How to configure zones in firewalld
How to Configure Zones in Firewalld
Table of Contents
1. [Introduction](#introduction)
2. [Prerequisites](#prerequisites)
3. [Understanding Firewalld Zones](#understanding-firewalld-zones)
4. [Default Zones Overview](#default-zones-overview)
5. [Basic Zone Configuration](#basic-zone-configuration)
6. [Advanced Zone Management](#advanced-zone-management)
7. [Practical Examples and Use Cases](#practical-examples-and-use-cases)
8. [Troubleshooting Common Issues](#troubleshooting-common-issues)
9. [Best Practices](#best-practices)
10. [Conclusion](#conclusion)
Introduction
Firewalld is a powerful, dynamic firewall management tool that has become the default firewall solution for many Linux distributions, including Red Hat Enterprise Linux, CentOS, and Fedora. One of its most distinctive features is the concept of zones, which provide a flexible and intuitive way to manage network security policies based on different network environments and trust levels.
This comprehensive guide will teach you everything you need to know about configuring zones in firewalld, from basic concepts to advanced management techniques. You'll learn how to create custom zones, assign network interfaces, manage services and ports, and implement security policies that adapt to different network environments automatically.
Whether you're a system administrator managing enterprise servers or a developer working on network security, understanding firewalld zones is essential for maintaining robust security while ensuring proper network connectivity.
Prerequisites
Before diving into zone configuration, ensure you have the following:
System Requirements
- A Linux system with firewalld installed (RHEL 7+, CentOS 7+, Fedora, or similar)
- Root or sudo privileges
- Basic understanding of networking concepts
- Familiarity with command-line interface
Required Packages
Verify that firewalld is installed and running:
```bash
Check if firewalld is installed
sudo dnf list installed firewalld
Install firewalld if not present
sudo dnf install firewalld
Start and enable firewalld service
sudo systemctl start firewalld
sudo systemctl enable firewalld
Verify firewalld status
sudo systemctl status firewalld
```
Network Information
Gather information about your network setup:
```bash
List network interfaces
ip addr show
Check current zone assignments
sudo firewall-cmd --get-active-zones
View current default zone
sudo firewall-cmd --get-default-zone
```
Understanding Firewalld Zones
What Are Zones?
Zones in firewalld represent different levels of trust for network connections. Each zone defines a set of rules that determine what network traffic is allowed or denied. The concept allows you to easily switch between different security profiles depending on your network environment.
Zone Characteristics
Each zone has the following characteristics:
- Trust Level: Defines how much you trust the network traffic
- Default Behavior: Determines whether traffic is allowed or denied by default
- Services: Predefined service configurations (SSH, HTTP, HTTPS, etc.)
- Ports: Specific port and protocol combinations
- Rich Rules: Advanced rule configurations
- Interface Binding: Network interfaces assigned to the zone
Zone Assignment Logic
Firewalld assigns network traffic to zones based on:
1. Source IP Address: Traffic from specific IP ranges
2. Network Interface: Traffic from specific network interfaces
3. Default Zone: Fallback for unmatched traffic
Default Zones Overview
Firewalld comes with several predefined zones, each designed for specific use cases:
Drop Zone
```bash
View drop zone configuration
sudo firewall-cmd --zone=drop --list-all
```
- Trust Level: No trust
- Default Action: Drop all incoming packets
- Use Case: Maximum security, no services allowed
Block Zone
```bash
View block zone configuration
sudo firewall-cmd --zone=block --list-all
```
- Trust Level: No trust
- Default Action: Reject incoming packets with icmp-host-prohibited
- Use Case: Similar to drop but sends rejection messages
Public Zone
```bash
View public zone configuration
sudo firewall-cmd --zone=public --list-all
```
- Trust Level: Low trust
- Default Action: Reject with exceptions for selected services
- Use Case: Public networks, untrusted environments
- Default Services: SSH, DHCPv6-client
External Zone
```bash
View external zone configuration
sudo firewall-cmd --zone=external --list-all
```
- Trust Level: Low trust
- Default Action: Reject with exceptions, NAT masquerading enabled
- Use Case: External networks with masquerading (router/gateway)
DMZ Zone
```bash
View dmz zone configuration
sudo firewall-cmd --zone=dmz --list-all
```
- Trust Level: Limited trust
- Default Action: Reject with exceptions for selected services
- Use Case: Demilitarized zone, publicly accessible services
- Default Services: SSH
Work Zone
```bash
View work zone configuration
