RHEL7 Firewall

Firewall

                          

To verify that firewall is installed by checking the version or displaying the help output.

 

[root@server ~]# firewall-cmd --version 0.4.4.4

 

To Verify the firewall status

 

● firewalld.service - firewalld - dynamic firewall daemon    Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)    Active: active (running) since Wed 2017-10-25 18:06:04 IST; 2min 58s ago      Docs: man: firewalld(1)  Main PID: 724 (firewalld)    CGroup: /system.slice/firewalld.service            └─724 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid   Oct 25 18:06:00 server systemd[1]: Starting firewalld - dynamic firewall daemon... Oct 25 18:06:04 server systemd[1]: Started firewalld - dynamic firewall daemon. Oct 25 18:06:06 server firewalld[724]: WARNING: ICMP type 'beyond-scope' is not supported by the kernel for ipv6. Oct 25 18:06:06 server firewalld[724]: WARNING: beyond-scope: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.

 

 

To check if firewall-cmd can connect to the daemon by entering the following command:

 

[root@server ~]# firewall-cmd --state running

 

Note: If Firewalld is not running, the command displays not running.

 

To Start Firewall service

 

[root@server ~]# systemctl start firewalld

 

 

To Enable firewall to start at boot

 

[root@server /]# systemctl enable firewalld

 

To make sure firewalld is not started by accessing the firewalld D-Bus interface and also if other services require firewalld, enter the following command as root:

 

 

[root@server ~]# systemctl mask firewalld Created symlink from /etc/systemd/system/firewalld.service to /dev/null.

 

 

To unmask the firewall service so firewall could be started

 

[root@server ~]# systemctl unmask firewalld Removed symlink /etc/systemd/system/firewalld.service. [root@server ~]#

 

To Enable a ftp service to firewall  to default port:

 

[root@server ~]# firewall-cmd --permanent --add-service=ftp success [root@server ~]#

 

To  add Multiple services (here http, https, and dns) at the same time to firewall to respective default ports.

 

[root@server ~]# firewall-cmd --permanent --add-service={http,https,dns} success

 

 

To Add ssh service permanently to firewall

 

 

[root@server /]# firewall-cmd --permanent --add-service=ssh success [root@server /]#

 

 

To Reload the firewall after making changes

 

[root@server /]# firewall-cmd --reload success

 

 

To list all service allowed by firewall

 

[root@server /]# firewall-cmd --list-services ssh dhcpv6-client nfs mountd rpc-bind dhcp ftp http https kerberos ntp samba smtp dns

 

To list all port added or allowed in firewall

 

[root@server /]# firewall-cmd --list-ports 111/tcp 2049/tcp 111/udp 2049/udp 2201/udp 443/tcp 80/tcp 9090/tcp 2201/tcp 8080/tcp 3306/tcp 514/udp 514/tcp 69/udp 892/tcp 3260/tcp 4011/udp 21/tcp 22/tcp 67/tcp 68/tcp 88/tcp 749/tcp 25/tcp [root@server /]#

 

 

To view the list of services currently loaded, enter the following command as root:

 

[root@server ~]# firewall-cmd --get-services RH-Satellite-6 amanda-client amanda-k5-client condor-collector ctdb dhcp dhcpv6 dhcpv6-client dns docker-registry dropbox-lansync elasticsearch freeipa-ldap freeipa-ldaps freeipa-replication freeipa-trust

 

 

To start dropping all incoming and outgoing packets, enter the following command as root:

 

[root@server ~]# firewall-cmd --panic-on

 

To start passing incoming and outgoing packets again, enter the following command as root:

 

[root@server ~]# firewall-cmd --panic-off

 

To find out if panic mode is enabled or disabled, enter the following command:

 

[root@server ~]# firewall-cmd --query-panic no

 

To Remove Service ssh from firewall

 

[root@server /]# firewall-cmd --permanent --remove-service=ssh success [root@server /]#

 

 

Understanding the Rich Rule Structure

          

 

The format or structure of the rich rule commands is as follows:

rule [family="rule family"]

    [ source [NOT] [address="address"] [mac="mac-address"] [ipset="ipset"] ]

    [ destination [NOT] address="address" ]

    [ element ]

