Tag: firewalld

  • Allow PPTP VPN connection on firewalld

    Allow PPTP VPN connection on firewalld

    To allow PPTP VPN connection when using firewalls, run the following commands.

    Allow 1723/tcp

    sudo firewall-cmd --permanent --zone=public --add-port=1723/tcp

    Allow gre protocol

    firewall-cmd --permanent --add-rich-rule='rule protocol value="gre" accept'

    or

    sudo firewall-cmd --permanent --zone=public --direct --add-rule ipv4 filter INPUT 0 -p gre -j ACCEPT
sudo firewall-cmd --permanent --zone=public --direct --add-rule ipv6 filter INPUT 0 -p gre -j ACCEPT

    Enable IP masquerade

    sudo firewall-cmd --permanent --zone=public --add-masquerade

    Reload firewall.

    sudo firewall-cmd --reload

    See firewalld

  • Firewalld

    firewall-cmd is used to manage firewall (iptables). It is used by default on latest version of CentOS, RHEL.

    Check firewall status

    To see if firewall is running of not use

    firewall-cmd --state

    or

    systemctl status firewalld

    To disable firewalls

    systemctl stop firewalld
systemctl disable firewalld

    Open a port in firewall

    To allow HTTP and HTTPS traffic, run

    firewall-cmd --permanent --zone=public --add-service=http
firewall-cmd --permanent --zone=public --add-service=https
firewall-cmd --permanent --zone=public --add-service=ssh
firewall-cmd --permanent --zone=public --add-port=25/tcp
firewall-cmd --reload

    Permanent option make the changes permanant. You need to reload firewall after using –permanent. If you want to open a port in current session and make it permanant, run the command with and with out –permanent.

    Open a port range in firewall

    firewall-cmd --zone=public --add-port=22-65535/tcp

    Close a port in firewall

    To close a port, you can use command same as you open with –add replaced with –remove.

    firewall-cmd --permanent --zone=public --remove-service http
firewall-cmd --permanent --zone=public --remove-port 25/tcp

    Whitelist an IP address

    firewall-cmd --zone=trusted --add-source=IP_ADDR_HERE

    To remove an IP, use

    firewall-cmd --zone=trusted --remove-source=IP_ADDR_HERE

    Firewalld Zones

    Zone is a collection of rules that can be applied to a specific interface. Some useful commands are

    firewall-cmd --get-active-zones
firewall-cmd --get-default-zone
firewall-cmd --list-all-zones
firewall-cmd --info-zone=public

    Zones are stored in /usr/lib/firewalld/zones

    Services

    Services are pre-made rules for a specific application. Some useful commands are

    firewall-cmd --get-services
firewall-cmd --info-service SERVICE_NAME_HERE

    Services are stoed in /usr/lib/firewalld/services/ or /etc/firewalld/services/

    On AlmaLinux 9, cpanel server used following service file

    https://gist.github.com/serverok/4433cbc84b90f41ddf60031896cf8475

    Save run time configuration into permanant

    firewall-cmd --runtime-to-permanent

    iptables

    See firewall

  • Firewalld list all open ports

    Firewalld list all open ports

    To list all open ports in firealld, run

    firewall-cmd --list-ports

    You may need to also use 

    [root@oc1 ~]# firewall-cmd --list-services
http https ssh
[root@oc1 ~]#

    Example

    firewalld list ports

    See firewalld

  • Firewalld list rules

    To list rules use command

    firewall-cmd --list-all --zone=public

    To list all open ports

    firewall-cmd --list-ports

    Example

    [root@centos7 zones]# firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="10.1.1.2/32" port protocol="tcp" port="1-65535" accept'
success
[root@centos7 zones]# firewall-cmd --list-all --zone=public
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0 eth1
  sources: 
  services: dhcpv6-client ssh
  ports: 25/tcp 9090/tcp
  protocols: 
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 
        rule family="ipv4" source address="10.1.1.2/32" port port="1-65535" protocol="tcp" accept
[root@centos7 zones]# firewall-cmd --zone=public --remove-rich-rule='rule family="ipv4" source address="10.1.1.2/32" port protocol="tcp" port="1-65535" accept'                                            
success
[root@centos7 zones]# firewall-cmd --list-all --zone=public
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0 eth1
  sources: 
  services: dhcpv6-client ssh
  ports: 25/tcp 9090/tcp
  protocols: 
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 

[root@centos7 zones]#

    See firewall-cmd