Configuring Linux Firewalls using Firewalld under Systemd

Tags syntax zones

< !!! INTERNAL USE ONLY !!! >
Not for distribution directly to end user

Overview

This article is intended to refresh the user's memory on exact syntax and locations, for those who have worked with it before or just want a limited understanding.

Audience

ITS Staff

Process

Quick Facts

This document assumes the uses of "zones".  Zones are sets of IP addresses to which particular firewall rules apply. Configuration of the firewall combines zones and rules.The default zone is applied if no other rule matches and this is recommended to be "drop".

Remember that a zone represents an area of the network. In order to become active, it has to be assigned source ip addresses or interface.

Problems have been encounter with syntax errors causing the state of the firewall to be unpredictable. Consider restarting the firewall, nftables, and even the system itself.

Firewall Operation

Operation Command
Start systemctl start firewalld
Stop systemctl stop firewalld
Reload configuration

firewall-cmd --reload
List all zones with status firewall-cmd --list-all-zones
Status check systemctl status firewalld
Set default zone (drop is example) firewall-cmd --set-default drop

File Locations

File locations pertain to Oracle Linux 8.  Other distributions have an identical structure that can be searched for.

Location Purpose
/etc/firewalld Overall firewalld configuration location
/etc/firewalld/zones

Rules for each zone.
/etc/firewalld/ipsets Used to define zones.

Configuration

  1. Create a file in ipsets using the example IPSET file from below. 
  2. Create a file in the zones using the example ZONE file from below.
  3. Reload the firewall configuration.
  4. List the zones to make sure its working.

Example Files

IPSET

<?xml version="1.0" encoding="utf-8"?>
<ipset type="hash:net">
  <entry>10.20.12.174</entry>
<entry>10.20.133.106</entry>

<entry>10.21.41.0/24</entry>
</ipset>

ZONE

Simple Zone for Allowing Ports

<?xml version="1.0" encoding="utf-8"?>
<zone>
  <source ipset="cljobshrpp-nodes"/>
  <rule> <port port="60010" protocol="tcp"/> <accept/> </rule>
  <rule> <port port="60011" protocol="tcp"/> <accept/> </rule>
</zone>

Zone for Allowing NFS

<?xml version="1.0" encoding="utf-8"?>
<zone>
    <source ipset="xeadmin-nodes"/>
  <short>xeadmin rules</short>
  <rule>
    <service name="nfs"/>
    <accept/>
  </rule>
  <rule>
    <service name="nfs3"/>
    <accept/>
  </rule>
</zone>
 

Print Article