FirewallD provides a way to configure dynamic firewall rules in linux, which can be applied directly without the need to start the firewall, and also supports D-BUS and zone concepts to simplify configuration.

Before executing a FirewallD rule, you must check that the FirewallD service is enabled and running:

# systemctl status firewalld

If FirewallD is started, it is recommended to check all active areas and active services:

# firewall-cmd --get-active-zones

# firewall-cmd --get-services

If you are not familiar with it, you can manage FirewallD from the GUI. You only need to install the GUI package on your system:

# yum install firewalld firewall-config

Make sure to identify which public zone you want to configure the Linux firewall in, and use the following command to list all active services, ports, and richness rules for the public zone:

# firewall-cmd --zone=public --list-all

To open any port for a public area, use the following command. For example, the following command will open port 80 for public areas:

# firewall-cmd --permanent --zone=public --add-port=80/tcp

To remove the added port, simply use the "-remove" option in the firewalld command, as follows:

# firewall-cmd --zone=public --remove-port=80/tcp

After adding or deleting a specific port, you need to use the "-list-ports" option to confirm whether the port is added or deleted:

# firewall-cmd --zone=public --list-ports

By default, FirewallD comes with predefined services, and adding a specific list of services requires creating a new xml file and including all the services in the file, otherwise you have to manually define or delete each service.

#firewall-cmd --zone=public --add-service=ftp

#firewall-cmd --zone=public --remove-service=ftp

#firewall-cmd --zone=public --list-services

If you want to block any incoming or outgoing connections, you need to use panic-on mode to block such requests. If you can delete any existing established connections on your system:

# firewall-cmd --panic-on

When trying to ping any area, use the "-query-panic" option to check that panic mode is enabled, as shown below.

# ping google.com -c 1

# firewall-cmd --query-panic

Did you see in the image above that the panic query shows "unknown host google.com"? Now try disabling panic mode, then ping again and check.

# firewall-cmd --query-panic

# firewall-cmd --panic-off

# ping google.com -c 1

Now this time, there will be a ping request from Google.

Masquerading IP addresses is also a type of network address translation that allows servers to connect to the Internet with the help of underlying machines. If you want to SSH to your home virtual machine from anywhere, just forward SSH port 22 to a different port. Before port forwarding, check that Masquerade is enabled in the external zone because we are accessing the machine from the external network.

# firewall-cmd --zone=external --query-masquerade

If it is not enabled, enable it first:

# firewall-cmd --zone=external --add-masquerade

Then forward all SSH port 22 connections to port 2222 at IP address 192.168.0.132.

# is firewall - CMD - zone = external - add - forward - port port of = = 22: proto = TCP: toport = 2222: toaddr = 192.168.0.132

# firewall-cmd --zone=external --list-all