Which type of firewall filters ip traffic between a pair of bridged interfaces?

47.1.1. When to use firewalld, nftables, or iptables

The following is a brief overview in which scenario you should use one of the following utilities:

• # systemctl enable firewalld

  56: Use the

  # systemctl enable firewalld

  56 utility for simple firewall use cases. The utility is easy to use and covers the typical use cases for these scenarios.

• # systemctl enable firewalld

  60: Use the

  # systemctl enable firewalld

  60 utility to set up complex and performance-critical firewalls, such as for a whole network.

• # systemctl enable firewalld

  70: The

  # systemctl enable firewalld

  70 utility on Red Hat Enterprise Linux uses the

  # systemctl enable firewalld

  72 kernel API instead of the

  # systemctl enable firewalld

  73 back end. The

  # systemctl enable firewalld

  72 API provides backward compatibility so that scripts that use

  # systemctl enable firewalld

  70 commands still work on Red Hat Enterprise Linux. For new firewall scripts, Red Hat recommends to use

  # systemctl enable firewalld

  60.

Important

To prevent the different firewall services from influencing each other, run only one of them on a RHEL host, and disable the other services.

47.1.2. Zones

⁠

# systemctl enable firewalld

# systemctl enable firewalld

# systemctl enable firewalld

• # systemctl enable firewalld

  78

• # systemctl enable firewalld

  81 tool

• # systemctl enable firewalld

  82 command-line tool
• The RHEL web console

The latter three can only edit the appropriate

# systemctl enable firewalld

# systemctl enable firewalld

# systemctl enable firewalld

# systemctl enable firewalld

# systemctl enable firewalld

The predefined zones are stored in the

# systemctl enable firewalld

# systemctl enable firewalld

# systemctl enable firewalld

# systemctl enable firewalld

# systemctl enable firewalld

# systemctl enable firewalld

# systemctl enable firewalld

# systemctl enable firewalld

# systemctl enable firewalld

# systemctl enable firewalld

# systemctl enable firewalld

# systemctl enable firewalld

# systemctl stop firewalld

One of these zones is set as the default zone. When interface connections are added to

# systemctl enable firewalld

# systemctl enable firewalld

# systemctl enable firewalld

Note

The network zone names should be self-explanatory and to allow users to quickly make a reasonable decision. To avoid any security problems, review the default zone configuration and disable any unnecessary services according to your needs and risk assessments.

Additional resources

• The

  # systemctl stop firewalld

  04 man page.

47.1.3. Predefined services

A service can be a list of local ports, protocols, source ports, and destinations, as well as a list of firewall helper modules automatically loaded if a service is enabled. Using services saves users time because they can achieve several tasks, such as opening ports, defining protocols, enabling packet forwarding and more, in a single step, rather than setting up everything one after another.

Service configuration options and generic file information are described in the

# systemctl stop firewalld

# systemctl stop firewalld

# systemctl enable firewalld

Services can be added and removed using the graphical

# systemctl enable firewalld

# systemctl enable firewalld

# systemctl stop firewalld

Alternatively, you can edit the XML files in the

# systemctl stop firewalld

# systemctl stop firewalld

# systemctl stop firewalld

Additional resources

• The

  # systemctl stop firewalld

  05 man page

47.1.4. Starting firewalld

Procedure

1. To start

   # systemctl enable firewalld

   56, enter the following command as

   # systemctl stop firewalld

   16:

   # systemctl unmask firewalld
   # systemctl start firewalld

2. To ensure

   # systemctl enable firewalld

   56 starts automatically at system start, enter the following command as

   # systemctl stop firewalld

   16:

   # systemctl enable firewalld

47.1.5. Stopping firewalld

Procedure

1. To stop

   # systemctl enable firewalld

   56, enter the following command as

   # systemctl stop firewalld

   16:

   # systemctl stop firewalld

2. To prevent

   # systemctl enable firewalld

   56 from starting automatically at system start:

   # systemctl disable firewalld

3. To make sure firewalld is not started by accessing the

   # systemctl enable firewalld

   56

   # systemctl stop firewalld

   23 interface and also if other services require

   # systemctl enable firewalld

   56:

   # systemctl mask firewalld

47.1.6. Verifying the permanent firewalld configuration

In certain situations, for example after manually editing

# systemctl enable firewalld

# systemctl enable firewalld

Prerequisites

• The

  # systemctl enable firewalld

  56 service is running.

Procedure

1. Verify the permanent configuration of the

   # systemctl enable firewalld

   56 service:

   # firewall-cmd --check-config
   success

   If the permanent configuration is valid, the command returns

   # systemctl stop firewalld

   29. In other cases, the command returns an error with further details, such as the following:

   # firewall-cmd --check-config
   Error: INVALID_PROTOCOL: 'public.xml': 'tcpx' not from {'tcp'|'udp'|'sctp'|'dccp'}

47.2.1. Viewing the current status of # systemctl enable firewalld56

The firewall service,

# systemctl enable firewalld

# systemctl enable firewalld

Procedure

1. To see the status of the service:

   # firewall-cmd --state

2. For more information about the service status, use the

   # systemctl stop firewalld

   35 sub-command:

   # systemctl status firewalld
   firewalld.service - firewalld - dynamic firewall daemon
      Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor pr
      Active: active (running) since Mon 2017-12-18 16:05:15 CET; 50min ago
        Docs: man:firewalld(1)
    Main PID: 705 (firewalld)
       Tasks: 2 (limit: 4915)
      CGroup: /system.slice/firewalld.service
              └─705 /usr/bin/python3 -Es /usr/sbin/firewalld --nofork --nopid

47.2.2. Viewing allowed services using GUI

To view the list of services using the graphical firewall-config tool, press the Super key to enter the Activities Overview, type

# systemctl stop firewalld

# systemctl stop firewalld

You can start the graphical firewall configuration tool using the command-line.

Prerequisites

• You installed the

  # systemctl enable firewalld

  81 package.

