FirewallD

• Drop: Any incoming packets are dropped, if we use this drop zone. This is same as we use to add iptables -j drop. If we use the drop rule, means there is no reply, only outgoing network connections will be available.

• Block: Block zone will deny the incoming network connections are rejected with an icmp-host-prohibited. Only established connections within the server will be allowed.

• Public: To accept the selected connections we can define rules in public zone. This will only allow the specific port to open in our server other connections will be dropped.

• External: This zone will act as router options with masquerading is enabled other connections will be dropped and will not accept, only specified connection will be allowed.

• DMZ: If we need to allow access to some of the services to public, you can define in DMZ zone. This too have the feature of only selected incoming connections are accepted.

• Work: In this zone, we can define only internal networks i.e. private networks traffic are allowed.

• Home: This zone is specially used in home areas, we can use this zone to trust the other computers on networks to not harm your computer as every zone. This too allow only the selected incoming connections.

• Internal: This one is similar to work zone with selected allowed connections.

• Trusted: If we set the trusted zone all the traffic are accepted.

# firewall-cmd --add-interface=[INTERFACE] --zone=internal --permanent

Editar a interface em /etc/sysconfig/network-scripts/ifcfg-[INTERFACE] e incluir :

[...]
ZONE=internal

Criar o arquivo /etc/network/if-pre-up.d/firewalld-zone-internal :

nmcli connection modify [INTERFACE] connection.zone internal

Permissão de execução:

# chmod +x /etc/network/if-pre-up.d/firewalld-zone-internal

Em public (quando não informamos a zona):

# firewall-cmd --add-service=http --permanent

Em outra zona:

# firewall-cmd --zone=internal --add-service=http --permanent

# firewall-cmd --add-port=1234/[tcp ou udp] --permanent

# firewall-cmd --reload

# firewall-cmd --get-active-zones

# firewall-cmd --get-services  

# firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="10.0.0.0/8" service name="http" accept"

# firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="146.164.0.0/16" port port=9101 protocol=tcp accept"

Pode-se também liberar um range de portas:

# firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="146.164.0.0/16" port port=9101-9109 protocol=tcp accept"

Obs.: O parâmetro –remove-rich-rule remove as regras citadas acima.

O modo pânico bloqueia qualquer a passagem de dados, tanto as conexões de entrada quanto as de saída.

# firewall-cmd --panic-on

Para desligar o modo pânico, o comando é:

# firewall-cmd --panic-off

Para verificar se o modo pânico está ativo ou não:

# firewall-cmd --query-panic

# firewall-cmd --zone=external --add-masquerade

Verificar se o recurso masquerade está liberado no firewall:

# firewall-cmd --zone=external --query-masquerade

# firewall-cmd --zone=external --add-forward-port=port=22:proto=tcp:toport=2222:toaddr=192.168.0.132

Listando os serviços ICMP disponíveis no FirewallD:

# firewall-cmd --get-icmptypes

Verificando se um serviço ICMP está ou não bloqueado:

# firewall-cmd --zone=public --query-icmp-block=echo-reply

Bloqueando um serviço ICMP:

# firewall-cmd --zone=public --add-icmp-block=echo-reply

Listar regras:

# firewall-cmd --direct --get-rules ipv4 filter IN_public_allow

Adicionar uma nova regra:

# firewall-cmd --direct --add-rule ipv4 filter IN_public_allow 0 -m tcp -p tcp --dport 25 -j ACCEPT

Remover uma regra já existente:

# firewall-cmd --direct --remove-rule ipv4 filter IN_public_allow 0 -m tcp -p tcp --dport 25 -j ACCEPT

• https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Using_Firewalls.html
• http://www.tecmint.com/firewalld-rules-for-centos-7/
• https://www.rootusers.com/how-to-use-firewalld-rich-rules-and-zones-for-filtering-and-nat/