===== FirewallD ===== Listando as zonas existentes # firewall-cmd --get-zones block dmz drop external home internal public trusted work Listando a zona padrão # firewall-cmd --get-default-zone public Verificando que interface está atrelada à zona # firewall-cmd --get-active-zones public interfaces: enp0s3 enp0s8 enp0s9 Alterando a zona padrão # firewall-cmd --set-default-zone=internal success Verificando em que zona uma interface está atrelada # firewall-cmd --get-zone-of-interface=enp0s3 internal Tipos de ICMP suportados pelo firewalld # firewall-cmd --get-icmptypes destination-unreachable echo-reply echo-request parameter-problem redirect router-advertisement router-solicitation source-quench time-exceeded Atribuindo uma interface a uma zona # firewall-cmd --zone=external --change-interface=enp0s8 success # nmcli con mod enp0s8 connection.zone exeternal # nmcli con up enp0s8 Conexão ativada com sucesso (caminho ativo D-Bus: /org/freedesktop/NetworkManager/ActiveConnection/3) # firewall-cmd --reload success # firewall-cmd --zone=external --list-all external (active) interfaces: enp0s8 sources: services: ssh ports: masquerade: yes forward-ports: icmp-blocks: rich rules: Liberando uma sub-rede na zona internal # firewall-cmd --zone=internal --add-source=192.0.2.0/24 success Listando os serviços suportados # firewall-cmd --get-services RH-Satellite-6 amanda-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns freeipa-ldap freeipa-ldaps freeipa-replication ftp high-availability http https imaps ipp ipp-client ipsec iscsi-target kerberos kpasswd ldap ldaps libvirt libvirt-tls mdns mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s postgresql proxy-dhcp radius rpc-bind rsyncd samba samba-client smtp ssh telnet tftp tftp-client transmission-client vdsm vnc-server wbem-https Liberando o service http # firewall-cmd --add-service=http success # firewall-cmd --zone=internal --list-services dhcpv6-client http ipp-client mdns samba-client ssh Liberando uma 7789 # firewall-cmd --add-port=7789/tcp success # firewall-cmd --list-ports 7789/tcp Liberando um serviço a uma sub-rede # firewall-cmd --add-rich-rule 'rule family="ipv4" source address="192.0.2.0/24" service name="http" accept' success Liberando uma porta a uma sub-rede # firewall-cmd --add-rich-rule="rule family="ipv4" source address="192.0.2.0/24" port protocol="tcp" port="7789" accept" success ===== Help ===== # firewall-cmd --help Usage: firewall-cmd [OPTIONS...] General Options -h, --help Prints a short help text and exists -V, --version Print the version string of firewalld -q, --quiet Do not print status messages Status Options --state Return and print firewalld state --reload Reload firewall and keep state information --complete-reload Reload firewall and loose state information --runtime-to-permanent Create permanent from runtime configuration Permanent Options --permanent Set an option permanently Usable for options maked with [P] Zone Options --get-default-zone Print default zone for connections and interfaces --set-default-zone= Set default zone --get-active-zones Print currently active zones --get-zones Print predefined zones [P] --get-services Print predefined services [P] --get-icmptypes Print predefined icmptypes [P] --get-zone-of-interface= Print name of the zone the interface is bound to [P] --get-zone-of-source=[/] Print name of the zone the source[/mask] is bound to [P] --list-all-zones List everything added for or enabled in all zones [P] --new-zone= Add a new zone [P only] --delete-zone= Delete an existing zone [P only] --zone= Use this zone to set or query options, else default zone Usable for options maked with [Z] --get-target Get the zone target [P only] [Z] --set-target= Set the zone target [P only] [Z] IcmpType Options --new-icmptype= Add a new icmptype [P only] --delete-icmptype= Delete and existing icmptype [P only] Service Options --new-service= Add a new service [P only] --delete-service= Delete and existing service [P only] Options to Adapt and Query Zones --list-all List everything added for or enabled in a zone [P] [Z] --list-services List services added for a zone [P] [Z] --timeout= Enable an option for timeval time, where timeval is a number followed by one of letters 's' or 'm' or 'h' Usable for options maked with [T] --add-service= Add a service for a zone [P] [Z] [T] --remove-service= Remove a service from a zone [P] [Z] --query-service= Return whether service has been added for a zone [P] [Z] --list-ports List ports added for a zone [P] [Z] --add-port=[-]/ Add the port for a zone [P] [Z] [T] --remove-port=[-]/ Remove the port from a zone [P] [Z] --query-port=[-]/ Return whether the port has been added for zone [P] [Z] --list-icmp-blocks List Internet ICMP type blocks added for a zone [P] [Z] --add-icmp-block= Add an ICMP block for a zone [P] [Z] [T] --remove-icmp-block= Remove the ICMP block from a zone [P] [Z] --query-icmp-block= Return whether an ICMP block has been added for a zone [P] [Z] --list-forward-ports List IPv4 forward ports added for a zone [P] [Z] --add-forward-port=port=[-]:proto=[:toport=[-]][:toaddr=