Procedure

• To start the graphical firewall configuration tool using the command-line:

  $ firewall-config

The

# systemctl stop firewalld

47.2.3. Viewing firewalld settings using CLI

With the CLI client, it is possible to get different views of the current firewall settings. The

# systemctl stop firewalld

# systemctl enable firewalld

# systemctl enable firewalld

# systemctl stop firewalld

Procedure

• To list all the relevant information for the default zone:

  # systemctl enable firewalld

  0

• To specify the zone for which to display the settings, add the

  # systemctl stop firewalld

  44 argument to the

  # systemctl stop firewalld

  45 command, for example:

  # systemctl enable firewalld

  1

• To see the settings for particular information, such as services or ports, use a specific option. See the

  # systemctl enable firewalld

  56 manual pages or get a list of the options using the command help:

  # systemctl enable firewalld

  2

• To see which services are allowed in the current zone:

  # systemctl enable firewalld

  3

Note

Listing the settings for a certain subpart using the CLI tool can sometimes be difficult to interpret. For example, you allow the

# systemctl stop firewalld

# systemctl enable firewalld

# systemctl stop firewalld

# systemctl stop firewalld

47.3.1. Disabling all traffic in case of emergency using CLI

In an emergency situation, such as a system attack, it is possible to disable all network traffic and cut off the attacker.

Procedure

1. To immediately disable networking traffic, switch panic mode on:

   # systemctl enable firewalld

   4

   Important

   Enabling panic mode stops all networking traffic. For this reason, it should be used only when you have the physical access to the machine or if you are logged in using a serial console.

2. Switching off panic mode reverts the firewall to its permanent settings. To switch panic mode off, enter:

   # systemctl enable firewalld

   5

Verification

• To see whether panic mode is switched on or off, use:

  # systemctl enable firewalld

  6

47.3.2. Controlling traffic with predefined services using CLI

The most straightforward method to control traffic is to add a predefined service to

# systemctl enable firewalld

Procedure

1. Check that the service is not already allowed:

   # systemctl enable firewalld

   7

2. List all predefined services:

   # systemctl enable firewalld

   8

3. Add the service to the allowed services:

   # systemctl enable firewalld

   9

4. Make the new settings persistent:

   # systemctl stop firewalld

   0

47.3.3. Controlling traffic with predefined services using GUI

This procedure describes how to control the network traffic with predefined services using graphical user interface.

Prerequisites

• You installed the

  # systemctl enable firewalld

  81 package

Procedure

1. To enable or disable a predefined or custom service:

   1. Start the firewall-config tool and select the network zone whose services are to be configured.
   2. Select the

      # systemctl stop firewalld

      55 tab and then the

      # systemctl stop firewalld

      37 tab below.
   3. Select the check box for each type of service you want to trust or clear the check box to block a service in the selected zone.

2. To edit a service:

   1. Start the firewall-config tool.
   2. Select

      # systemctl stop firewalld

      57 from the menu labeled

      # systemctl stop firewalld

      58. Additional icons and menu buttons appear at the bottom of the Services window.
   3. Select the service you want to configure.

The

# systemctl stop firewalld

# systemctl stop firewalld

# systemctl stop firewalld

# systemctl stop firewalld

# systemctl enable firewalld

# systemctl enable firewalld

Note

It is not possible to alter service settings in the

# systemctl stop firewalld

47.3.4. Adding new services

Services can be added and removed using the graphical firewall-config tool,

# systemctl enable firewalld

# systemctl stop firewalld

# systemctl stop firewalld

# systemctl stop firewalld

# systemctl stop firewalld

Note

Service names must be alphanumeric and can, additionally, include only

# systemctl stop firewalld

# systemctl stop firewalld

Procedure

To add a new service in a terminal, use

# systemctl enable firewalld

# systemctl stop firewalld

# systemctl enable firewalld

1. Enter the following command to add a new and empty service:

   # systemctl stop firewalld

   1

2. To add a new service using a local file, use the following command:

   # systemctl stop firewalld

   2

   You can change the service name with the additional

   # systemctl stop firewalld

   76 option.

3. As soon as service settings are changed, an updated copy of the service is placed into

   # systemctl stop firewalld

   11.

   As

   # systemctl stop firewalld

   16, you can enter the following command to copy a service manually:

   # systemctl stop firewalld

   3

# systemctl enable firewalld

# systemctl stop firewalld

# systemctl stop firewalld

# systemctl stop firewalld

# systemctl stop firewalld

# systemctl stop firewalld

# systemctl enable firewalld

47.3.5. Opening ports using GUI

To permit traffic through the firewall to a certain port, you can open the port in the GUI.

Prerequisites

• You installed the

  # systemctl enable firewalld

  81 package

Procedure

1. Start the firewall-config tool and select the network zone whose settings you want to change.
2. Select the

   # systemctl stop firewalld

   59 tab and click the Add button on the right-hand side. The

   # systemctl stop firewalld

   88 window opens.
3. Enter the port number or range of ports to permit.
4. Select

   # systemctl stop firewalld

   89 or

   # systemctl stop firewalld

   90 from the list.

47.3.6. Controlling traffic with protocols using GUI

To permit traffic through the firewall using a certain protocol, you can use the GUI.

Prerequisites

• You installed the

  # systemctl enable firewalld

  81 package

Procedure

1. Start the firewall-config tool and select the network zone whose settings you want to change.
2. Select the

   # systemctl stop firewalld

   60 tab and click the

   # systemctl stop firewalld

   93 button on the right-hand side. The

   # systemctl stop firewalld

   94 window opens.
3. Either select a protocol from the list or select the

   # systemctl stop firewalld

   95 check box and enter the protocol in the field.

47.3.7. Opening source ports using GUI

To permit traffic through the firewall from a certain port, you can use the GUI.

Prerequisites

• You installed the

  # systemctl enable firewalld

  81 package

Procedure

1. Start the firewall-config tool and select the network zone whose settings you want to change.
2. Select the

   # systemctl stop firewalld

   61 tab and click the

   # systemctl stop firewalld

   93 button on the right-hand side. The

   # systemctl stop firewalld

   61 window opens.
3. Enter the port number or range of ports to permit. Select

   # systemctl stop firewalld

   89 or

   # systemctl stop firewalld

   90 from the list.

47.4.1. Opening a port

Through open ports, the system is accessible from the outside, which represents a security risk. Generally, keep ports closed and only open them if they are required for certain services.

Procedure

To get a list of open ports in the current zone:

1. List all allowed ports:

   # systemctl stop firewalld

   4

2. Add a port to the allowed ports to open it for incoming traffic:

   # systemctl stop firewalld

   5

   The port types are either

   # systemctl stop firewalld

   89,

   # systemctl stop firewalld

   90,

   # systemctl disable firewalld

   05, or

   # systemctl disable firewalld

   06. The type must match the type of network communication.

3. Make the new settings persistent:

   # systemctl stop firewalld

   0

   The port types are either

   # systemctl stop firewalld

   89,

   # systemctl stop firewalld

   90,

   # systemctl disable firewalld

   05, or

   # systemctl disable firewalld

   06. The type must match the type of network communication.

47.4.2. Closing a port

When an open port is no longer needed, close that port in

# systemctl enable firewalld

Procedure

To close a port, remove it from the list of allowed ports:

1. List all allowed ports:

   # systemctl stop firewalld

   4

   Warning

   This command will only give you a list of ports that have been opened as ports. You will not be able to see any open ports that have been opened as a service. Therefore, you should consider using the

   # systemctl stop firewalld

   40 option instead of

   # systemctl disable firewalld

   13.