    [ log [prefix="prefix text"] [level="log level"] [limit value="rate/duration"] ]

    [ audit ]

    [ action ]

 

To Configure Rich Rules to allow only allow host 192.168.56.102  to access ssh service

 

[root@server /]# firewall-cmd --permanent --add-rich-rule 'rule family="ipv4" source address="192.168.56.102" service name=ssh accept'success [root@server /]# firewall-cmd --reload success [root@server /]# firewall-cmd --list-rich-rules rule family="ipv4" source address="192.168.56.102" service name="ssh" accept [root@server /]#

 

To Configure Rich Rules to allow only allow network 192.168.56.0  to access ssh service

 

 

 

 

 

 

[root@server /]# firewall-cmd --permanent --add-rich-rule 'rule family="ipv4" source address=192.168.56.0/24 service name=ssh accept' success           or [root@server /]# firewall-cmd --list-rich-rules rule family="ipv4" source address="192.168.56.0/255.255.255.0" service name="ssh" accept [root@server /]# firewall-cmd --reload success [root@server /]# firewall-cmd --list-rich-rules rule family="ipv4" source address="192.168.56.0/24" service name="ssh" accept

 

To Remove Firewall-rich-rules

 

 

[root@server /]# firewall-cmd --permanent --remove-rich-rule 'rule family="ipv4" source address=192.168.56.0/24 service name=ssh accept'success

 

 

To Configure Rich Rules to Reject or deny only  host 192.168.56.102  to access ssh service

 

[root@server /]# firewall-cmd --permanent --add-rich-rule 'rule family="ipv4" source address=192.168.56.102 service name=ssh reject' success [root@server /]# firewall-cmd --reload success rule family="ipv4" source address="192.168.56.102" service name="ssh" reject

 

To Configure Rich Rules to allow Network 192.168.56.0/24 and deny 172.172.172.0/24 to access ftp service

 

 

[root@server /]#firewall-cmd --permanent --add-rich-rules='rule family=ipv4 source address=192.168.56.0/24 service name=ftp accept'   [root@server /]# firewall-cmd --permanent --add-masquerade success                      [root@server /]# firewall-cmd --reload success [root@server /]#

 

 

 

 

 

To get some information about the ftp service,

 

[root@server /]# firewall-cmd --info-service=ftp ftp   ports: 21/tcp   protocols:   source-ports:   modules: ftp   destination: [

 

To add a source based on a MAC address (here 00:11:22:33:44:55) to a zone (here trusted) permanently:

 

[root@server ~]# firewall-cmd --permanent --zone=public --add-source=00:11:22:33:64:55 success

 

 

Managing Zones

                    

To get the default zone:

 

[root@server /]# firewall-cmd --get-default-zone public [root@server /]#

 

To get active zones:

 

[root@server /]# firewall-cmd --get-active-zones public   interfaces: enp0s3

 

To get available zones:

 

[root@server /]# firewall-cmd --get-zones block dmz drop external home internal public trusted work

 

 

 

 

 

 

To assign ep0s3 temporarily to the internal zone:

 

[root@server /]# firewall-cmd --zone=internal --change-interface=enp0s3 The interface is under control of NetworkManager, setting zone to 'internal'. success

 

To assign ep0s3 permanently to the internal zone:

 

[root@server /]# firewall-cmd --permanent --zone=internal --change-interface=enp0s3 The interface is under control of NetworkManager and already bound to 'internal' The interface is under control of NetworkManager, setting zone to 'internal'. success

 

To add a range of ports to a zone (for example, to allow the ports from 5060 to 5061 to the public zone, enter the following command as root:

 

[root@server /]#  firewall-cmd --zone=public --add-port=5060-5061/udp

 

Firewall Services Configuration

 

With the Firewalld package, the firewall configuration of the main services (ftp, httpd, etc) comes in the /usr/lib/firewalld/services directory.

 

To add new ones say HAProxy service in the /etc/firewalld/services directory.

 

For example, it is the case of the HAProxy service. There is no firewall configuration associated.

