Tag: firewalld

  • Allow PPTP VPN connection on firewalld

    Allow PPTP VPN connection on firewalld

    To allow PPTP VPN connection when using firewalls, run the following commands.

    Allow 1723/tcp

    sudo firewall-cmd --permanent --zone=public --add-port=1723/tcp

    Allow gre protocol

    firewall-cmd --permanent --add-rich-rule='rule protocol value="gre" accept'

    or

    sudo firewall-cmd --permanent --zone=public --direct --add-rule ipv4 filter INPUT 0 -p gre -j ACCEPT
sudo firewall-cmd --permanent --zone=public --direct --add-rule ipv6 filter INPUT 0 -p gre -j ACCEPT

    Enable IP masquerade

    sudo firewall-cmd --permanent --zone=public --add-masquerade

    Reload firewall.

    sudo firewall-cmd --reload

    See firewalld

  • Firewalld

    firewall-cmd is used to manage firewall (iptables). It is used by default on latest version of CentOS, RHEL.

      Check firewall status

      To see if firewall is running of not use

      firewall-cmd --state

      or

      systemctl status firewalld

      To disable firewalls

      systemctl stop firewalld
systemctl disable firewalld

      Open a port in firewall

      To allow HTTP and HTTPS traffic, run

      firewall-cmd --permanent --zone=public --add-service=http
firewall-cmd --permanent --zone=public --add-service=https
firewall-cmd --permanent --zone=public --add-service=ssh
firewall-cmd --permanent --zone=public --add-port=25/tcp
firewall-cmd --reload

      Permanent option make the changes permanant. You need to reload firewall after using –permanent. If you want to open a port in current session and make it permanant, run the command with and with out –permanent.

      Open a port range in firewall

      firewall-cmd --zone=public --add-port=22-65535/tcp

      Close a port in firewall

      To close a port, you can use command same as you open with –add replaced with –remove.

      firewall-cmd --permanent --zone=public --remove-service http
firewall-cmd --permanent --zone=public --remove-port 25/tcp

      Whitelist an IP address

      firewall-cmd --zone=trusted --add-source=IP_ADDR_HERE

      To remove an IP, use

      firewall-cmd --zone=trusted --remove-source=IP_ADDR_HERE

      Firewalld Zones

      Zone is a collection of rules that can be applied to a specific interface. Some useful commands are

      firewall-cmd --get-active-zones
firewall-cmd --get-default-zone
firewall-cmd --list-all-zones
firewall-cmd --info-zone=public

      Zones are stored in /usr/lib/firewalld/zones

      Services

      Services are pre-made rules for a specific application. Some useful commands are

      firewall-cmd --get-services
firewall-cmd --info-service SERVICE_NAME_HERE

      Services are stoed in /usr/lib/firewalld/services/ or /etc/firewalld/services/.

      Save run time configuration into permanant

      firewall-cmd --runtime-to-permanent

      iptables

      See firewall

    • Firewalld list all open ports

      Firewalld list all open ports

      To list all open ports in firealld, run

      firewall-cmd --list-ports

      You may need to also use 

      [root@oc1 ~]# firewall-cmd --list-services
http https ssh
[root@oc1 ~]#

      Example

      firewalld list ports

      See firewalld

    • Firewalld list rules

      To list rules use command

      firewall-cmd --list-all --zone=public

      To list all open ports

      firewall-cmd --list-ports

      Example

      [root@centos7 zones]# firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="10.1.1.2/32" port protocol="tcp" port="1-65535" accept'
success
[root@centos7 zones]# firewall-cmd --list-all --zone=public
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0 eth1
  sources: 
  services: dhcpv6-client ssh
  ports: 25/tcp 9090/tcp
  protocols: 
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 
        rule family="ipv4" source address="10.1.1.2/32" port port="1-65535" protocol="tcp" accept
[root@centos7 zones]# firewall-cmd --zone=public --remove-rich-rule='rule family="ipv4" source address="10.1.1.2/32" port protocol="tcp" port="1-65535" accept'                                            
success
[root@centos7 zones]# firewall-cmd --list-all --zone=public
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0 eth1
  sources: 
  services: dhcpv6-client ssh
  ports: 25/tcp 9090/tcp
  protocols: 
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 

[root@centos7 zones]#

      See firewall-cmd