sudo firewall-cmd --zone=work --list-all
```
- Trust Level: Medium trust
- Default Action: Reject with exceptions for work-related services
- Use Case: Work networks
- Default Services: SSH, DHCPv6-client
Home Zone
```bash
View home zone configuration
sudo firewall-cmd --zone=home --list-all
```
- Trust Level: High trust
- Default Action: Reject with exceptions for home services
- Use Case: Home networks
- Default Services: SSH, mDNS, SAMBA-client, DHCPv6-client
Internal Zone
```bash
View internal zone configuration
sudo firewall-cmd --zone=internal --list-all
```
- Trust Level: High trust
- Default Action: Reject with exceptions for internal services
- Use Case: Internal networks
- Default Services: SSH, mDNS, SAMBA-client, DHCPv6-client
Trusted Zone
```bash
View trusted zone configuration
sudo firewall-cmd --zone=trusted --list-all
```
- Trust Level: Full trust
- Default Action: Accept all traffic
- Use Case: Fully trusted networks
Basic Zone Configuration
Viewing Zone Information
Start by examining the current zone configuration:
```bash
List all available zones
sudo firewall-cmd --get-zones
Show active zones with their interfaces and sources
sudo firewall-cmd --get-active-zones
Display detailed information about a specific zone
sudo firewall-cmd --zone=public --list-all
Show the default zone
sudo firewall-cmd --get-default-zone
```
Changing the Default Zone
The default zone handles traffic that doesn't match any specific zone rules:
```bash
Change default zone to home
sudo firewall-cmd --set-default-zone=home
Verify the change
sudo firewall-cmd --get-default-zone
Make the change permanent (automatic with set-default-zone)
sudo firewall-cmd --runtime-to-permanent
```
Assigning Interfaces to Zones
Network interfaces can be assigned to specific zones:
```bash
List current interface assignments
sudo firewall-cmd --get-active-zones
Assign an interface to a zone temporarily
sudo firewall-cmd --zone=home --change-interface=eth0
Make the assignment permanent
sudo firewall-cmd --permanent --zone=home --change-interface=eth0
Reload to apply permanent changes
sudo firewall-cmd --reload
Remove interface from a zone
sudo firewall-cmd --zone=home --remove-interface=eth0
```
Managing Services in Zones
Services are predefined port and protocol combinations:
```bash
List available services
sudo firewall-cmd --get-services
Add a service to a zone
sudo firewall-cmd --zone=public --add-service=http
Add service permanently
sudo firewall-cmd --permanent --zone=public --add-service=http
Remove a service from a zone
sudo firewall-cmd --zone=public --remove-service=http
List services in a zone
sudo firewall-cmd --zone=public --list-services
```
Managing Ports in Zones
For services not predefined, you can open specific ports:
```bash
Add a port to a zone
sudo firewall-cmd --zone=public --add-port=8080/tcp
Add port permanently
sudo firewall-cmd --permanent --zone=public --add-port=8080/tcp
Add multiple ports
sudo firewall-cmd --zone=public --add-port=8080-8090/tcp
Remove a port
sudo firewall-cmd --zone=public --remove-port=8080/tcp
List ports in a zone
sudo firewall-cmd --zone=public --list-ports
```
Advanced Zone Management
Creating Custom Zones
Create zones tailored to your specific requirements:
```bash
Create a new zone
sudo firewall-cmd --permanent --new-zone=database
Reload to make the zone available
sudo firewall-cmd --reload
Configure the new zone
sudo firewall-cmd --permanent --zone=database --set-description="Database servers zone"
sudo firewall-cmd --permanent --zone=database --set-short="Database"
Add services to the custom zone
sudo firewall-cmd --permanent --zone=database --add-service=ssh
sudo firewall-cmd --permanent --zone=database --add-service=mysql
Add custom ports
sudo firewall-cmd --permanent --zone=database --add-port=3306/tcp
sudo firewall-cmd --permanent --zone=database --add-port=5432/tcp
Reload configuration
sudo firewall-cmd --reload
```
Zone Source Management
Assign specific IP addresses or networks to zones:
```bash
Add a source IP to a zone
sudo firewall-cmd --permanent --zone=trusted --add-source=192.168.1.100
Add a network range to a zone
sudo firewall-cmd --permanent --zone=internal --add-source=10.0.0.0/8
Remove a source from a zone
sudo firewall-cmd --permanent --zone=trusted --remove-source=192.168.1.100
List sources in a zone
sudo firewall-cmd --zone=trusted --list-sources
Reload to apply changes
sudo firewall-cmd --reload
```
Rich Rules in Zones
Rich rules provide advanced filtering capabilities:
```bash
Allow SSH from specific IP
sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.100" service name="ssh" accept'
Block specific IP address
sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.200" reject'
Allow port range from specific network
sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port protocol="tcp" port="8000-9000" accept'
Log dropped packets
sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" service name="ssh" log prefix="SSH Attempt: " level="info" limit value="3/m" drop'
List rich rules
sudo firewall-cmd --zone=public --list-rich-rules
```
Zone Target Configuration
Set the default target for zones:
```bash
Set zone target to DROP
sudo firewall-cmd --permanent --zone=public --set-target=DROP
Set zone target to ACCEPT
sudo firewall-cmd --permanent --zone=trusted --set-target=ACCEPT
Set zone target to REJECT
sudo firewall-cmd --permanent --zone=public --set-target=REJECT
Reset to default target
sudo firewall-cmd --permanent --zone=public --set-target=default
View zone target
sudo firewall-cmd --zone=public --get-target
```
Practical Examples and Use Cases
Example 1: Web Server Configuration
Configure zones for a web server environment:
```bash
Create a web server zone
sudo firewall-cmd --permanent --new-zone=webserver
sudo firewall-cmd --reload
Configure web server zone
sudo firewall-cmd --permanent --zone=webserver --set-description="Web server zone"
sudo firewall-cmd --permanent --zone=webserver --add-service=ssh
sudo firewall-cmd --permanent --zone=webserver --add-service=http
sudo firewall-cmd --permanent --zone=webserver --add-service=https
Add custom application port
sudo firewall-cmd --permanent --zone=webserver --add-port=8443/tcp
Assign interface to web server zone
sudo firewall-cmd --permanent --zone=webserver --change-interface=eth0
Allow specific management IP
sudo firewall-cmd --permanent --zone=webserver --add-rich-rule='rule family="ipv4" source address="192.168.1.10" service name="ssh" accept'
Reload configuration
sudo firewall-cmd --reload
```
Example 2: Database Server Setup
Create a secure database server zone:
```bash
Create database zone
sudo firewall-cmd --permanent --new-zone=dbserver
sudo firewall-cmd --reload
Configure database zone with minimal access
sudo firewall-cmd --permanent --zone=dbserver --set-description="Database server zone"
sudo firewall-cmd --permanent --zone=dbserver --add-service=ssh
Add database ports for specific networks only
sudo firewall-cmd --permanent --zone=dbserver --add-rich-rule='rule family="ipv4" source address="192.168.10.0/24" port protocol="tcp" port="3306" accept'
sudo firewall-cmd --permanent --zone=dbserver --add-rich-rule='rule family="ipv4" source address="192.168.10.0/24" port protocol="tcp" port="5432" accept'
Block all other database access
sudo firewall-cmd --permanent --zone=dbserver --add-rich-rule='rule family="ipv4" port protocol="tcp" port="3306" drop'
sudo firewall-cmd --permanent --zone=dbserver --add-rich-rule='rule family="ipv4" port protocol="tcp" port="5432" drop'
Apply configuration
sudo firewall-cmd --reload
```
Example 3: Multi-Network Environment
Configure zones for different network segments:
```bash
Management network zone
sudo firewall-cmd --permanent --new-zone=management
sudo firewall-cmd --reload
sudo firewall-cmd --permanent --zone=management --set-description="Management network"
sudo firewall-cmd --permanent --zone=management --add-source=192.168.100.0/24
sudo firewall-cmd --permanent --zone=management --add-service=ssh
sudo firewall-cmd --permanent --zone=management --add-service=snmp
sudo firewall-cmd --permanent --zone=management --add-port=8080/tcp
Production network zone
sudo firewall-cmd --permanent --new-zone=production
sudo firewall-cmd --permanent --zone=production --set-description="Production network"
sudo firewall-cmd --permanent --zone=production --add-source=10.0.0.0/8
sudo firewall-cmd --permanent --zone=production --add-service=http
sudo firewall-cmd --permanent --zone=production --add-service=https
Guest network zone (restrictive)
sudo firewall-cmd --permanent --new-zone=guest
sudo firewall-cmd --permanent --zone=guest --set-description="Guest network"
sudo firewall-cmd --permanent --zone=guest --add-source=172.16.0.0/12
sudo firewall-cmd --permanent --zone=guest --add-service=dhcp
sudo firewall-cmd --permanent --zone=guest --add-port=53/udp
Reload all changes
sudo firewall-cmd --reload
```
Example 4: Dynamic Zone Switching
Script for automatic zone switching based on network:
```bash
#!/bin/bash
zone-switcher.sh - Automatic zone switching script
Get current network
CURRENT_NETWORK=$(ip route | grep default | awk '{print $3}' | head -1)
Define network-to-zone mapping
case $CURRENT_NETWORK in
"192.168.1.1")
TARGET_ZONE="home"
;;
"10.0.0.1")
TARGET_ZONE="work"
;;
*)
TARGET_ZONE="public"
;;
esac
Get current default zone
CURRENT_ZONE=$(firewall-cmd --get-default-zone)
Switch zone if different
if [ "$CURRENT_ZONE" != "$TARGET_ZONE" ]; then
echo "Switching from $CURRENT_ZONE to $TARGET_ZONE"
sudo firewall-cmd --set-default-zone=$TARGET_ZONE
echo "Zone switched successfully"
else
echo "Already using correct zone: $CURRENT_ZONE"
fi
```
Troubleshooting Common Issues
Issue 1: Zone Changes Not Taking Effect
Problem: Configuration changes don't seem to apply.
