Firewalld in Linux | User Guide on How to Use and What it is

Understanding Firewalld in Linux is crucial for bolstering network security and shielding servers from potential threats. At IOFLOOD, where we prioritize the integrity and confidentiality of our clients’ data, familiarity with Firewalld is essential for enhancing our network defenses. Drawing from our experience in Linux system administration and cybersecurity, we’ve put together this article to simplify Firewalld’s functionalities. By offering our practical insights, we aim to fortify the security of our dedicated server customers and fellow developers.

This guide will provide a comprehensive understanding of firewalld, its usage, and its importance in Linux. We’ll cover everything from the basics of installing and configuring firewalld, to advanced features such as zones, services, and rich rules. We’ll also introduce alternative firewall solutions and discuss common issues and their solutions.

So, let’s dive in and start mastering firewalld in Linux!

TL;DR: What is Firewalld in Linux?

Firewalld is a firewall management tool for Linux operating systems that provides an easy-to-use interface for managing firewall rules. It is also the default firewall solution on many Linux distributions. You can manually install it with apt-get install firewalld and it can be started with systemctl start firewalld.

Here’s a simple example of how to check the status of firewalld:

sudo systemctl status firewalld

# Output:
# ● firewalld.service - firewalld - dynamic firewall daemon
#    Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
#    Active: active (running) since Tue 2021-12-07 09:06:39 PST; 1 weeks 0 days ago
#      Docs: man:firewalld(1)
# Main PID: 1234 (firewalld)
#    Tasks: 2 (limit: 4915)
#   Memory: 30.8M
#   CGroup: /system.slice/firewalld.service
#           └─1234 /usr/bin/python3 -Es /usr/sbin/firewalld --nofork --nopid

In this example, we use the systemctl command to check the status of the firewalld service. The output shows that the service is active and running.

This is just a basic interaction with firewalld in Linux, but there’s much more to learn about managing your system’s firewall with this tool. Continue reading for more detailed information and advanced usage scenarios.

How-to Install & Configure Firewalld

Firewalld comes pre-installed on many Linux distributions. However, if it’s not present on your system, you can install it using the package manager for your distribution. For example, on a Fedora or CentOS system, you would use the following command:

sudo dnf install firewalld

# Output:
# Installing:
#  firewalld                     noarch                     0.6.3-2.el7                     base                     429 k
# Transaction Summary
# Install  1 Package

This command installs the firewalld package using the dnf package manager. The sudo command is used to run the installation as the root user, which is necessary because installing software on a Linux system typically requires root privileges.

Once installed, you can start the firewalld service with the following command:

sudo systemctl start firewalld

# Output:
# No output means the command was successful

This command starts the firewalld service. The systemctl command is used to control systemd, the system and service manager for Linux.

Now, let’s discuss how to add and remove rules, and enable/disable the firewall.

Adding and Removing Rules in Firewalld

With firewalld, you can add rules to allow or deny traffic based on various criteria, such as the network zone, the traffic’s source and destination addresses, and the service or application generating the traffic.

Here is an example of how to add a rule to allow incoming SSH connections:

sudo firewall-cmd --zone=public --add-service=ssh --permanent

# Output:
# success

In this example, the firewall-cmd command is used to interact with firewalld. The --zone=public option specifies the network zone for which the rule should apply. The --add-service=ssh option adds a rule to allow SSH traffic. The --permanent option makes the rule persistent across reboots.

To remove the rule, you would use the following command:

sudo firewall-cmd --zone=public --remove-service=ssh --permanent

# Output:
# success

This command is similar to the previous one, but it uses the --remove-service=ssh option to remove the rule that allows SSH traffic.

Enabling and Disabling Firewalld

You can enable firewalld to start automatically at boot time with the following command:

sudo systemctl enable firewalld

# Output:
# Created symlink /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service → /usr/lib/systemd/system/firewalld.service.
# Created symlink /etc/systemd/system/multi-user.target.wants/firewalld.service → /usr/lib/systemd/system/firewalld.service.

