Zones and services

A firewall decides which network traffic may reach your machine. On RHEL that job belongs to firewalld. Before opening anything, you need two ideas: a zone is a set of rules for a level of trust, and a service is a named bundle of ports you can allow inside a zone.

Check that firewalld runs and read the active zone with firewall-cmd --list-all.
Explain how a packet is assigned to a zone: source, then interface, then default.
Allow a service and verify it from another machine.

Zones: rules for a level of trust

A zone is a named rule set. The built-in ones range from drop (discard everything) through public (the default; only ssh and a few services) to trusted (accept everything). Each interface, and optionally each source address, is assigned to one zone. Traffic is judged only by the rules of its zone.

Which zone decides?: Step through a packet arriving at servera.

Look at a fresh system:

[root@servera ~]# firewall-cmd --state
running
[root@servera ~]# firewall-cmd --get-default-zone
public
[root@servera ~]# firewall-cmd --get-active-zones
public
  interfaces: enp1s0
[root@servera ~]# firewall-cmd --get-zones
block dmz drop external home internal nm-shared public trusted work

Only zones that have an interface or source are active. A rule added to an inactive zone changes nothing you can test.

Reading the zone

--list-all prints everything the zone does. Select a line:

Reading firewall-cmd --list-all: Select a line of the output.

[root@servera ~]# firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: enp1s0
  sources: 
  services: cockpit dhcpv6-client ssh
  ports: 
  protocols: 
  forward: yes
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules:

Services are definitions, not daemons

firewall-cmd --get-services lists more than two hundred names, and --info-service=http shows what one stands for:

[root@servera ~]# firewall-cmd --info-service=http
http
  ports: 80/tcp
  protocols: 
  source-ports: 
  modules: 
  destination: 
  includes: 
  helpers:

Allowing a service

[root@servera ~]# firewall-cmd --permanent --add-service=http
success
[root@servera ~]# firewall-cmd --reload
success
[root@servera ~]# firewall-cmd --list-services
cockpit dhcpv6-client http ssh
[root@servera ~]# firewall-cmd --query-service=http
yes

--permanent saves the rule and --reload loads it. The next lesson explains why both steps exist. Remove a rule with --remove-service=http, the same way.

Try it

Check your understanding

A packet comes from an address listed as the source of the zone work, on an interface in the zone public. Which zone judges it?
What is a firewalld service?
Which command shows everything the active zone allows?
A client gets "No route to host" from a web server whose httpd is running. Most likely cause?
What does the target "default" mean for traffic nothing allows?
Which command lists the zone names that exist?