Firewalld.v7

Installing

New Server

Mrepo

smartd

RAID

Hardening

YUM

Crontabs

LogWatch

systemctl

firewalld

Speed Tests

CentOS 7

Packages

Apache

Bind

Cacti

DHCP

mariadb

Samba

Sarg

Sendmail

Smokeping

Rsync

Work Apps

Problems

VPN

VPN Win

Extras

Bash

MailScanner

Horde

Google CE

Wake Up

KVM

Other

Computer Lab

ISO2USB

aiContact

Google CE

Android

USB Live

SRS XML

YUM

yum install firewalld

systemctl

systemctl status firewalld
systemctl start firewalld
systemctl enable firewalld

View Settings

firewall-cmd --state
firewall-cmd --get-active-zones
firewall-cmd --get-zones
firewall-cmd --get-default-zone
firewall-cmd --zone=external --list-all
firewall-cmd --zone=internal --list-all
firewall-cmd --zone=public --list-all
firewall-cmd --list-services
firewall-cmd --get-services
firewall-cmd --get-icmptypes
firewall-cmd --query-panic

Adding

firewall-cmd --zone=home --remove-service=http
firewall-cmd --zone=internal --add-service=https --permanent
firewall-cmd [--zone=<zone>] --add-port=<port>[-<port>]/<protocol> [--timeout=<seconds>]

Removing

firewall-cmd --zone=home --remove-service=http
firewall-cmd --zone=internal --remove-service=https --permanent

Setting Up

For firewalld to work NetworkManager must be running.

In a non router configuration the single NIC will be assigned to public.

firewall-cmd --zone=public --list-all

Using a Public Zone

Open a port

In this case, I have ssh coming in via a different port than 22.

Here are come common ports to have open.

firewall-cmd --zone=public --add-port=67/upc --permanent
firewall-cmd --zone=public --add-port=68/upc --permanent
firewall-cmd --zone=public --add-port=2222/tcp --permanent
firewall-cmd --zone=public --add-port=873/tcp --permanent
firewall-cmd --zone=public --add-port=3389/tcp --permanent
firewall-cmd --zone=public --add-port=1000/tcp --permanent
firewall-cmd --zone=public --add-port=5901/tcp --permanent
firewall-cmd --zone=public --add-port=873/tcp --permanent
firewall-cmd --zone=public --add-port=8080/tcp --permanent
firewall-cmd --zone=public --add-service=http --permanent
firewall-cmd --zone=public --add-service=https --permanent
firewall-cmd --zone=public --add-service=mysql --permanent
firewall-cmd --zone=public --add-port=10000/tcp --permanent

firewall-cmd --zone=public --list-all

firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" sour

ce address="11.22.33.44" accept' --permanent

firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" reject' --permanent 
systemctl restart firewalls

To add a single IP address

• Remove the service

firewall-cmd --zone=public --remove-service=ssh --permanent

• Restart and make sure it is gone.

systemctl restart firewalls
firewall-cmd --zone=public --list-all

• Test that you can not get in
• Add the single IP

firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="76.197.102.224/32" accept' --permanent

• Test that you can get in
• Test that you can only get in from this IP Address

Refresh the Firewall

After creating new rules run.

firewall-cmd --complete-reload

To be really sure, rather use

systemctl restart firewalld