# Network Firewall Software Firewall (Runs on operating system) Hardware Firewall (Dedicated network appliance) Modern Linux uses firewalld as front-end & nftables under the hood
- organises rules by "zones" (like public, home, work) - exposes "services" (ssh, http, samba, nfs, etc.)
- temporary changes are active immediately but vanish on reload - permanent changes are written to disk and take effect after reload
- unspecified zone will be applied to the default (public) zone - services not on --list-all can be enabled by opening specific ports
Examples
- allow SSH from jump hosts - open http/https on a web server - open NFS only to specific subnets
Exam
- start/enable firewall, list zones, see active zone - add/remove a service, open/close a port, make changes permanent - reload, create, or use a custom XML service file - basic rich rules for blocking a specific source IP - temporary vs permanent
Basic Commands
dnf install firewalld install firewalld
systemctl enable --now firewalld enable now
systemctl status firewalld details & uptime
firewall-cmd --state status
firewall-cmd --get-active-zones
firewall-cmd --get-zones list predefined zone profiles - public - locked down default - home/work - more relaxed (known networks) - trusted - allow all - dmz/external - edge scenarios
firewall-cmd --list-all shows all zones, rules, services, etc. (only a few enabled by default)
firewall-cmd --get-services list of all services that can be allowed
firewall-cmd --reload write permanent and custom rules to memory
Adding and Removing Temporary and Permanent Rules
firewall-cmd --add-service=http add http (temporary)
firewall-cmd --permenent --add-service=http add http (permanent)
firewall-cmd --remove-service=http remove http (temporary)
firewall-cmd --permanent --remove-service=http remove http (permanent)
firewall-cmd --add-port=1110/tcp add TCP 1110 (temporary)
firewall-cmd --permanent --add-port=1110/tcp add TCP 1110 (permanent)
firewall-cmd --remove-port=1110/tcp remove TCP 1110 (temporary)
firewall-cmd --permanent --remove-port=1110/tcp remove TCP 1110 (permanent)
firewall-cmd --add-rich-rule='rule family="ipv4" source address="192.168.0.25" reject' block incoming packets from specific IP
firewall-cmd --remove-rich-rule='rule family="ipv4" source address="192.168.0.25" reject' remove
firewall-cmd --add-icmp-block=echo-request block icmp (ping) requests
firewall-cmd --remove-icmp-block=echo-request remove
firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -d 203.0.113.10 -j DROP block outgoing packets to IP (priority)
firewall-cmd --direct --remove-rule ipv4 filter OUTPUT 0 -d 203.0.113.10 -j DROP remove
nano /etc/firewalld/services/sap.xml xml version="1.0" encoding="utf-8" <service version=1.0"> <short>SAP</short> <description>Third-party application service</description> <port protocol="tcp" port="3200"/> </service> add a custom service definition for SAP xml header for firewalld
firewall-cmd --get-services | grep -i sap verify
firewall-cmd --add-service=sap add the custom rule (temporary)
firewall-cmd --permanent --add-service=sap add the custom rule (permanent)
dnf install -y httpd install apache web service
systemctl enable --now httpd
curl -I [http://localhost](http://localhost) verify (403 Forbidden)
curl -I [http://192.168.50.164/](http://192.168.50.164/) verify (403 Forbidden)