firewallD

-- INFO - COMMAND EXAMPLES - HOW to - Content Files -- LINKS --

Info

drop: The lowest level of trust.
All incoming connections are dropped without reply and only outgoing connections are possible.
block: Similar to the above.
Instead of simply dropping connections, incoming requests are rejected with an icmp-host-prohibited or icmp6-adm-prohibited message.
public: Represents public, untrusted networks.
You don’t trust other computers but may allow selected incoming connections on a case-by-case basis.
external: External networks in the event that you are using the firewall as your gateway.
It is configured for NAT masquerading so that your internal network remains private but reachable.
internal: The other side of the external zone, used for the internal portion of a gateway.
The computers are fairly trustworthy and some additional services are available.
dmz: Used for computers located in a DMZ
(isolated computers that will not have access to the rest of your network). Only certain incoming connections are allowed.
work: Used for work machines.
Trust most of the computers in the network. A few more services might be allowed.
home: A home environment.
It generally implies that you trust most of the other computers and that a few more services will be accepted.
trusted: Trust all of the machines in the network.
The most open of the available options and should be used sparingly.

Command Examples

Status firewallD	:	`firewall-cmd --state`

List Zones	:	`firewall-cmd --get-default-zone`
List ALL Zones	:	`firewall-cmd --get-zones`
List Network Interface associated	:	`firewall-cmd --get-active-zones`

List Everything	:	`firewall-cmd --list-all`

Reload after a change	:	`firewall-cmd --reload`

List ICMP Types Internet Control Message Protocol	:	`firewall-cmd --get-icmptypes`

List ALL Services	:	`firewall-cmd --get-services` `firewall-cmd --get-services \|sed "s/ /\\n/g" \| more`
		Look in `/usr/lib/firewalld/services` for particulars on each service.

Add a service	:	`firewall-cmd --zone=public --permanent --add-service=<service name>`

Add a Port	:	`firewall-cmd --zone=public --add-port=1501/tcp --permanent`
		Example: Add DSMC permanent

Open Port for an IP	:	`firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="1.2.3.4/32" port protocol="tcp" port="4567" accept'`

Whitelist IP range and one IP	:	`firewall-cmd --permanent --zone=public --add-source=192.168.1.0/24 firewall-cmd --permanent --zone=public --add-source=192.168.1.25/32`
Look at what is in public zone	:	`firewall-cmd --zone=public --list-all`

How To

> TOP

on the server:
    -what rules in firewalld
        firewall-cmd --list-all

    - what ports are open
        netstat -tulpn | grep LISTEN
        nmap localhost

outside the server
    -- what is seen off the server
            nmap 

add a port
    - the nmap gives a port that is being use by an application|program with the type tcp/ucp
    - to add a tcp port
        firewall-cmd --permanent --add-port=/tcp
        firewall-cmd --reload
        firewall-cmd --list-all
    - test if the new port is working from the outside (like with tomcat web pages)       

Repeat from < TOP 

FILES/etc/firewalld/zones
/usr/lib/firewalld/zones

LINKS
an-introduction-to-firewalld

Good Setup and Use Page

Firewalld Cheat Sheet

https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/sec-viewing_current_status_and_settings_of_firewalld

www.digitalocean.com/community/tutorials/how-to-set-up-a-firewall-using-firewalld-on-centos-7

https://fedoraproject.org/wiki/FirewallD?rd=FirewallD/