forked from linux/documentation
62 lines
1.8 KiB
Markdown
62 lines
1.8 KiB
Markdown
# Firewall Configuration
|
|
|
|
On RHEL 9, the default and recommended system firewall is **firewalld**. firewalld relies on the modern nftables kernel framework as its underlying packet-filtering backend (which completely replaces the legacy iptables). In almost all situations, you should manage your firewall via firewalld rather than writing raw nftables rules directly.
|
|
|
|
## Configuration
|
|
|
|
To configure firewalld using a configuration file rather than executing multiple CLI commands, you will want to leverage Zones.
|
|
By default, firewalld looks at XML configuration files located in /etc/firewalld/zones/. Any file placed here overrides the system defaults and takes effect as a permanent configuration.
|
|
|
|
By default, RHEL 9 assigns network interfaces to the public zone.
|
|
E.g. to restrict external access except SSH, one needs to create a custom XML configuration for the public zone - `/etc/firewalld/zones/public.xml`.
|
|
|
|
Example:
|
|
|
|
```xml
|
|
<?xml version="1.0" encoding="utf-8"?>
|
|
<zone>
|
|
<short>Public</short>
|
|
<description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
|
|
<service name="ssh"/>
|
|
</zone>
|
|
```
|
|
|
|
|
|
|
|
## Commandline Interface
|
|
|
|
Enable and start the firewalld service:
|
|
|
|
```bash
|
|
systemctl enable firewalld
|
|
systemctl start firewalld
|
|
```
|
|
|
|
Check the status of firewalld with the following command:
|
|
|
|
```bash
|
|
systemctl status firewalld
|
|
```
|
|
|
|
View your active zone and rules:
|
|
|
|
```bash
|
|
firewall-cmd --list-all
|
|
# Only show rules for the public zone
|
|
firewall-cmd --zone=public --list-all
|
|
```
|
|
|
|
Allow a predefined service permanently (e.g., HTTPS):
|
|
|
|
```bash
|
|
firewall-cmd --add-service=https --permanent
|
|
firewall-cmd --reload
|
|
```
|
|
|
|
Open a custom port permanently (e.g., TCP port 8080):
|
|
|
|
```bash
|
|
firewall-cmd --add-port=8080/tcp --permanent
|
|
firewall-cmd --reload
|
|
```
|