[/]] Add the IPv4 forward port for a zone [P] [Z] [T] --remove-forward-port=port=[-]:proto=[:toport=[-]][:toaddr=
[/]] Remove the IPv4 forward port from a zone [P] [Z] --query-forward-port=port=[-]:proto=[:toport=[-]][:toaddr=
[/]] Return whether the IPv4 forward port has been added for a zone [P] [Z] --add-masquerade Enable IPv4 masquerade for a zone [P] [Z] [T] --remove-masquerade Disable IPv4 masquerade for a zone [P] [Z] --query-masquerade Return whether IPv4 masquerading has been enabled for a zone [P] [Z] --list-rich-rules List rich language rules added for a zone [P] [Z] --add-rich-rule= Add rich language rule 'rule' for a zone [P] [Z] [T] --remove-rich-rule= Remove rich language rule 'rule' from a zone [P] [Z] --query-rich-rule= Return whether a rich language rule 'rule' has been added for a zone [P] [Z] Options to Handle Bindings of Interfaces --list-interfaces List interfaces that are bound to a zone [P] [Z] --add-interface= Bind the to a zone [P] [Z] --change-interface= Change zone the is bound to [Z] --query-interface= Query whether is bound to a zone [P] [Z] --remove-interface= Remove binding of from a zone [P] [Z] Options to Handle Bindings of Sources --list-sources List sources that are bound to a zone [P] [Z] --add-source=[/] Bind [/] to a zone [P] [Z] --change-source=[/] Change zone the [/] is bound to [Z] --query-source=[/] Query whether [/] is bound to a zone [P] [Z] --remove-source=[/] Remove binding of [/] from a zone [P] [Z] Direct Options --direct First option for all direct options --get-all-chains Get all chains [P] --get-chains {ipv4|ipv6|eb} Get all chains added to the table [P] --add-chain {ipv4|ipv6|eb}
Add a new chain to the table [P] --remove-chain {ipv4|ipv6|eb}
Remove the chain from the table [P] --query-chain {ipv4|ipv6|eb}
Return whether the chain has been added to the table [P] --get-all-rules Get all rules [P] --get-rules {ipv4|ipv6|eb}
Get all rules added to chain in table [P] --add-rule {ipv4|ipv6|eb}
... Add rule to chain in table [P] --remove-rule {ipv4|ipv6|eb}
... Remove rule with priority from chain in table [P] --remove-rules {ipv4|ipv6|eb}
Remove rules from chain in table [P] --query-rule {ipv4|ipv6|eb}
... Return whether a rule with priority has been added to chain in table [P] --passthrough {ipv4|ipv6|eb} ... Pass a command through (untracked by firewalld) --get-all-passthroughs Get all tracked passthrough rules [P] --get-passthroughs {ipv4|ipv6|eb} ... Get tracked passthrough rules [P] --add-passthrough {ipv4|ipv6|eb} ... Add a new tracked passthrough rule [P] --remove-passthrough {ipv4|ipv6|eb} ... Remove a tracked passthrough rule [P] --query-passthrough {ipv4|ipv6|eb} ... Return whether the tracked passthrough rule has been added [P] Lockdown Options --lockdown-on Enable lockdown. --lockdown-off Disable lockdown. --query-lockdown Query whether lockdown is enabled Lockdown Whitelist Options --list-lockdown-whitelist-commands List all command lines that are on the whitelist [P] --add-lockdown-whitelist-command= Add the command to the whitelist [P] --remove-lockdown-whitelist-command= Remove the command from the whitelist [P] --query-lockdown-whitelist-command= Query whether the command is on the whitelist [P] --list-lockdown-whitelist-contexts List all contexts that are on the whitelist [P] --add-lockdown-whitelist-context= Add the context context to the whitelist [P] --remove-lockdown-whitelist-context= Remove the context from the whitelist [P] --query-lockdown-whitelist-context= Query whether the context is on the whitelist [P] --list-lockdown-whitelist-uids List all user ids that are on the whitelist [P] --add-lockdown-whitelist-uid= Add the user id uid to the whitelist [P] --remove-lockdown-whitelist-uid= Remove the user id uid from the whitelist [P] --query-lockdown-whitelist-uid= Query whether the user id uid is on the whitelist [P] --list-lockdown-whitelist-users List all user names that are on the whitelist [P] --add-lockdown-whitelist-user= Add the user name user to the whitelist [P] --remove-lockdown-whitelist-user= Remove the user name user from the whitelist [P] --query-lockdown-whitelist-user= Query whether the user name user is on the whitelist [P] Panic Options --panic-on Enable panic mode --panic-off Disable panic mode --query-panic Query whether panic mode is enabled ==== Referências ==== - [[https://fedoraproject.org/wiki/Features/FirewalldRichLanguage]] - [[http://www.tecmint.com/configure-firewalld-in-centos-7/]] - [[https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Using_Firewalls.html]] - [[https://fedoraproject.org/wiki/FirewallD]]