DokuWiki » Infrastructure » Operating System » CentOS 8

h1. Config firewalld

have a look at 

* https://www.digitalocean.com/community/tutorials/how-to-set-up-a-firewall-using-firewalld-on-centos-8

* https://www.certdepot.net/rhel7-get-started-firewalld/

* https://www.liquidweb.com/kb/an-introduction-to-firewalld/

h2. Add a Port for TCP or UDP

You do have to specify TCP or UDP and to open a port for both. You will need to add rules for each protocol.

<pre><code class="shell">

firewall-cmd --permanent --add-port=22/tcp

firewall-cmd --permanent --add-port=53/udp

</code></pre>

h2. Remove a Port for TCP or UDP

Using a slight variation on the above structure, you can remove a currently open port, effectively closing off that port.

<pre><code class="shell">

firewall-cmd --permanent --remove-port=444/tcp

</code></pre>

h2. Add a Service

These services assume the default ports configured within the /etc/services configuration file; if you wish to use a service on a non-standard port, you will have to open the specific port, as in the example above.

<pre><code class="shell">

firewall-cmd --permanent --add-service=ssh

firewall-cmd --permanent --add-service=http

</code></pre>

h2. Remove a Service

As above, you specify the remove-service option, and you can close off the port that is defined for that service.

<pre><code class="shell">

firewall-cmd --permanent --remove-service=mysql

</code></pre>

h2. Whitelist an IP Address

To whitelist or allow access from an IP or range of IPs, you can tell the firewall to add a trusted source.

<pre><code class="shell">

firewall-cmd --permanent --add-source=192.168.1.100

</code></pre>

You can also allow a range of IPs using what is called CIDR notation. CIDR is outside the scope of this article but is a shorthand that can be used for noting ranges of IP addresses.

<pre><code class="shell">

firewall-cmd --permanent --add-source=192.168.1.0/24

</code></pre>

h2. Remove a Whitelisted IP Address

To remove a whitelisted IP or IP range, you can use the --remove-source option.

<pre><code class="shell">

firewall-cmd --permanent --remove-source=192.168.1.100

</code></pre>

h2. Block an IP Address

As the firewall-cmd tool is mostly used for opening or allowing access, rich rules are needed to block an IP. Rich rules are similar in form to the way iptables rules are written.

<pre><code class="shell">

firewall-cmd --permanent --add-rich-rule="rule family='ipv4' source address='192.168.1.100' reject"

</code></pre>

You can again use CIDR notation also block a range of IP addresses.

<pre><code class="shell">

firewall-cmd --permanent --add-rich-rule="rule family='ipv4' source address='192.168.1.0/24' reject"

</code></pre>

h2. to forward a specific port (not yet working!)

<pre><code class="shell">

firewall-cmd --zone=public --permanent --add-port=2222/tcp

firewall-cmd --zone=public --add-masquerade --permanent

firewall-cmd --zone=public --add-forward-port=port=2222:proto=tcp:toport=22:toaddr=192.168.122.80 --permanent

firewall-cmd --reload

firewall-cmd --zone=public --list-all

</code></pre>

h1. Testing

you may consider http://portquiz.net/

<pre><code class="shell">

http://portquiz.net:1234/

</code></pre>

This example tests whether you are able to visit outbound port 1234. You simply change the port number to whatever you like. Also, the site gives some examples that could be used in a command line script:

<pre><code class="shell">

wget -qO- portquiz.net:1234 

</code></pre>

<pre><code class="shell">

Port 1234 test successful!

Your IP: 198.252.206.16

</code></pre>