FirewallD: firewall daemon

FirewallD architecture

:::info By default:

• All incoming TCP and UDP connections → blocked (except the allowed ones)
• ssh (Port 22)
• dhcpv6 client (udp 546)
• ipv6 enabled by default
• Certian ICMP request are blocked :::

firewall-cmd --state

firewall-cmd --list-all

Installing firewalld on ubuntu

1. disable ufw on uduntu: sudo ufw disable
2. Install firewalld: sudo apt install firewalld
3. start and enable: `sudo systemctl enable --now firewalld

Services in FirewallD

List all services

firewall-cmd --get-services

Get info of a service

firewall-cmd --info-service http

Services in firewalld

/usr/lib/firewalld/services and /etc/firewalld/services

Firewalld config files

/etc/firewalld

Open and Close services

firewall-cmd --add-service=[service-name]

firewall-cmd --add-port=[port]/[Protocol]

Accessing web service running on hostname.local

1. Enable http or https: sudo firewall-cmd --add-service=http
2. enable mdns on server: sudo firewall-cmd --add-service=mdns
3. enable mdns on client: sudo firewall-cmd --add-service=mdns

Make changes persistence in firewalld

Use flag --permanent

Add or remove service permanently

sudo firewall-cmd --permanent --add-service=[service-name]

sudo firewall-cmd --permanent --remove-service=[service-name]

Add or remove port permanently

sudo firewall-cmd --permanent --add-port=[port]/[protocol]

sudo firewall-cmd --permanent --remove-port=[port]/[protocol]

Zones in firewalld

1 interface in 1 zone

Built in zones

1. trusted
2. home
3. work
4. public
5. drop

List all available zones

sudo firewall-cmd --get-zones

List all rules of a zone

sudo firewall-cmd --zone=work --list-all

Check config files of zones

cd /usr/lib/firewalld/zones

Get default zone

sudo firewall-cmd --get-default-zone

Change default zone

sudo firewall-cmd --set-default-zone=work

Making changes to any firewall zone

:::info Using --zone=[zone-name]

If --zone is not used it will consider default zone :::

sudo firewall-cmd --zone=work --add-service=mdns

Reload firewall config

sudo firewall-cmd --reload

Checking zone interface

sudo firewall-cmd --list-all

and check the interface line

Change interface of the zone

sudo firewall-cmd --zone=public --interface=enp0s5