Objectives

After completing this section, students should be able to configure a basic firewall.

Netfilter and firewalld concepts

The Linux kernel includes a powerful network filtering subsystem, netfilter. The netfilter subsystem allows kernel modules to inspect every packet traversing the system. This means any incoming, outgoing, or forwarded network packet can be inspected, modified, dropped, or rejected in a programmatic way, before reaching components in user space. This is the main building block for building a firewall on a Red Hat Enterprise Linux 7 machine.

Interacting with netfilter

Although it is theoretically possible for system administrators to write their own kernel modules to interact with netfilter, this is typically not done. Instead, other programs are used to interact with netfilter. One of the most common and well-known of these programs is iptables. In previous Red Hat Enterprise Linux releases, iptables was the main method of interacting with the kernel netfilter subsystem.

The iptables command is a low-level tool, and it can be challenging to correctly manage firewalls with that tool. In addition, it only adjusts IPv4 firewall rules. Other utilities, such as ip6tables for IPv6 and ebtables for software bridges, need to be used for more complete firewall coverage.

Introducing firewalld

In Red Hat Enterprise Linux 7 a new method of interacting with netfilter has been introduced: firewalld. firewalld is a system daemon that can configure and monitor the system firewall rules. Applications can talk to firewalld to request ports to be opened using the DBus messaging system, a feature which can be disabled or locked down). It both covers IPv4, IPv6, and potentially ebtables settings. The firewalld daemon is installed from the firewalld package. This package is part of a base install, but not part of a minimal install.

firewalld simplifies firewall management by classifying all network traffic into zones. Based on criteria such as the source IP address of a packet or the incoming network interface, traffic is then diverted into the firewall rules for the appropriate zone. Each zone can have its own list of ports and services to be opened or closed.

Every packet that comes into the system will first be checked for its source address. If that source address is tied to a specific zone, the rules for that zone will be parsed. If the source address is not tied to a zone, the zone for the incoming network interface will be used.

If the network interface is not associated with a zone for some reason, the default zone will be used. The default zone is not a separate zone itself; it is one of the other zones. The public zone is used by default, but this can be changed by a system administrator.

Most zones will allow traffic through the firewall which matches a list of particular ports and protocols ("631/udp") or pre-defined services ("ssh"). If the traffic does not match a permitted port/protocol or service, it will generally be rejected. (The trusted zone, which permits all traffic by default, is one exception to this.)

Pre-defined zones

firewalld ships with a number of pre-defined zones, suitable for various purposes. The default zone is set to public and interfaces are assigned to public if no changes are made. The lo interface is treated as if it were in the trusted zone. The following table details the configuration of these zones on installation, but the system administrator may then customize these zones to have different settings. By default, all zones permit any incoming traffic which is part of a communication initiated by the system, and all outgoing traffic.

For a list of all available pre-defined zones and their intended uses, consult the firewalld.zones(5) manual page.

Pre-defined services

firewalld also ships with a number of pre-defined services. These service definitions can be used to easily permit traffic for particular network services to pass through the firewall. The following table details the configuration of the pre-defined services used in the default configuration of the firewall zones.

Configure firewall settings

There are three main ways for system administrators to interact with firewalld:

Configure firewall settings with firewall-config

firewall-config is a graphical tool that can be used to alter and inspect both the running, in-memory configuration for firewalld, as well as the persistent, on-disk configuration. The firewall-config tool can be installed from the firewall-config package.

Once installed, firewall-config can be launched from the command line as firewall-config, or from the Applications menu under Applications → Sundry → Firewall. If firewall-config is started by an unprivileged user, it will prompt for the root password to continue.

Figure 14.1: The main firewall configuration screen

On the main screen of firewall-config, a system administrator can select between modifying the current, in-memory configuration, or the persistent, on-disk configuration that will be used after a restart/reload of firewalld. This is achieved with the Configuration dropdown menu. In most cases, system administrators will want to adjust the persistent (Permanent) configuration, and then use the Options → Reload Firewalld menu entry to activate their changes.

To modify a zone, select the zone in the Zone menu on the left. Network interfaces and source IP addresses/ranges can be assigned in the Interfaces and Sources tabs on the right, respectively.

Ports can be opened by either putting a checkmark in front of them in the Services tab, or by adding a new port in the Ports tab for that zone.

If a specific set of ports has to be opened in multiple zones, a system administrator can also define a service for those ports. This can be done in the Services tab at the top of the window.

The default zone for otherwise unspecified connections can be changed under Options → Change Default Zone.

Configure firewall settings with firewall-cmd

For those system administrators who prefer to work on the command line or who can not use a graphical environment for any reason, there is also a command-line client to interact with firewalld, firewall-cmd.

firewall-cmd is installed as part of the main firewalld package. firewall-cmd can perform the same actions that firewall-config can.

The following table lists a number of frequently used firewall-cmd commands, along with an explanation. Note that unless otherwise specified, almost all commands will work on the runtime configuration, unless the --permanent option is specified. Many of the commands listed take the --zone=<ZONE> option to determine which zone they affect.

firewall-cmd example

The following examples show the default zone being set to dmz, all traffic coming from the 192.168.0.0/24 network being assigned to the internal zone, and the network ports for mysql being opened on the internal zone.

[root@serverX ~]# firewall-cmd --set-default-zone=dmz
[root@serverX ~]# firewall-cmd --permanent --zone=internal --add-source=192.168.0.0/24
[root@serverX ~]# firewall-cmd --permanent --zone=internal --add-service=mysql
[root@serverX ~]# firewall-cmd --reload