Site icon System Zone

Firewalld Installation and Configuration in Ubuntu Server

Firewalld is an awesome host based firewall management tool for Linux Operating System. Firewalld has developed on Fedora but it is now available for almost all Linux distributions. So, Firewalld can be installed in Ubuntu Server although Ubuntu Server has UFW as the default firewall system. Firewalld is more robust and easy to maintain than UFW, I think. So, I am going to discuss how to install and configure Firewalld in Ubuntu Server. 

Firewalld Installation and Configuration in Ubuntu Server

Installing Firewalld in Ubuntu Server

By default Ubuntu Server comes with UFW firewall application. So, first we have to disable the UFW app before installing Firewalld. Issue the following command to disable UFW firewall application.

$ sudo ufw disable

We will now install Firewalld in Ubuntu Server with the following command.

$ sudo apt install firewalld

Firewalld will now start installing and within few times it will be installed completely. After installation, the daemon should be started and enabled for auto start. So, issue the following command to start Firewalld and enable it.

$ sudo systemctl start firewalld
$ sudo systemctl enable firewalld

Sometimes we may need to see the status of the Firewalld daemon. Issue the following command to see the Firewalld status.

$ sudo systemctl status firewalld

You will now find that the Firewalld is active and running. It is also possible to stop and restart the Firewalld daemon with the following commands.  

$ sudo systemctl stop firewalld$ sudo systemctl restart firewalld

Basic Concepts in Firewalld

Firewalld daemon is a zone based firewall application. A ‘Zone’ is an entity that defines the rules for allowing or rejecting internet traffic. Network interfaces are assigned to a zone to dictate the behavior that the firewall should allow. 

Firewalld daemon has the following nine predefined zones based on the trust level.

To use the Firewalld firewall, we can create access or reject rules and alter the properties of any zone and then assign any network interface to any zone which is most appropriate.

Getting Default Zone Information of Firewalld

Firewalld daemon provides firewall-cmd command line utility for administrating firewall rules. So, we can do any operation on Firewalld with the firewall-cmd utility.

First, we will know the default information of zones available in Firewalld. So, issue the following command to list all the default zones available in Firewalld.

$ sudo firewall-cmd –list-all-zones

With the above command you will find all the default zones available in Firewalld as well as their services. For example, if we see the public zone it will look like the following info.

public

  target: default

  icmp-block-inversion: no

  interfaces:

  sources:

  services: dhcpv6-client ssh

  ports:

  protocols:

  masquerade: no

  forward-ports:

  source-ports:

  icmp-blocks:

  rich rules:

From the above information we can see that only SSH and dhcpv6-client services are available in public zone.

The above command shows all the zones with available services. But if we want to know only the name of available zone, issue the following command.

$ sudo firewall-cmd –get-zones

Output

block dmz drop external home internal public trusted work

From the above command, we can see all available zones in Firewalld but among them there is a default zone that rules will be applied by default. To learn the default zone in Firewalld, issue the following command.

$ sudo firewall-cmd –get-default-zone

Output

public

By default public zone will have the default zone. So, you will find public as output.

It is possible to change the default zone with the firewall-cmd command. To change the default zone, issue the following command.

$ sudo firewall-cmd –set-default-zone=home

Now home zone will be the default zone and its rules will be applied by default.

Exploring Active Zone

From the above section, we can see available zones and the default zone but no zone will be active until a network interface will be associated with any zone. So, if we issue the following command to know active zones, no output will appear.

$ sudo firewall-cmd –get-active-zones

 So, to make a zone active, we have to add an interface to a zone. But before adding an interface, we need to know the name of that interface. To know the interface name, we can issue the ip link command.

$ ip link

Output

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000

    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000

    link/ether 00:50:56:9d:d9:fe brd ff:ff:ff:ff:ff:ff

3: ens192: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000

    link/ether 00:50:56:9d:05:a3 brd ff:ff:ff:ff:ff:ff

From the output we can see that there are two interfaces in our Ubuntu Server named ens160 and ens192. It may differ in your distribution but note the name that shows from the ip link command.

