Table of Contents
Firewall is essential network tool which controlls access to configure access to network resources.
ULFS is support various firewalls back-ends like iptables, nftables. But in order to work with firewalld front-end iptables is more suitable back-end.
Firewalld is command-line interface (CLI) which used by libvirt daemon. Both firewalld and libvirt is products of Red Hat Company and used in RedHat, CentOS, Fedora distribs. You can get more information from their documentation.
To install firewalld just build and install firewalld source package:
chimp install firewalld
After installing firewalld it's needed to configure firewalld back-end. As mentioned above we recomend to use iptables. Just edit /etc/firewalld/firewalld.conf file and change parameter "FirewallBackend" value to "iptables".
After configuring firewalld we can set firewalld daemon autoload.
systemctl enable firewalld
To launch firewalld we need to restart a system or run command
systemctl start firewalld
After launching firewalld all ports in local machine from outside become closed. It's needed to open ports before access to them.
To open tcp port to ssh by port number use command:
firewall-cmd --add-port=22/tcp
To open tcp port by service name use command:
firewall-cmd --add-service=ssh
It's should be mentioned that if you configure service to use other port (not default from /etc/services file) access can become denied. You have to check firewall settings manualy.
Some times it's needed to open ports for specific IP-address in order to perform administrative tasks for example.
To open tcp port 5900 to 10.0.0.1 we can use command:
firewall-cmd --add-rich-rule=' rule family="ipv4" source address="10.0.0.1" port protocol="tcp" port="5900" accept'
To open multiple ports from given interval use "-" as delimeter in ports value (for example: "5900-5999").
It's possible grant access for local network resources from outside. Openning access to local network nodes ports called ports forwarding.
Port forwardig is very useful when you work witn virtual machines.
To open port 27960 on virtual machine with address 192.168.122.2 we can use command:
firewall-cmd --add-forward-port=port=27960:proto=udp:toaddr=192.168.122.2
In order to save firewalld rules for further automatic load durring boot pass additional option "--permanent" to firewall-cmd command.
To clean temporary firewalld rules and to check stored permanent rules use command:
firewall-cmd --reload