Create the /etc/firewalld/services/haproxy.xml and paste the following lines:

 

<?xml version="1.0" encoding="utf-8"?>

<service>

 <short>HAProxy</short>

 <description>HAProxy load-balancer</description>

 <port protocol="tcp" port="80"/>

</service>

 

 

 

 

[root@server ~]# vi /etc/firewalld/services/haproxy.xml [root@server ~]# cat /etc/firewalld/services/haproxy.xml <?xml version="1.0" encoding="utf-8"?> <service> <short>HAProxy</short> <description>HAProxy load-balancer</description> <port protocol="tcp" port="80"/> </service>

  

 

Note: You can use the firewall-cmd –permanent –new-service=haproxy command to quickly create a configuration file skeleton.

 

Assign the correct SELinux context and file permissions to the haproxy.xml file:

 

[root@server ~]# cd /etc/firewalld/services [root@server services]# restorecon haproxy.xml [root@server services]# chmod 640 haproxy.xml [root@server services]#

 

Add the HAProxy service to the default zone permanently and reload the firewall configuration:

 

[root@server services]# firewall-cmd --permanent --add-service=haproxysuccess

 

 

 

 

Network Address Translation

               

Configure Nat

 

Configure two zone, internal & external and configure masquerading on the external zone

All packets will get your firewall IP address as source address.

 

To check if IP masquerading is enabled (for example, for the external zone), enter the following command as root:

 

[root@server services]# firewall-cmd --zone=external --query-masquerade yes

 

 

 

To set up masquerading on the external zone temporarily

firewall-cmd --zone=external --add-masquerade

[root@server /]# firewall-cmd --zone=external --add-masquerade success [root@server /]#

 

To set up masquerading on the external zone permanently

 

[root@server /]# firewall-cmd --permanent --zone=external --add-masquerade success

 

 

To Save the changes:

 

 

[root@server /]# firewall-cmd --reload success

 

To disable IP masquerading, enter the following command as root:

 

 

[root@server /]#  firewall-cmd --zone=external --remove-masquerade

 

                    

Port Forwarding

                                          

 

Port forwarding is a way to forward inbound network traffic for a specific port to another internal address or an alternative port.

 

Caution: Port forwarding requires masquerading (source). This point is a classical mistake made during the RHCE exam.

 

So, you need to enable masquerading before anything else:

 

# firewall-cmd --zone=external --add-masquerade

success

 

 

 

To forward all packets intended for port 22 to be now forwarded to port tcp 3753 temporarily, type:

 

 

[root@server services]# firewall-cmd --zone=external --add-forward-port=port=22:proto=tcp:toport=3753 success

 

 

To remove port forwarding, To forward all packets intended for port 22 to be now forwarded to port tcp 3753

 

root@server services]# --remove-forward-port=port=22:proto=tcp:toport=3753 success

 

Note2: To know if port forwarding is active in a zone, use the –query-forward-port option.

Note3: If you want to make the configuration permanent, add the –permanent option and reload the firewall configuration.

 

To forward packets to another port at another IPv4 address, usually an internal address, enter the following command as root:

 

 

[root@server services]# firewall-cmd --zone=external --add-forward-port=port=22:proto=tcp:toport=2055:toaddr=192.168.56.5 success

 

To forward packets to another IPv4 address, usually an internal address, without changing the destination port, enter the following command as root:

 

[root@server services]# firewall-cmd --zone=external --add-forward-port=port=22:proto=tcp:toaddr=192.168.56.5 success

 

                    

Direct Rules

                    

 

 

 

 

To set specific rules by using the direct mode (here to open the tcp port 9000) that by-passes the Firewalld interface:

 

[root@server services]# firewall-cmd --direct --add-rule ipv4 filter  INPUT 0 -p tcp --dport 9000 -j ACCEPT success

 

Note: It is not necessary to reload the firewall configuration, all commands are directly activated.

 

To remove a rule from the “IN_public_allow” chain, enter the following command as root:

 

 

[root@server services]# firewall-cmd --direct --remove-rule ipv4 filter  INPUT 0 -p tcp --dport 9000 -j ACCEPT success

 

To display all the direct rules added, type:

 

 

[root@server services]# firewall-cmd --direct --get-all-rules ipv4 filter INPUT 0 -p tcp --dport 9000 -j ACCEPT

 

Note1: For information, the configuration is written into the /etc/firewalld/direct.xml file.

