be overwritten by each firewalld package update.
/etc/firewalld holds system configuration files. These files will overwrite a default configuration.
# cp /usr/lib/firewalld/services/ssh.xml /etc/firewalld/services/newservice.xml
Open the newly created
newservice.xml file and change the short name and description for the service within the
<description> tags. The most important tag you need to change is the port tag which defines the port number and protocol you want to open.
In the following example, we are opening ports 2086 UDP and 2085 TCP.
# vi /etc/firewalld/services/newservice.xml <?xml version="1.0" encoding="utf-8"?> <service version="1.0"> <short>newservice</short> <description>This service is to open the ports 2086 and 2085</description> <port protocol="udp" port="2086"/> <port protocol="tcp" port="2085"/> </service>
Save the file and reload the Firewalld service:
# firewall-cmd --reload
You can now use the
newservice service in your zones same as any other service.
For forwarding traffic from one port to another port or address, first, enable masquerading for the desired zone using the
# firewall-cmd --zone=external --add-masquerade
To forward traffic from one port to another on the same server, for example, forward the traffic from port 80 to port 8080 on the same server, use:
# firewall-cmd --zone=external --add-forward-port=port=80:proto=tcp:toport=8080
To forward traffic to another server, for example, forward the traffic from port 80 to port 80 on a server with IP 10.10.10.2, use:
# firewall-cmd --zone=external --add-forward-port=port=80:proto=tcp:toaddr=10.10.10.2
To forward traffic to another server on a different port, for example forwarding the traffic from port 80 to port 8080 on a server with IP 10.10.10.2:
# firewall-cmd --zone=external --add-forward-port=port=80:proto=tcp:toport=8080:toaddr=10.10.10.2
If you want to make the forward permanent just append the
In this article, we have gone through how to configure and manage the Firewalld service on a CentOS system and some basic concepts of firewalld.
Category : Firewalls, Linux