2. Remove the port from the allowed ports to close it for the incoming traffic:

   # systemctl stop firewalld

   8

3. Make the new settings persistent:

   # systemctl stop firewalld

   0

47.5.1. Listing zones

This procedure describes how to list zones using the command line.

Procedure

1. To see which zones are available on your system:

   # systemctl disable firewalld

   0

   The

   # systemctl disable firewalld

   14 command displays all zones that are available on the system, but it does not show any details for particular zones.

2. To see detailed information for all zones:

   # systemctl disable firewalld

   1

3. To see detailed information for a specific zone:

   # systemctl disable firewalld

   2

47.5.2. Modifying firewalld settings for a certain zone

The Controlling traffic with predefined services using cli and Controlling ports using cli explain how to add services or modify ports in the scope of the current working zone. Sometimes, it is required to set up rules in a different zone.

Procedure

• To work in a different zone, use the

  # systemctl stop firewalld

  44 option. For example, to allow the

  # systemctl stop firewalld

  47 service in the zone public:

  # systemctl disable firewalld

  3

47.5.3. Changing the default zone

System administrators assign a zone to a networking interface in its configuration files. If an interface is not assigned to a specific zone, it is assigned to the default zone. After each restart of the

# systemctl enable firewalld

# systemctl enable firewalld

Procedure

To set up the default zone:

1. Display the current default zone:

   # systemctl disable firewalld

   4

2. Set the new default zone:

   # systemctl disable firewalld

   5

   Note

   Following this procedure, the setting is a permanent setting, even without the

   # systemctl disable firewalld

   19 option.

47.5.4. Assigning a network interface to a zone

It is possible to define different sets of rules for different zones and then change the settings quickly by changing the zone for the interface that is being used. With multiple interfaces, a specific zone can be set for each of them to distinguish traffic that is coming through them.

Procedure

To assign the zone to a specific interface:

1. List the active zones and the interfaces assigned to them:

   # systemctl disable firewalld

   6

2. Assign the interface to a different zone:

   # systemctl disable firewalld

   7

47.5.5. Assigning a zone to a connection using nmcli

This procedure describes how to add a

# systemctl enable firewalld

# systemctl enable firewalld

# systemctl disable firewalld

Procedure

1. Assign the zone to the

   # systemctl enable firewalld

   78 connection profile:

   # systemctl disable firewalld

   8

2. Activate the connection:

   # systemctl disable firewalld

   9

47.5.6. Manually assigning a zone to a network connection in an ifcfg file

When the connection is managed by NetworkManager, it must be aware of a zone that it uses. For every network connection, a zone can be specified, which provides the flexibility of various firewall settings according to the location of the computer with portable devices. Thus, zones and settings can be specified for different locations, such as company or home.

Procedure

• To set a zone for a connection, edit the

  # systemctl disable firewalld

  24 file and add a line that assigns a zone to this connection:

  # systemctl mask firewalld

  0

47.5.7. Creating a new zone

To use custom zones, create a new zone and use it just like a predefined zone. New zones require the

# systemctl disable firewalld

Procedure

1. Create a new zone:

   # systemctl mask firewalld

   1

2. Check if the new zone is added to your permanent settings:

   # systemctl mask firewalld

   2

3. Make the new settings persistent:

   # systemctl mask firewalld

   3

47.5.8. Zone configuration files

Zones can also be created using a zone configuration file. This approach can be helpful when you need to create a new zone, but want to reuse the settings from a different zone and only alter them a little.

A

# systemctl enable firewalld

# systemctl disable firewalld

# systemctl enable firewalld

# systemctl enable firewalld

The following example shows a configuration that allows one service (

# systemctl stop firewalld

# systemctl disable firewalld

# systemctl disable firewalld

# systemctl mask firewalld

To change settings for that zone, add or remove sections to add ports, forward ports, services, and so on.

Additional resources

• # systemctl disable firewalld

  33 manual page

47.5.9. Using zone targets to set default behavior for incoming traffic

For every zone, you can set a default behavior that handles incoming traffic that is not further specified. Such behavior is defined by setting the target of the zone. There are four options:

• # systemctl disable firewalld

  34: Accepts all incoming packets except those disallowed by specific rules.

• # systemctl disable firewalld

  35: Rejects all incoming packets except those allowed by specific rules. When

  # systemctl enable firewalld

  56 rejects packets, the source machine is informed about the rejection.

• # systemctl disable firewalld

  37: Drops all incoming packets except those allowed by specific rules. When

  # systemctl enable firewalld

  56 drops packets, the source machine is not informed about the packet drop.

• # systemctl disable firewalld

  39: Similar behavior as for

  # systemctl disable firewalld

  35, but with special meanings in certain scenarios. For details, see the

  # systemctl disable firewalld

  41 section in the

  # systemctl disable firewalld

  42 man page.

Procedure

To set a target for a zone:

1. List the information for the specific zone to see the default target:

   # systemctl mask firewalld

   5

2. Set a new target in the zone:

   # systemctl mask firewalld

   6

Additional resources

• # systemctl disable firewalld

  42 man page

47.6.1. Adding a source

To route incoming traffic into a specific zone, add the source to that zone. The source can be an IP address or an IP mask in the classless inter-domain routing (CIDR) notation.

Note

In case you add multiple zones with an overlapping network range, they are ordered alphanumerically by zone name and only the first one is considered.

• To set the source in the current zone:

  # systemctl mask firewalld

  7

• To set the source IP address for a specific zone:

  # systemctl mask firewalld

  8

The following procedure allows all incoming traffic from 192.168.2.15 in the

# systemctl enable firewalld

Procedure

1. List all available zones:

   # systemctl disable firewalld

   0

2. Add the source IP to the trusted zone in the permanent mode:

   # firewall-cmd --check-config
   success

   0

3. Make the new settings persistent:

   # systemctl stop firewalld

   0

47.6.2. Removing a source

Removing a source from the zone cuts off the traffic coming from it.

Procedure

1. List allowed sources for the required zone:

   # firewall-cmd --check-config
   success

   2

2. Remove the source from the zone permanently:

   # firewall-cmd --check-config
   success

   3

3. Make the new settings persistent:

   # systemctl stop firewalld

   0

47.6.3. Adding a source port

To enable sorting the traffic based on a port of origin, specify a source port using the

# systemctl disable firewalld

# systemctl disable firewalld

Procedure

• To add a source port:

  # firewall-cmd --check-config
  success

  5

47.6.4. Removing a source port

By removing a source port you disable sorting the traffic based on a port of origin.

Procedure

• To remove a source port:

  # firewall-cmd --check-config
  success

  6

47.6.5. Using zones and sources to allow a service for only a specific domain

To allow traffic from a specific network to use a service on a machine, use zones and source. The following procedure allows only HTTP traffic from the

# systemctl disable firewalld

Warning

When you configure this scenario, use a zone that has the

# systemctl disable firewalld

# systemctl disable firewalld

# systemctl disable firewalld

Procedure

1. List all available zones:

   # firewall-cmd --check-config
   success

   7

2. Add the IP range to the

   # systemctl enable firewalld

   97 zone to route the traffic originating from the source through the zone:

   # firewall-cmd --check-config
   success

   8

3. Add the

   # systemctl disable firewalld

   52 service to the

   # systemctl enable firewalld

   97 zone:

   # firewall-cmd --check-config
   success

   9

4. Make the new settings persistent:

   # firewall-cmd --check-config
   Error: INVALID_PROTOCOL: 'public.xml': 'tcpx' not from {'tcp'|'udp'|'sctp'|'dccp'}

   0

Verification

• Check that the

  # systemctl enable firewalld

  97 zone is active and that the service is allowed in it:

  # firewall-cmd --check-config
  Error: INVALID_PROTOCOL: 'public.xml': 'tcpx' not from {'tcp'|'udp'|'sctp'|'dccp'}

  1

Additional resources

• # systemctl disable firewalld

  55 man page

47.7.1. The relationship between policy objects and zones

Policy objects allow the user to attach firewalld’s primitives’ such as services, ports, and rich rules to the policy. You can apply the policy objects to traffic that passes between zones in a stateful and unidirectional manner.

# firewall-cmd --check-config
Error: INVALID_PROTOCOL: 'public.xml': 'tcpx' not from {'tcp'|'udp'|'sctp'|'dccp'}

# systemctl disable firewalld

# systemctl disable firewalld

• The

  # systemctl disable firewalld

  56 symbolic zone allows policies for the traffic originating from or has a destination to the host running firewalld.
• The

  # systemctl disable firewalld

  57 symbolic zone applies policy to all the current and future zones.

  # systemctl disable firewalld

  57 symbolic zone acts as a wildcard for all zones.

47.7.2. Using priorities to sort policies

Multiple policies can apply to the same set of traffic, therefore, priorities should be used to create an order of precedence for the policies that may be applied.

To set a priority to sort the policies:

# firewall-cmd --check-config
Error: INVALID_PROTOCOL: 'public.xml': 'tcpx' not from {'tcp'|'udp'|'sctp'|'dccp'}

In the above example -500 is a lower priority value but has higher precedence. Thus, -500 will execute before -100. Higher priority values have precedence over lower values.

The following rules apply to policy priorities:

• Policies with negative priorities apply before rules in zones.
• Policies with positive priorities apply after rules in zones.
• Priority 0 is reserved and hence is unusable.

47.7.3. Using policy objects to filter traffic between locally hosted Containers and a network physically connected to the host

The policy objects feature allows users to filter their container and virtual machine traffic.

Procedure

1. Create a new policy.

   # firewall-cmd --check-config
   Error: INVALID_PROTOCOL: 'public.xml': 'tcpx' not from {'tcp'|'udp'|'sctp'|'dccp'}

   4

2. Block all traffic.

   # firewall-cmd --check-config
   Error: INVALID_PROTOCOL: 'public.xml': 'tcpx' not from {'tcp'|'udp'|'sctp'|'dccp'}

   5

   Note

   Red Hat recommends that you block all traffic to the host by default and then selectively open the services you need for the host.

3. Define the ingress zone to use with the policy.

   # firewall-cmd --check-config
   Error: INVALID_PROTOCOL: 'public.xml': 'tcpx' not from {'tcp'|'udp'|'sctp'|'dccp'}

   6

4. Define the egress zone to use with the policy.

   # firewall-cmd --check-config
   Error: INVALID_PROTOCOL: 'public.xml': 'tcpx' not from {'tcp'|'udp'|'sctp'|'dccp'}

   7

Verification

• Verify information about the policy.

  # firewall-cmd --check-config
  Error: INVALID_PROTOCOL: 'public.xml': 'tcpx' not from {'tcp'|'udp'|'sctp'|'dccp'}

  8

47.7.4. Setting the default target of policy objects

You can specify --set-target options for policies. The following targets are available:

• ACCEPT - accepts the packet
• DROP - drops the unwanted packets
• REJECT - rejects unwanted packets with an ICMP reply

• CONTINUE (default) - packets will be subject to rules in following policies and zones.

  # firewall-cmd --check-config
  Error: INVALID_PROTOCOL: 'public.xml': 'tcpx' not from {'tcp'|'udp'|'sctp'|'dccp'}

  9

Verification

• Verify information about the policy

  # firewall-cmd --state

  0

47.8.1. NAT types

These are the different network address translation (NAT) types:

Masquerading and source NAT (SNAT)

Use one of these NAT types to change the source IP address of packets. For example, Internet Service Providers do not route private IP ranges, such as

# systemctl disable firewalld

Masquerading and SNAT are very similar to one another. The differences are:

• Masquerading automatically uses the IP address of the outgoing interface. Therefore, use masquerading if the outgoing interface uses a dynamic IP address.
• SNAT sets the source IP address of packets to a specified IP and does not dynamically look up the IP of the outgoing interface. Therefore, SNAT is faster than masquerading. Use SNAT if the outgoing interface uses a fixed IP address.

47.8.2. Configuring IP address masquerading

The following procedure describes how to enable IP masquerading on your system. IP masquerading hides individual machines behind a gateway when accessing the Internet.

Procedure

1. To check if IP masquerading is enabled (for example, for the

   # systemctl enable firewalld

   95 zone), enter the following command as

   # systemctl stop firewalld

   16:

   # firewall-cmd --state

   1

   The command prints

   # systemctl disable firewalld

   65 with exit status

   # systemctl disable firewalld

   66 if enabled. It prints

   # systemctl disable firewalld

   67 with exit status

   # systemctl disable firewalld

   68 otherwise. If

   # systemctl disable firewalld

   69 is omitted, the default zone will be used.

2. To enable IP masquerading, enter the following command as

   # systemctl stop firewalld

   16:

   # firewall-cmd --state

   2
3. To make this setting persistent, pass the

   # systemctl disable firewalld

   19 option to the command.

4. To disable IP masquerading, enter the following command as

   # systemctl stop firewalld

   16:

   # firewall-cmd --state

   3

   To make this setting permanent, pass the

   # systemctl disable firewalld

   19 option to the command.

47.10.1. Listing and blocking ICMP requests

Listing

# systemctl disable firewalld

The

# systemctl disable firewalld

# systemctl disable firewalld

# systemctl enable firewalld

# systemctl disable firewalld

• To list all available

  # systemctl disable firewalld

  85 types:

  # systemctl status firewalld
  firewalld.service - firewalld - dynamic firewall daemon
     Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor pr
     Active: active (running) since Mon 2017-12-18 16:05:15 CET; 50min ago
       Docs: man:firewalld(1)
   Main PID: 705 (firewalld)
      Tasks: 2 (limit: 4915)
     CGroup: /system.slice/firewalld.service
             └─705 /usr/bin/python3 -Es /usr/sbin/firewalld --nofork --nopid

  2

• The

  # systemctl disable firewalld

  85 request can be used by IPv4, IPv6, or by both protocols. To see for which protocol the

  # systemctl disable firewalld

  85 request has used:

  # systemctl status firewalld
  firewalld.service - firewalld - dynamic firewall daemon
     Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor pr
     Active: active (running) since Mon 2017-12-18 16:05:15 CET; 50min ago
       Docs: man:firewalld(1)
   Main PID: 705 (firewalld)
      Tasks: 2 (limit: 4915)
     CGroup: /system.slice/firewalld.service
             └─705 /usr/bin/python3 -Es /usr/sbin/firewalld --nofork --nopid

  3

• The status of an

  # systemctl disable firewalld

  85 request shows

  # systemctl disable firewalld

  65 if the request is currently blocked or

  # systemctl disable firewalld

  67 if it is not. To see if an

  # systemctl disable firewalld

  85 request is currently blocked:

  # systemctl status firewalld
  firewalld.service - firewalld - dynamic firewall daemon
     Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor pr
     Active: active (running) since Mon 2017-12-18 16:05:15 CET; 50min ago
       Docs: man:firewalld(1)
   Main PID: 705 (firewalld)
      Tasks: 2 (limit: 4915)
     CGroup: /system.slice/firewalld.service
             └─705 /usr/bin/python3 -Es /usr/sbin/firewalld --nofork --nopid

  4

Blocking or unblocking

# systemctl disable firewalld

When your server blocks

# systemctl disable firewalld

# systemctl disable firewalld

# systemctl disable firewalld

• To see if an

  # systemctl disable firewalld

  85 request is currently blocked:

  # systemctl status firewalld
  firewalld.service - firewalld - dynamic firewall daemon
     Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor pr
     Active: active (running) since Mon 2017-12-18 16:05:15 CET; 50min ago
       Docs: man:firewalld(1)
   Main PID: 705 (firewalld)
      Tasks: 2 (limit: 4915)
     CGroup: /system.slice/firewalld.service
             └─705 /usr/bin/python3 -Es /usr/sbin/firewalld --nofork --nopid

  4

• To block an

  # systemctl disable firewalld

  85 request:

  # systemctl status firewalld
  firewalld.service - firewalld - dynamic firewall daemon
     Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor pr
     Active: active (running) since Mon 2017-12-18 16:05:15 CET; 50min ago
       Docs: man:firewalld(1)
   Main PID: 705 (firewalld)
      Tasks: 2 (limit: 4915)
     CGroup: /system.slice/firewalld.service
             └─705 /usr/bin/python3 -Es /usr/sbin/firewalld --nofork --nopid

  6

• To remove the block for an

  # systemctl disable firewalld

  85 request:

  # systemctl status firewalld
  firewalld.service - firewalld - dynamic firewall daemon
     Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor pr
     Active: active (running) since Mon 2017-12-18 16:05:15 CET; 50min ago
       Docs: man:firewalld(1)
   Main PID: 705 (firewalld)
      Tasks: 2 (limit: 4915)
     CGroup: /system.slice/firewalld.service
             └─705 /usr/bin/python3 -Es /usr/sbin/firewalld --nofork --nopid

  7

Blocking

# systemctl disable firewalld

Normally, if you block

# systemctl disable firewalld

# systemctl disable firewalld

• To block and drop all

  # systemctl disable firewalld

  85 requests:

• Set the target of your zone to

  # systemctl disable firewalld

  37:

  # systemctl status firewalld
  firewalld.service - firewalld - dynamic firewall daemon
     Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor pr
     Active: active (running) since Mon 2017-12-18 16:05:15 CET; 50min ago
       Docs: man:firewalld(1)
   Main PID: 705 (firewalld)
      Tasks: 2 (limit: 4915)
     CGroup: /system.slice/firewalld.service
             └─705 /usr/bin/python3 -Es /usr/sbin/firewalld --nofork --nopid

  8

Now, all traffic, including

# systemctl disable firewalld

To block and drop certain

# systemctl disable firewalld

1. Set the target of your zone to

   # systemctl disable firewalld

   37:

   # systemctl status firewalld
   firewalld.service - firewalld - dynamic firewall daemon
      Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor pr
      Active: active (running) since Mon 2017-12-18 16:05:15 CET; 50min ago
        Docs: man:firewalld(1)
    Main PID: 705 (firewalld)
       Tasks: 2 (limit: 4915)
      CGroup: /system.slice/firewalld.service
              └─705 /usr/bin/python3 -Es /usr/sbin/firewalld --nofork --nopid

   8

2. Add the ICMP block inversion to block all

   # systemctl disable firewalld

   85 requests at once:

   $ firewall-config

   0

3. Add the ICMP block for those

   # systemctl disable firewalld

   85 requests that you want to allow:

   # systemctl status firewalld
   firewalld.service - firewalld - dynamic firewall daemon
      Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor pr
      Active: active (running) since Mon 2017-12-18 16:05:15 CET; 50min ago
        Docs: man:firewalld(1)
    Main PID: 705 (firewalld)
       Tasks: 2 (limit: 4915)
      CGroup: /system.slice/firewalld.service
              └─705 /usr/bin/python3 -Es /usr/sbin/firewalld --nofork --nopid

   6

4. Make the new settings persistent:

   # systemctl stop firewalld

   0

The block inversion inverts the setting of the

# systemctl disable firewalld

# systemctl disable firewalld

To revert the block inversion to a fully permissive setting:

1. Set the target of your zone to

   # systemctl disable firewalld

   39 or

   # systemctl disable firewalld

   34:

   $ firewall-config

   3

2. Remove all added blocks for

   # systemctl disable firewalld

   85 requests:

   # systemctl status firewalld
   firewalld.service - firewalld - dynamic firewall daemon
      Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor pr
      Active: active (running) since Mon 2017-12-18 16:05:15 CET; 50min ago
        Docs: man:firewalld(1)
    Main PID: 705 (firewalld)
       Tasks: 2 (limit: 4915)
      CGroup: /system.slice/firewalld.service
              └─705 /usr/bin/python3 -Es /usr/sbin/firewalld --nofork --nopid

   7

3. Remove the

   # systemctl disable firewalld

   85 block inversion:

   $ firewall-config

   5

4. Make the new settings persistent:

   # systemctl stop firewalld

   0

47.10.2. Configuring the ICMP filter using GUI

• To enable or disable an

  # systemctl disable firewalld

  85 filter, start the firewall-config tool and select the network zone whose messages are to be filtered. Select the

  # systemctl mask firewalld

  28 tab and select the check box for each type of

  # systemctl disable firewalld

  85 message you want to filter. Clear the check box to disable a filter. This setting is per direction and the default allows everything.
• To enable inverting the

  # systemctl mask firewalld

  28, click the

  # systemctl mask firewalld

  31 check box on the right. Only marked

  # systemctl disable firewalld

  85 types are now accepted, all other are rejected. In a zone using the DROP target, they are dropped.

47.11.1. Configuring IP set options using CLI

IP sets can be used in

# systemctl enable firewalld

# systemctl enable firewalld

• To list the IP sets known to

  # systemctl enable firewalld

  56 in the permanent environment, use the following command as

  # systemctl stop firewalld

  16:

  $ firewall-config

  8

• To add a new IP set, use the following command using the permanent environment as

  # systemctl stop firewalld

  16:

  $ firewall-config

  9

  The previous command creates a new IP set with the name test and the

  # systemctl mask firewalld

  40 type for

  # systemctl enable firewalld

  91. To create an IP set for use with

  # systemctl enable firewalld

  92, add the

  # systemctl mask firewalld

  43 option. To make the new setting effective in the runtime environment, reload

  # systemctl enable firewalld

  56.

• List the new IP set with the following command as

  # systemctl stop firewalld

  16:

  # systemctl enable firewalld

  00

• To get more information about the IP set, use the following command as

  # systemctl stop firewalld

  16:

  # systemctl enable firewalld

  01

  Note that the IP set does not have any entries at the moment.

• To add an entry to the test IP set, use the following command as

  # systemctl stop firewalld

  16:

  # systemctl enable firewalld

  02

  The previous command adds the IP address 192.168.0.1 to the IP set.

• To get the list of current entries in the IP set, use the following command as

  # systemctl stop firewalld

  16:

  # systemctl enable firewalld

  03

• Generate a file containing a list of IP addresses, for example:

  # systemctl enable firewalld

  04

  The file with the list of IP addresses for an IP set should contain an entry per line. Lines starting with a hash, a semi-colon, or empty lines are ignored.

• To add the addresses from the iplist.txt file, use the following command as

  # systemctl stop firewalld

  16:

  # systemctl enable firewalld

  05

• To see the extended entries list of the IP set, use the following command as

  # systemctl stop firewalld

  16:

  # systemctl enable firewalld

  06

• To remove the addresses from the IP set and to check the updated entries list, use the following commands as

  # systemctl stop firewalld

  16:

  # systemctl enable firewalld

  07

• You can add the IP set as a source to a zone to handle all traffic coming in from any of the addresses listed in the IP set with a zone. For example, to add the test IP set as a source to the drop zone to drop all packets coming from all entries listed in the test IP set, use the following command as

  # systemctl stop firewalld

  16:

  # systemctl enable firewalld

  08

  The

  # systemctl mask firewalld

  53 prefix in the source shows

  # systemctl enable firewalld

  56 that the source is an IP set and not an IP address or an address range.

Only the creation and removal of IP sets is limited to the permanent environment, all other IP set options can be used also in the runtime environment without the

# systemctl disable firewalld

Warning

Red Hat does not recommend using IP sets that are not managed through

# systemctl enable firewalld

# systemctl enable firewalld

# systemctl enable firewalld

# systemctl mask firewalld

47.12.1. How the priority parameter organizes rules into different chains

You can set the

# systemctl mask firewalld

# systemctl mask firewalld

# systemctl mask firewalld

The

# systemctl enable firewalld

• Priority lower than 0: the rule is redirected into a chain with the

  # systemctl mask firewalld

  67 suffix.
• Priority higher than 0: the rule is redirected into a chain with the

  # systemctl mask firewalld

  68 suffix.
• Priority equals 0: based on the action, the rule is redirected into a chain with the

  # systemctl mask firewalld

  69,

  # systemctl mask firewalld

  70, or

  # systemctl mask firewalld

  71 the action.

Inside these sub-chains,

# systemctl enable firewalld

47.12.2. Setting the priority of a rich rule

The procedure describes an example of how to create a rich rule that uses the

# systemctl mask firewalld

Procedure

1. Add a rich rule with a very low precedence to log all traffic that has not been matched by other rules:

   # systemctl enable firewalld

   09

   The command additionally limits the number of log entries to

   # systemctl mask firewalld

   74 per minute.

2. Optionally, display the

   # systemctl enable firewalld

   60 rule that the command in the previous step created:

   # systemctl enable firewalld

   10

47.13.1. Configuring lockdown using CLI

This procedure describes how to enable or disable lockdown using the command line.

• To query whether lockdown is enabled, use the following command as

  # systemctl stop firewalld

  16:

  # systemctl enable firewalld

  11

  The command prints

  # systemctl disable firewalld

  65 with exit status

  # systemctl disable firewalld

  66 if lockdown is enabled. It prints

  # systemctl disable firewalld

  67 with exit status

  # systemctl disable firewalld

  68 otherwise.

• To enable lockdown, enter the following command as

  # systemctl stop firewalld

  16:

  # systemctl enable firewalld

  12

• To disable lockdown, use the following command as

  # systemctl stop firewalld

  16:

  # systemctl enable firewalld

  13

47.13.2. Configuring lockdown allowlist options using CLI

The lockdown allowlist can contain commands, security contexts, users and user IDs. If a command entry on the allowlist ends with an asterisk "*", then all command lines starting with that command will match. If the "*" is not there then the absolute command including arguments must match.

• The context is the security (SELinux) context of a running application or service. To get the context of a running application use the following command:

  # systemctl enable firewalld

  14

  That command returns all running applications. Pipe the output through the grep tool to get the application of interest. For example:

  # systemctl enable firewalld

  15

• To list all command lines that are in the allowlist, enter the following command as

  # systemctl stop firewalld

  16:

  # systemctl enable firewalld

  16

• To add a command command to the allowlist, enter the following command as

  # systemctl stop firewalld

  16:

  # systemctl enable firewalld

  17

• To remove a command command from the allowlist, enter the following command as

  # systemctl stop firewalld

  16:

  # systemctl enable firewalld

  18

• To query whether the command command is in the allowlist, enter the following command as

  # systemctl stop firewalld

  16:

  # systemctl enable firewalld

  19

  The command prints

  # systemctl disable firewalld

  65 with exit status

  # systemctl disable firewalld

  66 if true. It prints

  # systemctl disable firewalld

  67 with exit status

  # systemctl disable firewalld

  68 otherwise.

• To list all security contexts that are in the allowlist, enter the following command as

  # systemctl stop firewalld

  16:

  # systemctl enable firewalld

  20

• To add a context context to the allowlist, enter the following command as

  # systemctl stop firewalld

  16:

  # systemctl enable firewalld

  21

• To remove a context context from the allowlist, enter the following command as

  # systemctl stop firewalld

  16:

  # systemctl enable firewalld

  22

• To query whether the context context is in the allowlist, enter the following command as

  # systemctl stop firewalld

  16:

  # systemctl enable firewalld

  23

  Prints

  # systemctl disable firewalld

  65 with exit status

  # systemctl disable firewalld

  66, if true, prints

  # systemctl disable firewalld

  67 with exit status

  # systemctl disable firewalld

  68 otherwise.

• To list all user IDs that are in the allowlist, enter the following command as

  # systemctl stop firewalld

  16:

  # systemctl enable firewalld

  24

• To add a user ID uid to the allowlist, enter the following command as

  # systemctl stop firewalld

  16:

  # systemctl enable firewalld

  25

• To remove a user ID uid from the allowlist, enter the following command as

  # systemctl stop firewalld

  16:

  # systemctl enable firewalld

  26

• To query whether the user ID uid is in the allowlist, enter the following command:

  # systemctl enable firewalld

  27

  Prints

  # systemctl disable firewalld

  65 with exit status

  # systemctl disable firewalld

  66, if true, prints

  # systemctl disable firewalld

  67 with exit status

  # systemctl disable firewalld

  68 otherwise.

• To list all user names that are in the allowlist, enter the following command as

  # systemctl stop firewalld

  16:

  # systemctl enable firewalld

  28

• To add a user name user to the allowlist, enter the following command as

  # systemctl stop firewalld

  16:

  # systemctl enable firewalld

  29

• To remove a user name user from the allowlist, enter the following command as

  # systemctl stop firewalld

  16:

  # systemctl enable firewalld

  30

• To query whether the user name user is in the allowlist, enter the following command:

  # systemctl enable firewalld

  31

  Prints

  # systemctl disable firewalld

  65 with exit status

  # systemctl disable firewalld

  66, if true, prints

  # systemctl disable firewalld

  67 with exit status

  # systemctl disable firewalld

  68 otherwise.

47.13.3. Configuring lockdown allowlist options using configuration files

The default allowlist configuration file contains the

# systemctl enable firewalld

# firewall-cmd --check-config
success

+ The allowlist configuration files are stored in the

# firewall-cmd --check-config
success

# systemctl enable firewalld

Following is an example allowlist configuration file enabling all commands for the

# systemctl enable firewalld

# firewall-cmd --check-config
success

# systemctl enable firewalld

This example shows both

# firewall-cmd --check-config
success

# firewall-cmd --check-config
success

# systemctl enable firewalld

In that example, only the

# firewall-cmd --check-config
success

In Red Hat Enterprise Linux, all utilities are placed in the

# firewall-cmd --check-config
success

# firewall-cmd --check-config
success

# firewall-cmd --check-config
success

# systemctl enable firewalld

# systemctl stop firewalld

# firewall-cmd --check-config
success

# firewall-cmd --check-config
success

# systemctl stop firewalld

# firewall-cmd --check-config
success

# firewall-cmd --check-config
success

# systemctl stop firewalld

The

# firewall-cmd --check-config
success

# firewall-cmd --check-config
success

47.14.1. The difference between intra-zone forwarding and zones with the default target set to ACCEPT

When intra-zone forwarding is enabled, the traffic within a single

# systemctl enable firewalld

Note that, if you enable intra-zone forwarding in the default zone of

# systemctl enable firewalld

The

# systemctl enable firewalld

# systemctl enable firewalld

# systemctl disable firewalld

As for other default target values, forwarded traffic is dropped by default, which applies to all standard zones except the trusted zone.

47.14.2. Using intra-zone forwarding to forward traffic between an Ethernet and Wi-Fi network

You can use intra-zone forwarding to forward traffic between interfaces and sources within the same

# systemctl enable firewalld

# firewall-cmd --check-config
success

# firewall-cmd --check-config
success

Procedure

1. Enable packet forwarding in the kernel:

   # systemctl enable firewalld

   35

2. Ensure that interfaces between which you want to enable intra-zone forwarding are not assigned to a zone different than the

   # systemctl enable firewalld

   97 zone:

   # systemctl enable firewalld

   36

3. If the interface is currently assigned to a zone other than

   # systemctl enable firewalld

   97, reassign it:

   # systemctl enable firewalld

   37

4. Add the

   # firewall-cmd --check-config
   success

   43 and

   # firewall-cmd --check-config
   success

   44 interfaces to the

   # systemctl enable firewalld

   97 zone:

   # systemctl enable firewalld

   38

5. Enable intra-zone forwarding:

   # systemctl enable firewalld

   39

Verification

The following verification steps require that the

# firewall-cmd --check-config
success

1. Log in to a host that is in the same network as the

   # firewall-cmd --check-config
   success

   43 interface of the host you enabled zone forwarding on.

2. Start an echo service with

   # firewall-cmd --check-config
   success

   52 to test connectivity:

   # systemctl enable firewalld

   40
3. Log in to a host that is in the same network as the

   # firewall-cmd --check-config
   success

   44 interface.

4. Connect to the echo server running on the host that is in the same network as the

   # firewall-cmd --check-config
   success

   43:

   # systemctl enable firewalld

   41
5. Type something and press Enter, and verify the text is sent back.

Additional resources

• # systemctl disable firewalld

  55 man page

47.15.1. Introduction to the # systemctl stop firewalld36 RHEL System Role

RHEL System Roles is a set of contents for the Ansible automation utility. This content together with the Ansible automation utility provides a consistent configuration interface to remotely manage multiple systems.

The

# firewall-cmd --check-config
success

# systemctl enable firewalld

# firewall-cmd --check-config
success

To apply the

# systemctl enable firewalld

# systemctl stop firewalld

You can use an inventory file to define a set of systems that you want Ansible to configure.

With the

# systemctl stop firewalld

# systemctl enable firewalld

• Zones.
• The services for which packets should be allowed.
• Granting, rejection, or dropping of traffic access to ports.
• Forwarding of ports or port ranges for a zone.

Additional resources

• # firewall-cmd --check-config
  success

  70 and

  # firewall-cmd --check-config
  success

  71 files in the

  # firewall-cmd --check-config
  success

  72 directory
• Working with playbooks
• How to build your inventory

47.15.2. Resetting the firewalld settings using the firewall RHEL System Role

With the

# systemctl stop firewalld

# systemctl enable firewalld

# firewall-cmd --check-config
success

# systemctl enable firewalld

# firewall-cmd --check-config
success

# systemctl stop firewalld

Run this procedure on Ansible control node.

Prerequisites

• The

  # firewall-cmd --check-config
  success

  79 and

  # firewall-cmd --check-config
  success

  65 packages are installed on the control node.
• If you use a different remote user than root when you run the playbook, you must have appropriate sudo permissions on the managed node.
• One or more managed nodes that you configure with the

  # systemctl stop firewalld

  36 RHEL System Role.

Procedure

1. If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the

   # firewall-cmd --check-config
   success

   82 Ansible inventory file:

   # systemctl enable firewalld

   42

2. Create the

   # firewall-cmd --check-config
   success

   83 playbook with the following content:

   # systemctl enable firewalld

   43

3. Run the playbook:

   1. To connect as root user to the managed node:

      # systemctl enable firewalld

      44

   2. To connect as a user to the managed node:

      # systemctl enable firewalld

      45

      The

      # firewall-cmd --check-config
      success

      84 option makes sure that the

      # firewall-cmd --check-config
      success

      85 command prompts for the sudo password of the user defined in the

      # firewall-cmd --check-config
      success

      86 option.

If you do not specify the

# firewall-cmd --check-config
success

# firewall-cmd --check-config
success

Verification

• Run this command as root on the managed node to check all the zones:

  # systemctl enable firewalld

  46

Additional resources

• # firewall-cmd --check-config
  success

  89

• # firewall-cmd --check-config
  success

  90

• # firewall-cmd --check-config
  success

  91

47.15.3. Forwarding incoming traffic from one local port to a different local port

With the

# systemctl stop firewalld

# systemctl enable firewalld

Perform this procedure on the Ansible control node.

Prerequisites

• You have prepared the control node and the managed nodes
• You are logged in to the control node as a user who can run playbooks on the managed nodes.
• The account you use to connect to the managed nodes has

  # firewall-cmd --check-config
  success

  94 permissions on the them.
• The hosts or host groups on which you want run this playbook are listed in the Ansible inventory file.

Procedure

1. Create a playbook file, for example

   # firewall-cmd --check-config
   success

   95, with the following content:

   # systemctl enable firewalld

   47

2. Run the playbook:

   # systemctl enable firewalld

   48

Verification

• On the managed host, display the

  # systemctl enable firewalld

  56 settings:

  # systemctl enable firewalld

  49

Additional resources

• # firewall-cmd --check-config
  success

  89

47.15.4. Configuring ports using System Roles

You can use the RHEL

# systemctl stop firewalld

Perform this procedure on the Ansible control node.

Prerequisites

• You have prepared the control node and the managed nodes
• You are logged in to the control node as a user who can run playbooks on the managed nodes.
• The account you use to connect to the managed nodes has

  # firewall-cmd --check-config
  success

  94 permissions on the them.
• The hosts or host groups on which you want run this playbook are listed in the Ansible inventory file.

Procedure

1. Create a playbook file, for example

   # firewall-cmd --check-config
   Error: INVALID_PROTOCOL: 'public.xml': 'tcpx' not from {'tcp'|'udp'|'sctp'|'dccp'}

   00, with the following content:

   # systemctl enable firewalld

   50

   The

   # firewall-cmd --check-config
   Error: INVALID_PROTOCOL: 'public.xml': 'tcpx' not from {'tcp'|'udp'|'sctp'|'dccp'}

   01 option makes the new settings persistent across reboots.

2. Run the playbook:

   # systemctl enable firewalld

   51

Verification

• On the managed node, verify that the

  # firewall-cmd --check-config
  Error: INVALID_PROTOCOL: 'public.xml': 'tcpx' not from {'tcp'|'udp'|'sctp'|'dccp'}

  02 port associated with the

  # firewall-cmd --check-config
  Error: INVALID_PROTOCOL: 'public.xml': 'tcpx' not from {'tcp'|'udp'|'sctp'|'dccp'}

  03 service is open:

  What are two layer 2 firewall filter types?

  Two-Color and Three-Color Logical Interface Policers..

  Two-Color and Three-Color Physical Interface Policers..

  What is a firewall filter?

  A packet filtering firewall is a network security feature that controls the flow of incoming and outgoing network data. The firewall examines each packet, which comprises user data and control information, and tests them according to a set of pre-established rules.

  Which routing instance type is used for filter based forwarding applications?

  VRF. The VRF instance type is used when creating an L3VPN. This is a VRF (VPN Routing and Forwarding) in the traditional sense of the term.

  What is a valid action for firewall filter?

  Actions include accept, reject, discard, log, count, sample, next-term, and others. The 'reject' action will deny a packet and send an ICMP response. The 'discard' action will deny a packet silently.