Now we want to add ens160 to home zone and ens192 to public because these two zones are used most of the cases.

To add ens160 interface to home zone, issue the following command.

$ sudo firewall-cmd –zone=home –add-interface=ens160

Now home zone is active and home zone’s rules will be applied for all incoming traffics coming through ens160 interface. If we now run firewall-cmd command with –get-active-zones option, we will find home zone is now in active zone list.

The above command will make home zone active temporarily and if we reload Firewalld with the following command or restart Firewalld, active zone will be flushed. 

$ sudo firewall-cmd –reload

So, to make the above rule permanent, we have to run the same command with the –permanent option.

$ sudo firewall-cmd –zone=home –add-interface=ens160 –permanent

Now the above rule is permanent and it will not be removed either Firewalld reload or restart.

Similarly, we can add ens192 interface to public zone with the following command and activate the public zone.

$ sudo firewall-cmd –zone=public –add-interface=ens192$ sudo firewall-cmd –zone=public –add-interface=ens192 –permanent

If we now list active zones, the following output will be found.

$ sudo firewall-cmd –get-active-zones

Output

home

  interfaces: ens160

public

  interfaces: ens192

Managing Services in Firewalld Zones

Firewalld daemon provides a lot of services those can be allowed or blocked with firewall rules. To list available services provided by Firewalld, issue the following command.

$ sudo firewall-cmd –get-services

The listed services can be allowed or blocked with Firewalld. To explore assigned services to a zone (for example: home zone), issue the following command.

$ sudo firewall-cmd –zone=home –list-all

The above command will show everything applied on home zone. To list only the services applied on home zone, issue the following command.

$ sudo firewall-cmd –zone=home –list-services

Output

dhcpv6-client mdns samba-client ssh     

From the output, we can see that there are four services allowed in home zone. Now we want to add a service, for example http, in home zone. For this, issue the following commands.

$ sudo firewall-cmd –zone=home –add-service=http$ sudo firewall-cmd –zone=home –add-service=http –permanent

Similarly you can add any service in your any desired firewall zone following the above command.

Besides adding services, we can also remove any service from any firewall zone with the firewall-cmd utility. To remove any service, for example samba-client, from home zone, issue the following command.

$ sudo firewall-cmd –zone=home –remove-service=samba-client$ sudo firewall-cmd –zone=home –remove-service=samba-client –permanent

Now if we list services in home zone after running the above command, we will find the following output.

$ sudo firewall-cmd –zone=home –list-services

Output

dhcpv6-client http mdns ssh

Managing Ports in Firewalld Zones

Popular services which represent specific port are available in Firewalld daemon. For example, http service represent port 80 and https represent port 443. So, we can allow or block these services with that service name. But sometimes we may need to allow or block some specific ports those are not listed Firewalld daemon services. For this, Firewalld provides –add-port and –remove-port commands to add or remove any port from any zone respectively.

So, to add any port in home zone, for example UDP port 1812, issue the following commands.

$ sudo firewall-cmd –zone=home –add-port=1812/udp$ sudo firewall-cmd –zone=home –add-port=1812/udp –permanent

Now if we list the allowed port in home zone, the following output will be found.

$ sudo firewall-cmd –zone=home –list-ports

Output

1812/udp

Similarly we can remove any port from any zone with the following commands.

$ sudo firewall-cmd –zone=home –remove-port=1812/udp$ sudo firewall-cmd –zone=home –remove-port=1812/udp –permanent

If we want to know the port of any service, for example http, issue the following command from the command prompt.

$ grep http /etc/services

Output

http            80/tcp          www             # WorldWideWeb HTTP

How to install and configure Firewalld daemon in Ubuntu Server has been discussed in this article. How to manage Firewalld services and ports has also been discussed here. So, I hope you will now be able to manage Firewalld daemon in Ubuntu Server without any hesitation. However, if you face any confusion, feel free to discuss in comment or contact me from Contact page. I will try my best to stay with you.

Exit mobile version