How to Install Firewalld on CentOS Stream 9 or 8

This guide will demonstrate how to install Firewalld on CentOS Stream 9 or 8 using the command-line terminal, accompanied by an introduction to Firewalld commands.

Firewalld, a dynamic firewall manager, stands as a fundamental tool in managing network traffic on CentOS Stream environments, whether on desktops or, more critically, on servers. Its role is pivotal in defining and enforcing rules regulating network access and security, making it a trusted ally for users, system administrators, and developers. Firewalld’s flexibility and robust feature set offer numerous benefits:

• Dynamic Zone Management: Allows real-time updates of firewall rules without needing a restart.
• Rich Language for Rules: Enables precise and complex rule definitions.
• IPv4 and IPv6 Support: Ensures compatibility with diverse network architectures.
• Integration with D-Bus: Facilitates easy interaction with other services and applications.
• Direct Interface Control: Empowers direct management of interfaces and sources within zones.
• Support for Masquerading and Port Forwarding: Enhances network address translation and routing capabilities.
• Lockdown Mode: Provides an extra layer of security against unauthorized modifications.

In understanding Firewalld’s architecture and features, users gain the ability to meticulously tailor their firewall settings, ensuring a secure and efficient network environment.

Install Firewalld on CentOS Stream via DNF

Check for Existing Firewalld Installation

Begin by verifying if Firewalld is already installed on your CentOS Stream system. This step is essential to prevent conflicts during installation. Use the command:

firewall-cmd --version

This command displays the current version of Firewalld if it’s installed. An error message will appear if not installed, indicating Firewalld’s absence.

Install Firewalld Using DNF Command

In case Firewalld is not present on your CentOS Stream system, proceed to install it using the DNF package manager. DNF, being the default package manager for CentOS Stream, ensures smooth installation.

Run the installation command:

sudo dnf install firewalld

This command directs DNF to retrieve and install the Firewalld package from the CentOS Stream repositories, setting the stage for enhanced network security.

Enable Firewalld Service

After installing Firewalld, it’s crucial to enable it so it starts automatically with your system. Enabling Firewalld ensures your network remains protected from the get-go.

Execute this command to enable the Firewalld service:

sudo systemctl enable firewalld

This systemctl command activates the Firewalld service, ensuring its automatic launch at system startup, thus maintaining continuous network protection.

Verify Firewalld Service Status

To conclude, confirm that the Firewalld service is active and running correctly. This verification ensures that Firewalld is set up properly and functioning as expected.

Use this command to check the service status:

sudo systemctl status firewalld

A successful output will show Firewalld’s active and running status.

Basic Firewalld Commands on CentOS Stream

Understanding Firewalld Command Syntax

Effectively managing Firewalld on CentOS Stream hinges on understanding its command syntax. A Firewalld command typically follows this pattern:

firewall-cmd [options] <command>

Here, firewall-cmd is your direct line to Firewalld’s functionalities. The [options] segment modifies the command’s action, offering versatility. Common options are --zone for targeting specific firewall zones, --permanent to ensure changes survive reboots, and --reload for immediate effect without service interruption. The <command> defines the action, like modifying services or rules.

Display All Configured Firewalld Zones

To get an overview of all zones, which are virtual partitions of your network with distinct rules, use:

firewall-cmd --list-all-zones

This command lists each zone with its respective rules and settings, providing a clear picture of your current network segmentation and policy.

Retrieve the Current Firewalld Default Zone

Knowing the default zone, which is the automatic choice for incoming and outgoing traffic, is vital:

firewall-cmd --get-default-zone

This command quickly identifies your primary line of network defense and traffic regulation.

Set a New Firewalld Default Zone

Tailoring your network security starts by setting a preferred default zone:

firewall-cmd --set-default-zone=zone_name

Replace zone_name with your chosen zone to customize how your system initially handles network traffic.

List Services in a Firewalld Zone

Understanding what services are allowed in a specific zone helps maintain robust security:

firewall-cmd --zone=zone_name --list-services

This command, with zone_name as your target zone, displays all services permitted, ensuring you’re aware of the potential entry points in that segment of your network.

Add a Service to a Firewalld Zone

Expanding a zone’s capabilities involves adding new services:

firewall-cmd --zone=zone_name --add-service=service_name

Insert zone_name and service_name to enhance the zone with additional functionalities, like HTTP or FTP access.

Remove a Service from a Firewalld Zone

To streamline a zone or close off vulnerabilities, removing services is key:

firewall-cmd --zone=zone_name --remove-service=service_name

This command excises service_name from zone_name, tightening your security posture.

Apply Changes with Firewalld Reload

For changes to take effect immediately, without disrupting current connections:

firewall-cmd --reload

This command refreshes Firewalld, activating your adjustments in real-time.

View All Rules Within a Firewalld Zone

A comprehensive view of a zone’s rules offers insight into its security setup:

firewall-cmd --zone=zone_name --list-all

Detailing every rule in zone_name, this command helps audit your security measures.

Add a Specific Port to a Firewalld Zone

Customizing a zone’s traffic flow can involve opening specific ports:

firewall-cmd --zone=zone_name --add-port=port_number/protocol

Replace zone_name, port_number, and protocol (tcp or udp) to enable specific types of network traffic.

Remove a Port from a Firewalld Zone

To close off a network path:

firewall-cmd --zone=zone_name --remove-port=port_number/protocol

This command shuts the specified port_number with protocol in zone_name, enhancing network security.

Conclusion

That’s a wrap! We’ve walked through the basics of installing and managing Firewalld on CentOS Stream, from checking if it’s already on your system to adding and removing services and ports. Remember, keeping Firewalld up-to-date and regularly reviewing your firewall settings is key to maintaining a secure network. Don’t hesitate to tweak and tailor it to fit your needs; a well-configured firewall is the backbone of your system’s security.