1.6. Working with firewalld zones

Procedure

1. Display the current default zone:

   # firewall-cmd --get-default-zone

2. Set the new default zone:

   # firewall-cmd --set-default-zone <zone_name>

   注記

   Following this procedure, the setting is a permanent setting, even without the --permanent option.

Procedure

1. Create a new zone:

   # firewall-cmd --permanent --new-zone=zone-name

2. Make the new zone usable:

   # firewall-cmd --reload

   The command applies recent changes to the firewall configuration without interrupting network services that are already running.

Procedure

1. List the active zones and the interfaces assigned to them:

   # firewall-cmd --get-active-zones

2. Assign the interface to a different zone:

   # firewall-cmd --zone=zone_name --change-interface=interface_name --permanent

Procedure

1. List all available zones:

   # firewall-cmd --get-zones

2. Add the source IP to the trusted zone in the permanent mode:

   # firewall-cmd --zone=trusted --add-source=192.168.2.15

3. Make the new settings persistent:

   # firewall-cmd --runtime-to-permanent

Procedure

1. List allowed sources for the required zone:

   # firewall-cmd --zone=zone-name --list-sources

2. Remove the source from the zone permanently:

   # firewall-cmd --zone=zone-name --remove-source=<source>

3. Make the new settings persistent:

   # firewall-cmd --runtime-to-permanent

Procedure

1. Assign the zone to the NetworkManager connection profile:

   # nmcli connection modify profile connection.zone zone_name

2. Activate the connection:

   # nmcli connection up profile

Procedure

1. List the information for the specific zone to see the default target:

   # firewall-cmd --zone=zone-name --list-all

2. Set a new target in the zone:

   # firewall-cmd --permanent --zone=zone-name --set-target=<default|ACCEPT|REJECT|DROP>

Procedure

1. List the available firewall zones:

   # firewall-cmd --get-zones

   The firewall-cmd --get-zones command displays all zones that are available on the system, but it does not show any details for particular zones. To see more detailed information for all zones, use the firewall-cmd --list-all-zones command.

2. Choose the zone you want to use for this configuration.

3. Modify firewall settings for the chosen zone. For example, to allow the SSH service and remove the ftp service:

   # firewall-cmd --add-service=ssh --zone=<your_chosen_zone>
   # firewall-cmd --remove-service=ftp --zone=<same_chosen_zone>

4. Assign a network interface to the firewall zone:

   1. List the available network interfaces:

      # firewall-cmd --get-active-zones

      Activity of a zone is determined by the presence of network interfaces or source address ranges that match its configuration. The default zone is active for unclassified traffic but is not always active if no traffic matches its rules.

   2. Assign a network interface to the chosen zone:

      # firewall-cmd --zone=<your_chosen_zone> --change-interface=<interface_name> --permanent

      Assigning a network interface to a zone is more suitable for applying consistent firewall settings to all traffic on a particular interface (physical or virtual).

      The firewall-cmd command, when used with the --permanent option, often involves updating NetworkManager connection profiles to make changes to the firewall configuration permanent. This integration between firewalld and NetworkManager ensures consistent network and firewall settings.

Verification

1. Display the updated settings for your chosen zone:

   # firewall-cmd --zone=<your_chosen_zone> --list-all

   The command output displays all zone settings including the assigned services, network interface, and network connections (sources).

Procedure

1. Create an IP set with a meaningful name:

   # firewall-cmd --permanent --new-ipset=allowlist --type=hash:ip

   The new IP set called allowlist contains IP addresses that you want your firewall to allow.

2. Add a dynamic update to the IP set:

   # firewall-cmd --permanent --ipset=allowlist --add-entry=198.51.100.10

   This configuration updates the allowlist IP set with a newly added IP address that is allowed to pass network traffic by your firewall.

3. Create a firewall rule that references the previously created IP set:

   # firewall-cmd --permanent --zone=public --add-source=ipset:allowlist

   Without this rule, the IP set would not have any impact on network traffic. The default firewall policy would prevail.

4. Reload the firewall configuration to apply the changes:

   # firewall-cmd --reload

Verification

1. List all IP sets:

   # firewall-cmd --get-ipsets
   allowlist

2. List the active rules:

   # firewall-cmd --list-all
   public (active)
     target: default
     icmp-block-inversion: no
     interfaces: enp0s1
     sources: ipset:allowlist
     services: cockpit dhcpv6-client ssh
     ports:
     protocols:
     ...

   The sources section of the command-line output provides insights to what origins of traffic (hostnames, interfaces, IP sets, subnets, and others) are permitted or denied access to a particular firewall zone. In this case, the IP addresses contained in the allowlist IP set are allowed to pass traffic through the firewall for the public zone.

3. Explore the contents of your IP set:

   # cat /etc/firewalld/ipsets/allowlist.xml
   <?xml version="1.0" encoding="utf-8"?>
   <ipset type="hash:ip">
     <entry>198.51.100.10</entry>
   </ipset>

Procedure

1. Log in to the RHEL 10 web console.
2. Click Networking.
3. Click the Edit rules and zones button.
4. In the Firewall section, click Add new zone.

5. In the Add zone dialog box, select a zone from the Trust level options.

   The web console displays all zones predefined in the firewalld service.

6. In the Interfaces part, select an interface or interfaces to which you want to apply the selected zone.

7. In the Allowed Addresses part, you can select whether the zone is applied to:

   • the whole subnet

   • a range of IP addresses in the following format:

     • 192.168.1.0
     • 192.168.1.0/24
     • 192.168.1.0/24, 192.168.1.0
8. Click the Add zone button.

Procedure

1. Log in to the RHEL 10 web console.
2. Click Networking.
3. Click the Edit rules and zones button.

4. Click the ⋮ button (three-dot menu) at the zone you want to remove.

   

5. Click Delete.