 

    

Configuring IP Set options with the Command-Line Client

    

 

With the RHEL 7.3 release, you can create an ipset (a set of IP addresses or networks, see below) and add a source based on it:

 

To add a new IP set, use the following command using the permanent environment as root:

 

[root@server services]# firewall-cmd --permanent --new-ipset=iplist --type=hash:ip success [root@server services]# firewall-cmd --reload success

 

 

 

To list the IP sets known to firewalld in the permanent environment, use the following command as root:

 

[root@server services]# firewall-cmd --permanent --get-ipsets iplist

 

To add an entry to the iplist IP set, use the following command as root:

 

[root@server services]# firewall-cmd --ipset=iplist --add-entry=192.168.56.11 success [root@server services]# firewall-cmd --ipset=iplist --add-entry=192.168.56.12 success [root@server services]# firewall-cmd --reload success

 

 To add a rule per IP address that needs to be black listed in the example. There is only one rule added to the firewall to use the ipset for black listing. The matching against the set entries is a lot faster.

 

To get the list of current entries in the IP set, use the following command as root:

 

[root@server services]#  firewall-cmd --permanent --ipset=iplist --get-entries 192.168.0.1

 

To remove the iplist ipset, type:

 

[root@server services]# firewall-cmd --permanent --delete-ipset=iplist success

 

 

 

To Generate a file containing a list of IP addresses, for example:

 

[root@server etc]#  cat > iplist.txt <<EOL 192.168.56.13 192.168.56.14 192.168.2.254 EOL

 

The file with the list of IP addresses for an IP set should contain an entry per line. Lines starting with a hash, a semi-colon, or empty lines are ignored.

 

To add the addresses from the iplist.txt file, use the following command as root:

 

[root@server etc]# firewall-cmd --permanent --new-ipset=iplist --type=hash:ip success [root@server etc]# firewall-cmd --permanent --ipset=iplist --add-entries-from-file=iplist.txt success [root@server etc]#

 

To see the extended entries list of the IP set, use the following command as root:

 

[root@server etc]# firewall-cmd --permanent --ipset=iplist --get-entries 192.168.56.13 192.168.56.14 192.168.2.254

 

To remove the addresses from the IP set and to check the updated entries list, use the following commands as root:

 

 

[root@server etc]# firewall-cmd --permanent --ipset=iplist --remove-entries-from-file=iplist.txt success

 

To download the content of an ipset from a file (--add-entries-from-file=file option) or store it with the name ipset in the /etc/firewalld/ipsets/ipset.xml

or /usr/lib/firewalld/ipsets/ipset.xml files according to the following format:

 

[root@server ipsets]# cat  /etc/firewalld/ipsets/iplist.xml <?xml version="1.0" encoding="utf-8"?> <ipset type="hash:ip">   <short>My Ipset</short>   <description>description</description>   <entry>192.168.56.11</entry>   <entry>192.168.56.12</entry> </ipset>

 

 

 

Blacklist creation using an ipset for IPv4

          

To create the ipset blacklist for IPv4:

 

To create a permanent IPv4 ipset containing two IP addresses and drop packets coming from these addresses, type:

 

 

root@server ipsets]#  firewall-cmd --permanent --new-ipset=blacklist --type=hash:ip success root@server ipsets]#  firewall-cmd --reload success root@server ipsets]#  firewall-cmd --ipset=blacklist --add-entry=192.168.56.11 success root@server ipsets]#  firewall-cmd --ipset=blacklist --add-entry=192.168.56.12 success root@server ipsets]#  firewall-cmd --add-rich-rule='rule source ipset=blacklist drop' success

 

 

 

 

 

 

To get the content of the blacklist ipset, type:

 

[root@server ipsets]#   firewall-cmd --info-ipset=blacklist blacklist type: hash:ip options: entries: 192.168.56.11 192.168.56.12

 

To remove the 192.168.56.12 entry from the blacklist ipset, type:

 

 

[root@server ipsets]#    firewall-cmd --ipset=blacklist --remove-entry=192.168.56.12 success [root@server ipsets]#   firewall-cmd --ipset=blacklist --get-entries 192.168.56.11