Solution:
```bash
Check if changes are made to runtime or permanent configuration
sudo firewall-cmd --list-all
sudo firewall-cmd --permanent --list-all
Reload firewalld to apply permanent changes
sudo firewall-cmd --reload
Or restart the service
sudo systemctl restart firewalld
```
Issue 2: Interface Not Assigned to Expected Zone
Problem: Network interface appears in wrong zone.
Diagnosis:
```bash
Check current interface assignments
sudo firewall-cmd --get-active-zones
Check which zone an interface belongs to
sudo firewall-cmd --get-zone-of-interface=eth0
```
Solution:
```bash
Remove interface from current zone
sudo firewall-cmd --zone=public --remove-interface=eth0
Add interface to correct zone
sudo firewall-cmd --zone=home --add-interface=eth0
Make permanent
sudo firewall-cmd --permanent --zone=home --change-interface=eth0
sudo firewall-cmd --reload
```
Issue 3: Service Not Accessible After Zone Change
Problem: Services become inaccessible after changing zones.
Diagnosis:
```bash
Check if service is allowed in current zone
sudo firewall-cmd --zone=public --list-services
Check if port is open
sudo firewall-cmd --zone=public --list-ports
Test connectivity
sudo ss -tlnp | grep :80
```
Solution:
```bash
Add required service to zone
sudo firewall-cmd --zone=public --add-service=http
sudo firewall-cmd --permanent --zone=public --add-service=http
Or add specific port
sudo firewall-cmd --zone=public --add-port=80/tcp
sudo firewall-cmd --permanent --zone=public --add-port=80/tcp
sudo firewall-cmd --reload
```
Issue 4: Rich Rules Not Working
Problem: Rich rules don't filter traffic as expected.
Diagnosis:
```bash
List current rich rules
sudo firewall-cmd --zone=public --list-rich-rules
Check rule syntax
sudo firewall-cmd --check-config
```
Solution:
```bash
Remove problematic rule
sudo firewall-cmd --zone=public --remove-rich-rule='rule family="ipv4" source address="192.168.1.100" service name="ssh" accept'
Add corrected rule
sudo firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.100" service name="ssh" accept'
Make permanent
sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.100" service name="ssh" accept'
```
Issue 5: Zone Configuration Lost After Reboot
Problem: Zone configurations disappear after system restart.
