The nftables packet classification framework builds on the netfilter framework to apply firewall rules to network traffic. In Red Hat Enterprise Linux 9, the nftables framework is the system firewall core, and it replaces the deprecated iptables framework.

The nftables framework provides many advantages over iptables, including improved usability and more efficient rule sets. For example, the iptables framework required a rule for each protocol, but nftables rules can apply to both IPv4 and IPv6 traffic simultaneously. The iptables framework required using different tools, such as iptables, ip6tables, arptables, and ebtables, for each protocol. By contrast, the nftables framework uses the single nft user-space utility to manage all protocols through a single interface.

The firewalld service is a dynamic firewall manager, and is the recommended front end to the nftables framework. The Red Hat Enterprise Linux 9 distribution includes the firewalld package.

The firewalld service simplifies firewall management by classifying network traffic into zones. A network packet's assigned zone depends on criteria such as the source IP address of the packet or the incoming network interface. Each zone has its own list of ports and services that are either open or closed.

The firewalld service ensures the source address for every incoming packet into the system. If that source address is assigned to a specific zone, then the rules for that zone apply. If the source address is not assigned to a zone, then the firewalld service associates the packet with the zone for the incoming network interface, and the rules for that zone apply. If the network interface is not associated with a zone, then the firewalld service sends the packet to the default zone.

The default zone is not a separate zone but rather an assigned designation to an existing zone. Initially, the firewalld service designates the public zone as default, and maps the lo loopback interface to the trusted zone.

Most zones allow traffic through the firewall if it matches a list of particular ports and protocols, such as 631/udp, or a predefined service configuration, such as ssh. Normally, if the traffic does not match a permitted port and protocol or service, then it is rejected. The trusted zone, which permits all traffic by default, is an exception.

The firewalld service uses predefined zones, which you can customize. By default, all zones allow any incoming traffic that is part of an existing session that system initiated, and also allow all outgoing traffic. The following table details the initial zone configuration.

For a list of available predefined zones and their intended use, see the firewalld.zones(5) man page.

The firewalld service includes predefined configurations for common services, to simplify setting firewall rules. For example, instead of researching the relevant ports for an NFS server, use the predefined nfs configuration create rules for the correct ports and protocols. The following table lists some predefined service configurations that might be active in your default firewalld zone.

The firewalld package includes many predefined service configurations. You can list the services with the firewall-cmd --get-services command.

[root@host ~]# firewall-cmd --get-services
RH-Satellite-6 RH-Satellite-6-capsule amanda-client amanda-k5-client amqp amqps
apcupsd audit bacula bacula-client bb bgp bitcoin bitcoin-rpc bitcoin-testnet
bitcoin-testnet-rpc bittorrent-lsd ceph ceph-mon cfengine cockpit collectd
...output omitted...

If the predefined service configurations are not appropriate for your scenario, then you can manually specify the required ports and protocols. You can use the web console graphical interface to review predefined services and manually define more ports and protocols.

To manage firewall services with the web console, you must log in and escalate privileges. You can escalate privileges by clicking the Limited access or Turn on administrative access buttons. Then, enter your password when prompted. The administrative mode elevates privileges based on your user's sudo configuration. As a security reminder, remember to toggle back to limited access mode after you perform the system task that requires administrative privileges.

Click the Networking option in the left navigation menu to display the Firewall section in the main networking page. Click the Edit rules and zones button zones to navigate to the Firewall page.

Figure 15.1: The web console networking page

The Firewall page displays active zones and their allowed services. Click the arrow (>) button to the left of a service name to view its details. To add a service to a zone, click the Add services button in the upper right corner of the applicable zone.

Figure 15.2: The web console firewall page

The Add Services page displays the available predefined services.

Figure 15.3: The web console add services menu

To select a service, scroll through the list or enter a selection in the Filter services text box. In the following example, the http string filters the options to web-related services. Select the checkbox to the left of the service to allow it through the firewall. Click the Add services button to complete the process.

Figure 15.4: The web console add services menu options

The interface returns to the Firewall page, where you can review the updated allowed services list.

Figure 15.5: The web console firewall overview

The firewall-cmd command interfaces with the firewalld daemon. It is installed as part of the firewalld package, and is available for administrators who prefer to work on the command line, for working on systems without a graphical environment, or for scripting a firewall setup.

The following table lists often use firewall-cmd commands, along with an explanation. Most commands work on the runtime configuration, unless the --permanent option is specified. If the --permanent option is specified, then you must activate the setting by also running the firewall-cmd --reload command, which reads the current permanent configuration and applies it as the new runtime configuration. Many of the listed commands take the --zone=ZONE option to find which zone they affect. Where a netmask is required, use CIDR notation, such as 192.168.1/24.

The following example sets the default zone to dmz, assigns all traffic coming from the 192.168.0.0/24 network to the internal zone, and opens the network ports for the mysql service on the internal zone.

[root@host ~]# firewall-cmd --set-default-zone=dmz
[root@host ~]# firewall-cmd --permanent --zone=internal \
--add-source=192.168.0.0/24
[root@host ~]# firewall-cmd --permanent --zone=internal --add-service=mysql
[root@host ~]# firewall-cmd --reload

As another example, to add all the incoming traffic from the 172.25.25.11 single IPv4 address to the public zone, use the following commands:

[root@host ~]# firewall-cmd --permanent --zone=public \
--add-source=172.25.25.11/32
[root@host ~]# firewall-cmd --reload