[:en]

In CentOS 7, add a new service, Firewalld, the following picture, so that we clearly understand the relationship between Firewall and iptables and the difference between.

Article from

http://digit77.com/experience/centos-7-firewall-look-at-this-you-will-be-good-at-it.html

Install it just

yum install firewalld

If you need a graphical interface, then install

yum install firewall-config

A.The introduction

The firewall daemon firewalld introduces a concept of trust level to manage the associated connections and interfaces. It supports ipv4 and ipv6, and supports the bridge, using firewall-cmd (command) or firewall-config (gui) to dynamically manage the kernel netfilter temporary or permanent interface rules, and real-time without having to restart the service.

1.zone

Firewall can classify different network connections to different levels of trust, and Zone provides the following levels

drop: Drop all incoming packets without giving any response
block: Rejects all externally initiated connections, allowing internally initiated connections
public: Allows the specified incoming connection
external:Same as above. Access to the disguised connection, generally used for routing forwarding
dmz: Allow restricted access connections
work: Allows trusted computers to be restricted to incoming connections, such as workgroups
home: Same as above, similar to homegroup
internal: Same as above, for all Internet users
trusted: Trust all connections

2.Filter rules

source:Filter by source address

interface: Filter according to network card
service: Filter by service name
port:Filter by port
icmp-block: ICMP packet filtering, according to icmp type configuration
masquerade: Ip address camouflage
forward-port: Port forwarding
rule: Custom rules

The priority of the filtering rules follows the following order

source
interface
firewalld.conf

B. Method

systemctl start firewalld # Start,
systemctl enable firewalld # Start when boot
systemctl stop firewalld # Shut down
systemctl disable firewalld # Cancel start when boot

Specific rule management can be used firewall-cmd，Specific use can be

$ firewall-cmd --help

--zone=NAME # Specify zone
--permanent # Permanent modification, -- after reload executthe
--timeout=seconds # Continuous effect, automatically removed after expiration, for debugging, can not be used with --permanent

1. View rules

View the running status

$ firewall-cmd --state

View the Zone information that has been activated

$ firewall-cmd --get-active-zones
public
interfaces: eth0 eth1

View the Zone information for the specified interface

$ firewall-cmd --get-zone-of-interface=eth0
public

View the interface at the specified level

$ firewall-cmd --zone=public --list-interfaces
eth0

View all information at the specified level, such as public

$ firewall-cmd --zone=public --list-all
public (default, active)
interfaces: eth0
sources:
services: dhcpv6-client http ssh
ports:
masquerade: no
forward-ports:
icmp-blocks:
rich rules:

View all levels of information that is allowed

$ firewall-cmd --get-service

Check the services that are allowed in all Zones levels after the restart, that is, the services that are permanently released

$ firewall-cmd --get-service --permanent

2. Management rules

firewall-cmd --panic-on # Drop
firewall-cmd --panic-off # Cancel drop
firewall-cmd --query-panic # View Drop Status
firewall-cmd --reload # Update the rules, do not restart the service
firewall-cmd --complete-reload #Update the rules, restart the service

Add an interface to a trust level, such as add eth0 to public, permanent changes

firewall-cmd --zone=public --add-interface=eth0 --permanent

Set Public as the default trust level

firewall-cmd --set-default-zone=public

a. Management port

List the allowed entry ports at the dmz level

firewall-cmd --zone=dmz --list-ports

Allow tcp port 8080 to dmz level

firewall-cmd --zone=dmz --add-port=8080/tcp

Allows a range of udp ports to the Public level and takes effect permanently

firewall-cmd --zone=public --add-port=5060-5059/udp --permanent

b. NIC interface

List all Public network cards

firewall-cmd --zone=public --list-interfaces

Add eth0 to the Public zone, permanent

firewall-cmd --zone=public --permanent --add-interface=eth0

Eth0 in the Public Zone, add the card to the work zone, and remove it from thePublic Zone

firewall-cmd --zone=work --permanent --change-interface=eth0

Delete eth0 in Public Zone, permanent

firewall-cmd --zone=public --permanent --remove-interface=eth0

c. Management services

Add the smtp service to the Work Zone

firewall-cmd --zone=work --add-service=smtp

Remove the smtp service from theWork Zone

firewall-cmd --zone=work --remove-service=smtp

d. Configure the ip address mismatch in the external zone

To view

firewall-cmd --zone=external --query-masquerade

Turn on Masquerade

firewall-cmd --zone=external --add-masquerade

Turn off Masquerade

firewall-cmd --zone=external --remove-masquerade

e.Configure the port forwarding of the public zone

To turn on port forwarding, you need to first

firewall-cmd --zone=public --add-masquerade

And then forward tcp port 22 to 3753

firewall-cmd --zone=public --add-forward-port=port=22:proto=tcp:toport=3753

Forward data on port 22 to another ip on the same port

firewall-cmd --zone=public --add-forward-port=port=22:proto=tcp:toaddr=192.168.1.100

Forward data on port 22 to another ip on the port 2055

firewall-cmd --zone=public --add-forward-port=port=22:proto=tcp:toport=2055:toaddr=192.168.1.100

f. Configure the public zone icmp

View all types of supported ICMP

firewall-cmd --get-icmptypes

destination-unreachable echo-reply echo-request parameter-problem redirect router-advertisement router-solicitation source-quench time-exceeded

List

firewall-cmd --zone=public --list-icmp-blocks

Add echo-request mask

firewall-cmd --zone=public --add-icmp-block=echo-request [--timeout=seconds]

Remove echo-reply mask

firewall-cmd --zone=public --remove-icmp-block=echo-reply

g. Block IP

firewall-cmd --permanent --add-rich-rule="rule family='ipv4' source address='222.222.222.222' reject"
Of course, we can still use the ipset to ban ip

Block ip

firewall-cmd --permanent --zone=public --new-ipset=blacklist --type=hash:ip
firewall-cmd --permanent --zone=public --ipset=blacklist --add-entry=222.222.222.222

Block the network segment

firewall-cmd --permanent --zone=public --new-ipset=blacklist --type=hash:net
firewall-cmd --permanent --zone=public --ipset=blacklist --add-entry=222.222.222.0/24

Import ipset rules

firewall-cmd --permanent --zone=public --new-ipset-from-file=/path/blacklist.xml

Then banned blacklist

firewall-cmd --permanent --zone=public --add-rich-rule='rule source ipset=blacklist drop'

Reload to execution

firewall-cmd --reload

Above are some common methods, more advanced methods, please refer to:

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Using_Firewalls.html
https://fedoraproject.org/wiki/FirewallD[:]