In this video you'll learn about Firewall-D.
Firewall-D is the default firewall on Red Hat and Family.
Firewall-D uses a couple of ingredients.
First ingredient is the zone.
A zone is a collection of one or more network cards
that is facing a specific direction
and to which rules can be assigned.
So if you have multiple internal network cards
or multiple outgoing network cards,
you can put all of them in a zone
and build your rules on top of that.
Interfaces is how we call individual network cards.
But interfaces in Firewall-D are always part of a zone.
And then there are services.
A service in Firewall-D is an XML-based configuration
that specifies ports to be opened
and modules that should be used.
We have forward ports,
which are used to send traffic coming in on a specific port
to another port which may be on another machine.
This is port forwarding.
And you can use it to redirect traffic.
And there is masquerading, IP masquerading,
which provides network address translation on the router.
So if your Firewall-D server is a router,
enable IP masquerading
and all the nodes on the private network
that this router is connected to
can use your Firewall to go out into the Internet
without being visible themselves.
Firewall-D rich rules are an extension to the Firewall-D syntax
to make more complex configuration possible.
In order to work with Firewall-D,
Firewall-CMD is your main command.
It may appear overwhelming,
but it is not, and it is very well structured.
The elements previously listed can be managed easily
by using Firewall-CMD minus minus help.
You can get the syntax description.
And I would advise you do that.
Try, for instance, Firewall-CMD minus minus help pipe grab services,
and you will see all the commands that relate to services.
Now, many elements in Firewall-D have a get, set, and list option.
So list services will list your current configuration.
Get services will show you what is available.
Add service will add something,
and remove service is going to remove it.
Now, there is one more thing to remember about Firewall-D,
and that is the minus minus permanent option.
Whatever you do in Firewall-D, you need to do it twice.
First, you add it to a runtime.
Then you add it to permanent.
So if you want to use Firewall-CMD minus minus add services SSH,
you add the SSH service.
You need to repeat your commands
and do it again using Firewall-CMD minus minus add services SSH
minus minus permanent,
because otherwise you will lose it after a reboot.
Let me show you.
So I'm starting with Firewall-CMD minus minus list all,
which is giving the current configuration.
And there we can see that we are in the default zone.
Default, that's the zone name.
And Firewall-D is active.
In this default zone,
we have the one and only network interface ENS160,
and we have some default services that are available,
including Cockpit, DHCP, v6 client, and SSH.
Now, if I use Firewall-CMD minus minus get services,
I get a list of all the services that are available.
So if I want to see what is behind, let's say, NFS v3,
I can look up the service file,
which is in user lib Firewall-D services NFS3.xml.
And there you can see that NFS3.xml is opening TCP
as well as UDP port 2049.
And how about NFS.xml?
It's also opening port 2049.
Well, that's kind of disappointing.
But if I want to add it,
then I'm going to use Firewall-CMD minus minus add service NFS3.
And now Firewall-CMD minus minus list services
is showing all the services that are currently available.
You might be better off using list all, by the way.
That will show all the information, including the services.
And as you can see, NFS3 is available.
But if I would use Firewall-CMD minus minus reload,
then it reloads, and look here, NFS3 is gone.
So what are we going to do about it?
Well, one option is to use it twice.
Another option would be to use Firewall-CMD minus minus add service
is NFS3 minus minus permanent.
And now list all is not showing it.
But if we do the Firewall-CMD reload again,
it's going to reload, including the persistent configuration.
And then you will see that NFS3 will show up as well.
And that concludes our small introduction to Firewall-CMD.