LINUX-30
FIREWALLD (RHEL7) -P3
Other Posts under firewalld,
FIREWALLD (RHEL7) -P3
INTERFACES
& FIREWALLD:
How
to add an interface to a zone
How
to change an interface from one zone to another
How
to remove an interface from a zone
How
to list interfaces assigned to a zone
How
to List the zone to which an interface is assigned
Any
connection needs an interface to pass, whenever any packet enters to firewalld
enabled server it must be sorted based on defined zone. Sounds great, but if I
use active interfaces to sort packets coming to/from an interface to flow in to
a zone then it would be more convenient.
All
active interfaces will be assigned to zones, either to the default zone or to a
user-specified one. However, an interface cannot be assigned to more than one
zone. In default scenario, firewalld club all active interfaces (ifconfig -a)
with public zone
The
firewalld_interface resource will add a network interface to a zone for the
current and permanent configurations. The interface name is a string that
should match a network interface on the system. If zone is omitted, default
zone will be used.
Actions
Add: Add the
interface to the current and permanent configuration.
Change: Change the
interface to the current and permanent configuration. (default)
Remove: Remove the
interface from the current and permanent configuration.
Let’s
check my details, here default/active zone is “work”. Though the “work” is
currently my default zone so all interfaces are by default assigned to my
default zone which is “work” here.
[root@rhel7-server ~]#
firewall-cmd --get-default-zone
work
[root@rhel7-server ~]#
firewall-cmd --get-active-zones
work
interfaces: eth0 eth1 eth2
Let’s check the “public” zone as well,
[root@rhel7-server ~]# firewall-cmd --zone=public --list-all
public
interfaces:
sources:
services: dhcpv6-client ssh
ports: 3000-4000/udp 80/tcp 3000-4000/tcp
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
Let’s change the default zone and see
the assignment of interfaces,
[root@rhel7-server ~]# firewall-cmd --set-default-zone=public
Success
[root@rhel7-server ~]# firewall-cmd --zone=public --list-all
public
(default, active)
interfaces: eth0 eth1 eth2
sources:
services: dhcpv6-client ssh
ports: 3000-4000/udp 80/tcp 3000-4000/tcp
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
[root@rhel7-server ~]#
firewall-cmd --get-default-zone
public
There are no more interfaces with zone
“work” now,
[root@rhel7-server ~]# firewall-cmd --zone=work --list-all
work
interfaces:
sources:
services: dhcpv6-client ftp ipp-client nfs
ssh
ports: 3306/tcp 80/tcp
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
We
can see that interfaces are by default assigned to default zone.
Let’s
try to remove interface from our default zone which is “public” now,
THIS EXERCISE IS TO ADD
INTERFACE PERMANENTLY,
# firewall-cmd --remove-interface=eth2 --zone=public --permanent
success
[root@rhel7-server ~]# firewall-cmd --reload
success
[root@rhel7-server ~]# firewall-cmd --get-zone-of-interface=eth2
public
NO
luck, its getting re-attached to “Public” zone automatically.
Let’s
remove from public and add to another zone,
# firewall-cmd --remove-interface=eth2 --zone=public --permanent
success
# firewall-cmd --add-interface=eth2 --zone=work --permanent
success
[root@rhel7-server ~]# firewall-cmd --get-zone-of-interface=eth2
public
[root@rhel7-server ~]# firewall-cmd --reload
success
[root@rhel7-server ~]# firewall-cmd --get-zone-of-interface=eth2
public
Still
no luck, but I really want to add my “eth2” to “work” zone.
WORKAROUND:
[root@rhel7-server ~]# vi /etc/sysconfig/network-scripts/ifcfg-eth2
ZONE=work
çç added this at
end
Now again I did,
# firewall-cmd --remove-interface=eth2 --zone=public --permanent
success
# firewall-cmd --add-interface=eth2 --zone=work --permanent
success
[root@rhel7-server ~]# firewall-cmd --get-zone-of-interface=eth2
public
still, no changes…… let’s reload and see
[root@rhel7-server ~]# firewall-cmd --reload
success
[root@rhel7-server ~]# firewall-cmd --get-zone-of-interface=eth2
public
Still, same situation…… Now let’s
restart the network,
[root@rhel7-server ~]# systemctl restart network
[root@rhel7-server ~]# firewall-cmd --get-zone-of-interface=eth2
work
Ohhhhh…… Finally,
If we
want to add/change/remove interfaces temporarily then just remove the --permanent
tag from above commands and do not reload.
Note: Zone change for
network interfaces is for the current session only. To permanently change zone
of an interface, we need to edit network-interface file
ZONE=<zone
name>
So, what we learned,
How to add an interface to a
zone
# firewall-cmd --add-interface=eth1 --zone=work
How to change an interface from
one zone to another
# firewall-cmd --change-interface=eth1 --zone=work
How to remove an interface from
a zone
# firewall-cmd --remove-interface=eth2 --zone=public
How to list interfaces
assigned to a zone
# firewall-cmd --zone=work --list-all
How to List the zone to
which an interface is assigned
# firewall-cmd --get-zone-of-interface=eth2
**if need to add/remove/change
permanently then add "--permanent" at end without quotes.
No comments:
Post a Comment