This command creates a symbolic link that tells systemd to start the firewalld service at boot time.

If you need to disable firewalld, you can use the following command:

sudo systemctl disable firewalld

# Output:
# Removed /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
# Removed /etc/systemd/system/multi-user.target.wants/firewalld.service.

This command removes the symbolic link that was created by the systemctl enable command, which prevents firewalld from starting automatically at boot time.

Advanced Features of Firewalld

Firewalld offers several advanced features that provide more granular control over network traffic. Let’s dive into some of these features: zones, services, and rich rules.

Understanding Zones in Firewalld

Zones are a fundamental concept in firewalld. They allow you to define different levels of trust for different network interfaces and connections. For example, you might have a ‘public’ zone for untrusted networks and a ‘home’ zone for your home network.

You can view the default zone using the following command:

sudo firewall-cmd --get-default-zone

# Output:
# public

This command displays the default zone, which is ‘public’ in this case.

To change the default zone, you would use the --set-default-zone option:

sudo firewall-cmd --set-default-zone=home

# Output:
# success

This command changes the default zone to ‘home’.

Managing Services with Firewalld

Firewalld allows you to manage network traffic based on the service or application that is generating the traffic. For example, you can add a rule to allow HTTP traffic through the firewall.

Here is an example of how to add a service to a zone:

sudo firewall-cmd --zone=public --add-service=http --permanent

# Output:
# success

This command adds a rule to the ‘public’ zone to allow HTTP traffic. The --permanent option makes the rule persistent across reboots.

Using Rich Rules in Firewalld

Rich rules provide a way to create more complex firewall rules. They allow you to combine multiple criteria, such as source and destination addresses, ports, protocols, and more.

Here is an example of how to add a rich rule that allows SSH connections from a specific IP address:

sudo firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="192.0.2.0/24" service name="ssh" accept' --permanent

# Output:
# success

This command adds a rich rule to the ‘public’ zone that allows SSH connections from the 192.0.2.0/24 IP address range. The --permanent option makes the rule persistent across reboots.

These are just a few examples of the advanced features of firewalld. By understanding and using these features, you can create a robust and secure firewall configuration for your Linux system.

Alternate Linux Firewall Solutions

While firewalld is a powerful and flexible tool for managing your Linux system’s firewall, it’s not the only game in town. Other popular firewall solutions include iptables and ufw (Uncomplicated Firewall). Let’s take a closer look at these alternatives.

Diving into Iptables

Iptables is a user-space utility program that allows a system administrator to configure the IP packet filter rules of the Linux kernel firewall. It is a mature and highly flexible tool, but it can be complex and difficult to use.

Here’s a basic example of how to add a rule with iptables to allow incoming SSH connections:

sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Output:
# No output means the command was successful

This command appends (-A) a rule to the INPUT chain to accept (-j ACCEPT) incoming TCP packets (-p tcp) destined for port 22 (--dport 22), which is the default port for SSH.

Uncomplicating Firewalls with Ufw

Ufw, or Uncomplicated Firewall, is a frontend for iptables that is designed to be easy to use while still providing powerful functionality. It’s the default firewall management tool on Ubuntu and other Debian-based distributions.

Here’s an example of how to add a rule with ufw to allow incoming SSH connections:

sudo ufw allow ssh

# Output:
# Rules updated
# Rules updated (v6)

This command uses the allow keyword to permit incoming SSH traffic. The ssh argument is a service name from the /etc/services file.

Comparing Firewalld, Iptables, and Ufw

All three of these tools can be used to effectively manage a Linux system’s firewall, but they each have their own strengths and weaknesses.

Firewalld is dynamic, meaning its rules can be updated without interrupting current connections, and it supports network zones. However, it may be overkill for simple use cases, and its syntax can be confusing.

