firewalld zones

 https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/sec-working_with_zones

firewald quick guide

Now you can start configuring firewalld.

• Allow or deny a port
• Allow or deny a protocol
• Allow or deny a service
• Bind to an ethernet interface
• IP address masquerade
• Lockdown
• Port forwarding
• Zones

---

Getting Started with the firewall-cmd commandGetting Started with the firewall-config commandfirewall-cmdfirewall-cmd - allow certain IP addresses (source)firewall-cmd - allow or deny a portfirewall-cmd - allow or deny a protocolfirewall-cmd - allow or deny a servicefirewall-cmd - allow or deny ICMPfirewall-cmd - bind an ethernet interface to a zonefirewall-cmd - IP address masqueradefirewall-cmd - lockdownfirewall-cmd - port forwardfirewall-cmd - reload firewalldfirewall-cmd - rich rulefirewall-cmd - zones

 

http://www.freekb.net/Articles?tag=Firewalld

Open a Port or Service firewalld

There are different ways to open up a port (range) or service. These ways depend on the use case and the number of changes that are needed to make it work.

A simple port number or port range can be used in the cases where no additional changes are needed. For example, with opening port 80/tcp to allow access to a local http servicer on the standard port. For most of the more important services there is already a service defined in firewalld. Then there is no need to know about the default port number(s). The service can then simply be enabled in the used zone.

If there is a need to open different ports or to do additional changes, then using a service might be simpler. If you need to add a new or custom service, then please have a look at the howto “Add a Service”. It is also possible to adapt a builtin service according to the user’s needs, for example to change one of the used ports. But it is recommended to generate a new service in this case to make it more obvious that the service has been customized.

How to open port 80/tcp with firewall-cmd:

firewall-cmd --zone=public --add-port=80/tcp

This will open the port 80 with protocol tcp in the public zone of the runtime environment. The runtime environment is only effective until the machine has been rebooted or the firewalld service has been restarted. The zone option can be omitted here if the port should be added to the default zone.

firewall-cmd --permanent --zone=public --add-port=80/tcp

If you want to make this a permanent change also, then open the port also in the permanent environment. This means the port will be open also after a system reboot or firewalld service reload.

How to open a service with firewall-cmd:

firewall-cmd --zone=public --add-service=http

This opens the service in the public zone of the runtime environment.

firewall-cmd --permanent --zone=public --add-service=http

This also opens the service in public zone of the permanent environment.

Firewalld config

 https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/using-and-configuring-firewalld_configuring-and-managing-networking

Failed to start firewalld service unit is masked – How we fix it!

 

by Adarsh M | Jan 23, 2020

Are you stuck with failed to start firewalld service unit is masked? We can help you fix it.

Masking the firewall service will stop it from automatically starting.

Here at Bobcares, we often receive requests regarding firewalld as a part of our Server Management Services.

Today, let’s see how our Support Engineers fix the errors related to firewalld.

 

Causes for failed to start firewalld service unit is masked

We mask the firewall to prevent the firewall from starting from other services.

This error occurs when we try to enable the firewalld that is masked.

The error can also occur if the mask symbolic link is broken.

We resolve the error by unmasking the firewalld and starting the service.

 

How to fix failed to start firewalld service unit is masked?

Recently one of our customers contacted us saying he was unable to enable firewalld in the server. And also was getting the same error.

Now let’s discuss how our Support Engineers resolve the error for our customers.

 

Unmask

On analyzing the firewalld service we found a mask firewall set. Thus to resolve the error we unmask the firewalld service. We can enable the firewall service if it is not masked.

To unmask the service we use the command

systemctl unmask --now firewalld

After executing the command we get the output as

Now we enable the firewalld service using the command

systemctl enable firewalld

Finally, we start the firewalld service using the command

systemctl start firewalld

 

Mask link is broken

One of the common reasons for the error is when starting the service the masked link is broken. Thus we need to link the mask location once again to resolve the error.

To unmask the service we use the command.

systemctl unmask firewalld

Thus, if the service still fails to unmask we need to manually mask it first. The location will change based on the Linux flavors.

ln -s /etc/systemd/system/firewalld.service /dev/null

Thus we unmask it. Then we start the service using the command

systemctl start firewalld

Finally, we find the status using

firewall-cmd --state

 

Failed to start firewalld service

If the above solution did not fix the error. We need to analyze the logs to determine more details about the error.

Our Support Engineers find more information using the command

systemctl status firewalld.service

We find further information from journalctl -xn

Thus, our Support Engineers find the reason for the error and resolve the error accordingly.

 

Opensuse iptables

 systemctl stop firewalld

systemctl disable firewalld
zypper in iptables

iptables -I INPUT 2 -m state --state NEW,RELATED,ESTABLISHED -m udp -p udp --dport 5060 -j DROP

https://gist.github.com/ambiorixg12/931f70818752aff5c602b83c055c9726

Use iptables with CentOS 7

Beginning with Red Hat® Enterprise Linux® (RHEL) 7 and CentOS® 7, firewalld is available for managing iptables. As a result, you either need to use firewall-cmd commands, or disable firewalld and enable iptables. This article shows you how to use the classic iptables setup.

Stop and mask the firewalld service

Run the following commands to stop and mask the firewalld service that you don’t want to use:

$ systemctl stop firewalld
$ systemctl mask firewalld

Install and configure iptables

Use the following steps to install and configure iptables:

1. Install the iptables-services package (if it is not already installed) by running the following command:

   $ yum install iptables-services
   

2. Enable the service to start at boot time by running the following commands:

   $ systemctl enable iptables
   $ systemctl enable ip6tables
   

3. Next, add iptables rules. You can do this in either of the following ways:
   • From the command-line interface (CLI), by running commands similar to iptables -I INPUT ...
   • By creating or editing your /etc/sysconfig/iptables file to look similar to the following basic example, which leaves ports 22 and 80 open:

     $ cat /etc/sysconfig/iptables
     *filter
     :INPUT ACCEPT [0:0]
     :FORWARD ACCEPT [0:0]
     :OUTPUT ACCEPT [214:43782]
     -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
     -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
     -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
     -A INPUT -i lo -j ACCEPT
     -A INPUT -j REJECT --reject-with icmp-port-unreachable
     COMMIT
     
     $cat /etc/sysconfig/ip6tables
     
     *filter
     :INPUT ACCEPT [0:0]
     :FORWARD ACCEPT [0:0]
     :OUTPUT ACCEPT [214:43782]
     -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
     -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
     -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
     -A INPUT -i lo -j ACCEPT
     -A INPUT -j REJECT --reject-with icmp6-adm-prohibited
     COMMIT
     

4. (Optional) If you are saving your rules in the /etc/sysconfig/ip{,6}tables files, you must also run the following commands:

   $ systemctl restart iptables
   $ systemctl restart ip6tables
   

5. Next, check that the iptables service is active by running the following commands:

   $ systemctl status iptables
   $ systemctl status ip6tables
   

6. Check your iptables rules by running the following commands:

   $ iptables -L
   $ ip6tables -L
   

7. Verify that your server is listening on the ports that you opened (22 and 80 in the above example) by running the following command:

   $ netstat -plant
   

8. Query the systemd journal for a log of the changes that you made to the iptables service by running the following commands:

   $ journalctl -f -u iptables.service
   $ journalctl -f -u ip6tables.service
   

9. Reboot the server. The iptables rules should be saved and automatically reloaded.

Share this information: