firewalld rules list

3 min read 16-10-2024

Mastering Firewalld: A Comprehensive Guide to Firewall Rules and Lists

Firewalld, a powerful and user-friendly firewall daemon for Linux, plays a crucial role in securing your system by controlling network traffic. One of its key functionalities is the use of firewall rules and lists to define precise access policies. This article will delve into the world of Firewalld rules and lists, providing a comprehensive understanding of how they work and how to leverage them effectively.

What are Firewalld Rules?

Firewall rules are the building blocks of your security policy. Each rule defines a specific action that Firewalld should take when a particular network connection attempts to pass through it. The key components of a firewall rule include:

Zone: The network zone (e.g., "public", "dmz", "internal") to which the rule applies.
Service: The service (e.g., "http", "ssh", "https") that the rule should allow or block.
Port: The specific port number (e.g., 80, 443) that the rule targets.
Source Address: The IP address or network range from which the connection originates.
Destination Address: The IP address or network range to which the connection is directed.
Protocol: The network protocol (e.g., TCP, UDP) being used.
Action: The action Firewalld should take, such as "accept", "reject", "drop", or "masquerade".

What are Firewalld Lists?

Firewalld lists are a powerful mechanism to group related addresses, services, or ports together, simplifying the management of rules. Lists allow you to easily reuse these groups in multiple rules, reducing redundancy and making your firewall configuration more organized.

Types of Firewalld Lists:

Address Lists: Used to group IP addresses or network ranges.
Service Lists: Used to group services, such as HTTP, SSH, or FTP.
Port Lists: Used to group specific port numbers.

Creating and Managing Firewalld Rules

Using the firewall-cmd Command:

Firewalld provides a command-line tool called firewall-cmd for managing rules and lists. Here are some common commands:

Adding a rule:

firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" accept'

This command adds a rule that allows traffic from the 192.168.1.0/24 network to the "public" zone.

Adding to a list:

firewall-cmd --permanent --new-address-list=trusted
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/24" accept' --list=trusted

This creates a new address list called "trusted" and adds the 10.0.0.0/24 network to it.

Using lists in rules:

firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="@trusted" accept'

This rule allows traffic from any address in the "trusted" list to the "public" zone.

Using Firewalld's graphical interface:

Firewalld also offers a user-friendly graphical interface for managing rules and lists. You can access it through the firewalld-config command or your system's graphical settings menu.

Examples and Use Cases

Example 1: Allowing SSH access from a specific IP:

firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.10" port protocol="tcp" port="22" accept'

This rule allows SSH access (port 22) from the IP address 192.168.1.10 to the "public" zone.

Example 2: Blocking HTTP traffic from a specific country:

firewall-cmd --permanent --new-address-list=blocked_countries
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.0.0/24" port protocol="tcp" port="80" reject' --list=blocked_countries
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.0.0/24" port protocol="tcp" port="80" accept'

This example creates a list of blocked countries, defines a rule that blocks HTTP traffic from those countries, and then allows all other HTTP traffic.

Best Practices for Firewalld Rules and Lists

Start with a secure default: Always begin with a default configuration that restricts access as much as possible.
Use specific rules: Avoid using overly broad rules that could allow unwanted traffic.
Use lists wisely: Create separate lists for different types of addresses, services, or ports to simplify management.
Document your rules: Maintain detailed documentation of your firewall rules and lists for easy troubleshooting and maintenance.
Test thoroughly: Test your firewall changes in a controlled environment before deploying them to production.
Stay informed: Keep up-to-date with the latest security best practices and Firewalld documentation to ensure your system remains secure.

Conclusion

Firewalld rules and lists offer a powerful and flexible way to manage network traffic and secure your system. By understanding their principles and best practices, you can configure a robust and effective firewall that safeguards your network and data. Remember to carefully document your rules, test them thoroughly, and stay updated on the latest security recommendations to ensure your firewall remains effective.