Iptables is extremely flexible and powerful, but it can be complex and difficult to use. It’s best suited for advanced users who need fine-grained control over their firewall rules.

Ufw is easy to use and is a good choice for beginners or anyone who wants a simple firewall management tool. However, it doesn’t support network zones and isn’t as flexible or powerful as iptables.

In the end, the best tool for you depends on your needs and your comfort level with Linux and firewall management.

Troubleshooting Tips with Firewalld

As with any tool, there can be challenges and conflicts when using firewalld. Let’s discuss some common issues you might encounter and how to solve them.

Dealing with Firewall Conflicts

One common issue is conflicts with other firewall solutions. If you have another firewall tool like iptables or ufw installed and running on your system, it might interfere with firewalld.

To check if iptables or ufw is running, you can use the following commands:

sudo systemctl status iptables
sudo systemctl status ufw

# Output:
# ● iptables.service - LSB: Start iptables at boot time
#    Loaded: loaded (/etc/init.d/iptables; bad; vendor preset: enabled)
#    Active: inactive (dead)
#      Docs: man:systemd-sysv-generator(8)

# ● ufw.service - Uncomplicated firewall
#    Loaded: loaded (/lib/systemd/system/ufw.service; enabled; vendor preset: enabled)
#    Active: inactive (dead)
#      Docs: man:ufw(8)

If either of these services is active, you should stop and disable them to prevent conflicts with firewalld.

Understanding and Resolving Error Messages

Another common issue is error messages when trying to add rules or make other changes. These errors are often due to syntax errors or trying to use features that aren’t supported by your version of firewalld.

For example, if you try to add a rich rule with a feature that isn’t supported, you might see an error message like this:

sudo firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="192.0.2.0/24" service name="ssh" log prefix="ssh connections" level="info" limit value="1/m" accept'

# Output:
# Error: INVALID_RULE: rule family="ipv4" source address="192.0.2.0/24" service name="ssh" log prefix="ssh connections" level="info" limit value="1/m" accept

This error message indicates that the log directive in the rich rule is invalid. You can resolve this issue by removing the log directive or by upgrading to a version of firewalld that supports it.

Best Practices for Using Firewalld

Finally, here are some best practices for using firewalld:

• Always test new rules before making them permanent. This can prevent you from locking yourself out of your system if a rule blocks necessary traffic.

• Use zones to organize your rules. This can make your firewall configuration easier to understand and manage.

• Regularly review and update your rules. This can help keep your system secure as your network requirements change.

• Use the --list-all option to view all the settings for a zone. This can be helpful for troubleshooting and for understanding your current firewall configuration.

sudo firewall-cmd --zone=public --list-all

# Output:
# public (active)
#  target: default
#  icmp-block-inversion: no
#  interfaces: eth0
#  sources: 
#  services: ssh dhcpv6-client
#  ports: 
#  protocols: 
#  masquerade: no
#  forward-ports: 
#  source-ports: 
#  icmp-blocks: 
#  rich rules: 

This command lists all the settings for the ‘public’ zone, including interfaces, services, and rules.

Explained: Firewalls Role in Linux

In the realm of network security, a firewall acts as a gatekeeper, controlling incoming and outgoing network traffic based on predetermined security rules. It forms the first line of defense in network security by controlling access to systems from external networks.

In Linux, a firewall is used to filter packets, control network access, and provide an additional layer of security. It can block unwanted traffic, allow necessary traffic, and even direct traffic from one address to another using NAT (Network Address Translation).

Principles of Network Security

The principles of network security revolve around three fundamental concepts: confidentiality, integrity, and availability, often referred to as the CIA triad.

• Confidentiality: Ensuring that data is accessible only to authorized parties.
• Integrity: Assuring the accuracy and reliability of data during its lifecycle.
• Availability: Ensuring that authorized parties are able to access the data when needed.

A firewall plays a crucial role in maintaining these principles by controlling access to the network, preventing unauthorized access, and maintaining the overall security of the system.