Solution:
```bash
Always make changes permanent
sudo firewall-cmd --permanent --zone=public --add-service=http
Or copy runtime to permanent
sudo firewall-cmd --runtime-to-permanent
Ensure firewalld starts on boot
sudo systemctl enable firewalld
```
Debugging Commands
Use these commands for troubleshooting:
```bash
Check firewalld status
sudo systemctl status firewalld
View firewalld logs
sudo journalctl -u firewalld -f
Test configuration syntax
sudo firewall-cmd --check-config
List all configuration
sudo firewall-cmd --list-all-zones
Get help for specific commands
firewall-cmd --help
```
Best Practices
Security Best Practices
1. Principle of Least Privilege
```bash
# Start with restrictive zones and open only necessary ports
sudo firewall-cmd --set-default-zone=public
sudo firewall-cmd --zone=public --add-service=ssh
# Add other services only as needed
```
2. Use Specific Source Restrictions
```bash
# Restrict administrative access to specific IPs
sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.10" service name="ssh" accept'
sudo firewall-cmd --permanent --zone=public --remove-service=ssh
```
3. Regular Security Audits
```bash
# Regularly review zone configurations
sudo firewall-cmd --list-all-zones | grep -A 10 -B 2 "services:"
# Check for overly permissive rules
sudo firewall-cmd --zone=trusted --list-all
```
Configuration Management
1. Always Use Permanent Rules in Production
```bash
# Good practice
sudo firewall-cmd --permanent --zone=public --add-service=http
sudo firewall-cmd --reload
# Avoid temporary rules in production
# sudo firewall-cmd --zone=public --add-service=http
```
2. Backup Configurations
```bash
# Backup firewalld configuration
sudo tar -czf firewalld-backup-$(date +%Y%m%d).tar.gz /etc/firewalld/
# Version control for zone files
sudo cp /etc/firewalld/zones/*.xml /path/to/git/repo/
```
3. Document Zone Purposes
```bash
# Use descriptive zone names and descriptions
sudo firewall-cmd --permanent --zone=webserver --set-description="Production web servers - HTTP/HTTPS only"
```
Performance Optimization
1. Minimize Rich Rules
```bash
# Use services instead of rich rules when possible
# Preferred
sudo firewall-cmd --zone=public --add-service=http
# Less efficient
sudo firewall-cmd --zone=public --add-rich-rule='rule port protocol="tcp" port="80" accept'
```
2. Optimize Zone Assignments
```bash
# Assign interfaces to appropriate zones
# Don't rely only on default zone
sudo firewall-cmd --permanent --zone=internal --change-interface=eth1
```
Monitoring and Maintenance
1. Enable Logging
```bash
# Enable logging for denied packets
sudo firewall-cmd --set-log-denied=all
# Monitor logs
sudo tail -f /var/log/messages | grep -i firewalld
```
2. Regular Testing
```bash
# Test connectivity after changes
nmap -p 80,443 your-server-ip
# Verify service accessibility
curl -I http://your-server-ip
```
3. Automation Scripts
```bash
#!/bin/bash
# zone-health-check.sh
echo "=== Firewalld Zone Health Check ==="
echo "Default Zone: $(firewall-cmd --get-default-zone)"
echo "Active Zones:"
firewall-cmd --get-active-zones
echo "=== End Health Check ==="
```
Development vs Production
1. Development Environment
```bash
# More permissive for development
sudo firewall-cmd --set-default-zone=trusted
# Or use work/home zones
```
2. Production Environment
```bash
# Restrictive default with specific exceptions
sudo firewall-cmd --set-default-zone=public
sudo firewall-cmd --permanent --zone=public --add-service=ssh
sudo firewall-cmd --permanent --zone=public --add-service=http
sudo firewall-cmd --permanent --zone=public --add-service=https
```
Conclusion
Configuring zones in firewalld provides a powerful and flexible approach to network security management. Throughout this comprehensive guide, you've learned how to leverage firewalld's zone-based architecture to create sophisticated security policies that adapt to different network environments automatically.
Key Takeaways
1. Zone Concept Mastery: You now understand how zones represent different trust levels and how they can be used to implement layered security policies.
2. Practical Configuration Skills: From basic zone assignments to advanced rich rules, you have the tools to configure firewalld zones for any scenario.
3. Real-World Applications: The practical examples demonstrated how to apply zone concepts to common infrastructure scenarios like web servers, database servers, and multi-network environments.
4. Troubleshooting Expertise: You're equipped with diagnostic techniques and solutions for common firewalld zone issues.
5. Best Practices Implementation: Following the security and configuration management best practices will help you maintain robust and maintainable firewall configurations.
Next Steps
To further enhance your firewalld expertise, consider:
1. Advanced Features: Explore firewalld's integration with NetworkManager for automatic zone switching based on network profiles.
2. Automation: Implement configuration management tools like Ansible to manage firewalld zones across multiple systems.
3. Integration: Learn how firewalld integrates with container technologies like Docker and Kubernetes.
4. Monitoring: Set up comprehensive logging and monitoring solutions to track firewall activity and security events.
5. Policy Development: Develop organization-wide firewall policies and zone standards for consistent security posture.
Remember that firewall configuration is an ongoing process that requires regular review and updates as your infrastructure evolves. The zone-based approach of firewalld makes this evolution manageable and secure, providing you with the flexibility to adapt to changing security requirements while maintaining robust protection.
By mastering firewalld zones, you've gained a valuable skill that will serve you well in managing Linux system security in diverse network environments. Continue practicing with different scenarios and stay updated with firewalld developments to maintain your expertise in this critical area of system administration.