How to Set Up Firewall Policies using Firewalld

Introduction

Firewalld is a dynamic firewall application that provides a flexible way of setting up network filtering policies on a server by extending the Kernel-based Iptables functionalities. It provides flexible configuration options which include zone-based firewall management policies that represent a specific level of trust depending on your server network connections to protect the system from unauthorized access.

In this article, you will set up firewall policies using Firewalld and configure sample rules to filter network requests on a Vultr Cloud Server.

Prerequisites

Before you begin:

• Deploy a Vultr Rocky Linux server to use as the workstation.

• Access the server using SSH as a non-root user with sudo privileges.

• Update the server:

  console Copy

  $ sudo dnf update
  

Install Firewalld

Firewalld is available as a default system package on most Redhat-based server distributions such as CentOS, Rocky Linux, and AlmaLinux. When unavailable, follow the steps below to install and enable Firewalld to set up firewall filtering rules on the server.

1. Install Firewalld.

   console Copy

   $ sudo dnf install firewalld
   

2. Enable the Firewalld application to start at boot time.

   console Copy

   $ sudo systemctl enable firewalld
   

3. Start Firewalld.

   console Copy

   $ sudo systemctl start firewalld
   

4. Verify that the Firewalld service is active and running.

   console Copy

   $ sudo firewall-cmd --state
   

5. Run the following command to save all runtime changes to the permanent Firewalld configuration.

   console Copy

   $ sudo firewall-cmd --runtime-to-permanent
   

Set Up Firewalld Zones

Firewalld zones represent the level of trust for network connections associated with a specific network interface. Each zone includes a different security level and policies that govern the traffic flow on the associated interface. By default, Firewalld runs with the following zones:

• public: Applies to public-facing interfaces connected to external networks such as the Internet.
• home: Applies to network interfaces associated with home networks or small office environments.
• work: Works with corporate or organization network interfaces with better security over the home zone.
• internal: Works with private interfaces connected to networks such as Vultr VPCs.
• external: Applies to external untrusted networks. It's similar to the public zone but applies a higher security level by blocking incoming connection requests while accepting outgoing network connections.
• dmz: Works with network interfaces connected to demilitarized zones partly connected to the Internet and filtered by a firewall.
• block: Blocks all incoming and outgoing network traffic. It's useful when troubleshooting server network interfaces or networking errors.

1. View all available Firewalld zones.

   console Copy

   $ sudo firewall-cmd --get-zones
   

   Output:

   block dmz drop external home internal nm-shared public trusted work

2. View the default Firewalld zone.

   console Copy

   $ sudo firewall-cmd --get-default-zone
   

   Output:

   public

3. View the active Firewalld zone and the associated server network interfaces.

   console Copy

   $ sudo firewall-cmd --get-active-zones
   

   Output:

   public
     interfaces: enp1s0

   View the Firewalld zones assigned to a specific network interface. For example, view the enp8s0 network interface zone.

   console Copy

   $ sudo firewall-cmd --get-zone-of-interface=enp8s0
   

   Run the following command to change an interface from one zone to another. For example, change the enp1s0 interface to the external zone.

   console Copy

   $ sudo firewall-cmd --zone=home --change-interface=eth0
   

   Output:

   success

   Switching interfaces between zones sets different firewall rules and policies on the network interface for troubleshooting or testing purposes on the server.

4. View the active zones again to verify that two Firewalld zones are active due to the new interface assignment.

   console Copy

   $ sudo firewall-cmd --get-active-zones
   

   Output:

   home
     interfaces: enp8s0
   public
     interfaces: enp1s0

5. View all firewall rules associated with the active zone. By default public.

   console Copy

   $ sudo firewall-cmd --list-all
   

   Output:

   public (active)
     target: default
     icmp-block-inversion: no
     interfaces: enp1s0 enp8s0
     sources: 
     services: cockpit dhcpv6-client ssh
     ports: 
     protocols: 
     forward: yes
     masquerade: no
     forward-ports: 
     source-ports: 
     icmp-blocks: 
     rich rules: 

6. Change the active zone depending on your server networking environment. For example, change the Firewalld zone to external.

   console Copy

   $ sudo firewall-cmd --change-zone=public
   

Set Up Firewall Policies using Firewalld

Firewalld accepts network ports, system services, and service names across multiple zones depending on your server interfaces. Every Firewalld zone for example public applies the set policies and rules to the associated interfaces. Follow the steps below to set up firewall policies using Firewalld on the server.

To delete Firewalld rules, replace the --add option with --remove to delete the rule. For example, delete the FTP port 21 policy in the public zone.

```console
$ sudo firewall-cmd --zone=public --permanent --remove-port=22/tcp
```

Allow Network Ports

1. Add a new Firewalld rule that allows the SSH TCP port 22 through the public zone.

   console Copy

   $ sudo firewall-cmd --zone=public --permanent --add-port=22/tcp
   

   The above rule allows SSH access to the server using port 22 through the public zone. In addition, the rule is permanently saved in the firewall table using the --permanent option.