How Firewalld Enhances Network Security in Linux

Firewalld amplifies the principles of network security by providing a dynamic, manageable, and configurable firewall with a simple and easy-to-use interface. It supports both IPv4 and IPv6, ethernet bridges, and IP sets, ensuring a broad range of compatibility.

Firewalld uses zones and services instead of chains and rules, which are used in traditional Linux firewalls like iptables. This makes firewalld easier to manage and understand, especially for beginners.

For example, to allow HTTP traffic in the public zone, you would use the following command:

sudo firewall-cmd --zone=public --add-service=http --permanent

# Output:
# success

This command adds a rule to the ‘public’ zone to allow HTTP traffic. The --permanent option makes the rule persistent across reboots.

This is just a simple example, but it illustrates how firewalld’s approach to firewall management can be more intuitive and user-friendly than traditional methods. By understanding and effectively using firewalld, you can significantly enhance the security of your Linux system.

Practical Linux Usage of Firewalld

Firewalld is not just a standalone tool, but a significant part of the Linux system administration ecosystem. It is closely intertwined with various other aspects of system administration, particularly those related to network security.

Network Security and Firewalld

Firewalld is a crucial component in a Linux system’s network security. By controlling network traffic, it helps protect the system from unauthorized access and potential attacks. Understanding firewalld’s functionality and its role in network security is essential for any Linux system administrator.

Here’s an example of how to block all incoming traffic except SSH using firewalld:

sudo firewall-cmd --zone=public --add-service=ssh --permanent
sudo firewall-cmd --zone=public --set-target=DROP --permanent
sudo firewall-cmd --reload

# Output:
# success

In this example, the first command adds a rule to allow SSH traffic. The second command sets the default action for incoming traffic in the ‘public’ zone to ‘DROP’, effectively blocking all incoming traffic that doesn’t match any other rules. The third command reloads the firewall configuration to apply the changes.

Intrusion Detection Systems and Firewalld

Intrusion Detection Systems (IDS) are another key aspect of network security. These systems monitor network traffic for suspicious activity and issue alerts when such activity is detected. Firewalld can work in conjunction with an IDS to provide a robust defense against network-based attacks.

Virtual Private Networks and Firewalld

Virtual Private Networks (VPNs) are used to create secure connections to a network over the Internet. Firewalld can be configured to allow VPN traffic, adding an additional layer of security for remote access to a network.

Further Resources for Mastering Firewalld in Linux

For those interested in diving deeper into firewalld and related topics, here are some useful resources:

• The Fedora Project’s Firewalld Documentation covers everything from basic usage to advanced features.

• Digital Ocean’s Tutorial on Firewalld provides a hands-on introduction to using firewalld on CentOS 7.

• A Guide to Linux Firewalls covers both iptables and firewalld, providing a comparative look.

Recap: Firewalld Linux Tutorial

In this comprehensive guide, we’ve delved into the world of firewalld, a dynamic firewall management tool for Linux systems. We’ve explored its fundamental role in protecting Linux systems from unwanted network traffic, and how it contributes to the principles of network security.

We began with the basics, learning how to install and configure firewalld, and how to add and remove rules. We then ventured into more advanced territory, exploring features like zones, services, and rich rules. Along the way, we tackled common challenges you might face when using firewalld, such as conflicts with other firewall solutions, and provided solutions to help you overcome these challenges.

We also looked at alternative approaches, comparing firewalld with other popular Linux firewall solutions like iptables and ufw. Here’s a quick comparison of these tools:

Whether you’re just starting out with firewalld or you’re looking to level up your Linux system administration skills, we hope this guide has given you a deeper understanding of firewalld and its capabilities.

With its balance of flexibility, ease of use, and support for zones, firewalld is a powerful tool for managing your Linux system’s firewall. Now, you’re well equipped to enjoy those benefits. Happy coding!