2. Allow another service port 80 through the firewall.

   console Copy

   $ sudo firewall-cmd --zone=public --permanent --add-port=80/tcp
   

3. View the active Firewalld zone ports to verify the new rules.

   console Copy

   $ sudo firewall-cmd --zone=public --list-ports
   

   Output:

   22/tcp 80/tcp

4. Run the following command to allow a range of ports through the public Firewalld zone. For example, port 7000 to 7500 depending on your internal hosts.

   console Copy

   $ sudo firewall-cmd --zone=public --permanent --add-port=4990-4999/udp
   

Allow System Services

1. View the list of available Firewalld services on your server.

   console Copy

   $ sudo firewall-cmd --get-services
   

   Output:

   RH-Satellite-6 RH-Satellite-6-capsule afp amanda-client amanda-k5-client amqp amqps apcupsd audit ausweisapp2 bacula bacula-client bb bgp bitcoin bitcoin-rpc bitcoin-testnet bitcoin-testnet-rpc bittorrent-lsd ceph ceph-mon cfengine checkmk-agent cockpit collectd condor-collector cratedb ctdb dhcp dhcpv6 dhcpv6-client distcc dns dns-over-tls docker-registry docker-swarm dropbox-lansync elasticsearch etcd-client etcd-server finger foreman foreman-proxy freeipa-4 freeipa-ldap freeipa-ldaps freeipa-replication freeipa-trust ftp galera ganglia-client ganglia-master git gpsd grafana gre high-availability http http3 https ident imap imaps ipfs ipp ipp-client ipsec irc ircs iscsi-target isns jenkins kadmin kdeconnect kerberos kibana klogin kpasswd kprop kshell kube-api kube-apiserver kube-control-plane kube-control-plane-secure kube-controller-manager kube-controller-manager-secure kube-nodeport-services kube-scheduler kube-scheduler-secure kube-worker kubelet kubelet-readonly kubelet-worker ldap ldaps libvirt libvirt-tls lightning-network llmnr llmnr-tcp llmnr-udp managesieve matrix mdns memcache minidlna mongodb mosh mountd mqtt mqtt-tls ms-wbt mssql murmur mysql nbd netbios-ns netdata-dashboard nfs nfs3 nmea-0183 nrpe ntp nut openvpn ovirt-imageio ovirt-storageconsole ovirt-vmconsole plex pmcd pmproxy pmwebapi pmwebapis pop3 pop3s postgresql privoxy prometheus prometheus-node-exporter proxy-dhcp ps3netsrv ptp pulseaudio puppetmaster quassel radius rdp redis redis-sentinel rpc-bind rquotad rsh rsyncd rtsp salt-master samba samba-client samba-dc sane sip sips slp smtp smtp-submission smtps snmp snmptls snmptls-trap snmptrap spideroak-lansync spotify-sync squid ssdp ssh steam-streaming svdrp svn syncthing syncthing-gui synergy syslog syslog-tls telnet tentacle tftp tile38 tinc tor-socks transmission-client upnp-client vdsm vnc-server wbem-http wbem-https wireguard ws-discovery ws-discovery-client ws-discovery-tcp ws-discovery-udp wsman wsmans xdmcp xmpp-bosh xmpp-client xmpp-local xmpp-server zabbix-agent zabbix-server zerotier

2. Allow a service such as HTTPS for access through the public zone table.

   console Copy

   $ sudo firewall-cmd --zone=public --add-service=https --permanent
   

3. Allow another service such as FTP through the public zone.

   console Copy

   $ sudo firewall-cmd --zone=public --add-service=ftp --permanent
   

4. Reload Firewalld to apply the new service changes.

   console Copy

   $ sudo firewall-cmd --reload
   

   Output:

   cockpit dhcpv6-client ftp http https ssh

Enable Forwarding and IP Address Rules

1. Allow incoming traffic to the SSH port 22 from your public server IP address 192.0.2.100.

   console Copy

   $ sudo firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="192.0.2.100" port protocol="tcp" port="80" accept'
   

2. Forward traffic from one port to another. For example, forward traffic from the internal port 8080 to the destination port 8900 through all IP addresses.

   console Copy

   $ sudo firewall-cmd --zone=public --add-forward-port=port=80:proto=tcp:toport=8080:toaddr=0.0.0.0 --permanent
   

   The above rule forwards all incoming requests on port 8080 to 8900 to securely expose a specific resource on different ports.

3. Reload Firewalld to save the zone changes.

   console Copy

   $ sudo firewall-cmd --reload
   

Create Custom Firewalld Zones

1. Create a new Firewalld zone with a custom name such as example-zone.

   console Copy

   $ sudo firewall-cmd --permanent --new-zone=example-zone
   

2. Reload Firewalld to save changes.

   console Copy

   $ sudo firewall-cmd --reload
   

3. View the Firewalld zones and verify that the new custom zone is available.

   console Copy

   $ sudo firewall-cmd --permanent --get-zones
   

   Output:

   block dmz drop example-zone external home internal nm-shared public trusted work

Firewalld Panic Mode

Firewalld panic mode blocks all incoming and outgoing network connections on the server to protect the system in case of security threats. When enabled, the server blocks all connections including your active SSH session. Follow the steps below to enable panic mode and troubleshoot the system in case of external threats or network failures.

1. View the Firewalld panic mode status.

   console Copy

   $ sudo firewall-cmd --query-panic
   

   Output:

   no

2. Enable panic mode to block all network connections on the server.

   console Copy

   $ sudo firewall-cmd --panic-on
   

3. View the Firewalld panic mode status and verify that it's active.

   console Copy

   $ sudo firewall-cmd --query-panic
   

   Output:

   yes

   In case Firewalld blocks your SSH session, access your instance page in the Vultr Customer Portal and use the Vultr Console to start a new server terminal session.

Conclusion

You have set up firewall policies using Firewalld on a Vultr Cloud Server and configured multiple rules to filter network connections using zone profiles. Firewalld uses zones, services, ports, and custom rules as the major firewall configuration options to filter network traffic on a server. To manually modify the Firewalld configurations, navigate to the /etc/firewalld application data directory. For more information, visit the application manual page using the man firewalld command.