CentOS 7のFirewallでforward-portsの設定

CentOS 7の勉強をコツコツとやっていますがFirewall機能も大幅に変わっています。

基本的なコマンド操作は何となく理解しましたが(firewall-cmdを自在に操れるわけではない;_;)Ports forwardが出来そうなので試してみました。

FirewallD/jp – FedoraProject(日本語)
https://fedoraproject.org/wiki/FirewallD/jp

firewalld – Fedora(英語)
https://fedoraproject.org/wiki/FirewallD

上記ドキュメントに下記の記述があります。

■ゾーンでポート転送あるいはポートマッピングを永続的に有効化する。

Shell

firewall-cmd [--zone=<zone>] --add-forward-port=port=<port>[-<port>]:proto=<protocol> { :toport=<port>[-<port>] | :toaddr=<address> | :toport=<port>[-<port>]:toaddr=<address> }

1

firewall-cmd [--zone=<zone>] --add-forward-port=port=<port>[-<port>]:proto=<protocol> { :toport=<port>[-<port>] | :toaddr=<address> | :toport=<port>[-<port>]:toaddr=<address> }

ポートは、他のホストの同じポートや、同じホストの別のポート、あるいは別のホストの別のポートにマップされます。ポートは単一のポートや–というポートの範囲を使えます。プロトコルはtcpかudpです。toportはポートや–というポートの範囲を使えます。toaddrはIPv4アドレスです。ポート転送はカーネルの制限によりIPv4のみです。

今回のテスト環境は
■ CentOS Linux release 7.1.1503 (Core)
■ kernel: 3.10.0-229.4.2.el7.x86_64
■ firewalld-0.3.9-11.el7.noarch
■ LANは一つ
■ Firewallのデフォルトゾーンはpublic

テスト内容はCentOS 7のポート:13389への接続は別のWindowsサーバ(IP:192.168.1.11)のポート:3389(Windows RDP)に転送する。
いわゆるCentOS 7のマシンを踏み台にして別のWindows Serverにリモート接続しようってことです。

今回はpermanentオプションを指定していません。
再起動後も設定を有効にしたい場合はpermanentオプションを指定して下さい。

masqueradeを有効にする

[root@host02 ~]# firewall-cmd --add-masquerade
success
[root@host02 ~]# firewall-cmd --list-all
public (default, active)
  interfaces: eno16777736
  sources:
  services: dhcpv6-client http ssh
  ports:
  masquerade: yes
  forward-ports:
  icmp-blocks:
  rich rules:

[root@host02 ~]# firewall-cmd --add-masquerade

success

[root@host02 ~]# firewall-cmd --list-all

public (default, active)

interfaces: eno16777736

sources:

services: dhcpv6-client http ssh

ports:

masquerade: yes

forward-ports:

icmp-blocks:

rich rules:

ポート13389を許可

[root@host02 ~]# firewall-cmd --add-port=13389/tcp
 success
[root@host02 ~]# firewall-cmd --list-all
public (default, active)
  interfaces: eno16777736
  sources:
  services: dhcpv6-client http ssh
  ports: 13389/tcp
  masquerade: yes
  forward-ports:
  icmp-blocks:
  rich rules:

[root@host02 ~]# firewall-cmd --add-port=13389/tcp

success

[root@host02 ~]# firewall-cmd --list-all

public (default, active)

interfaces: eno16777736

sources:

services: dhcpv6-client http ssh

ports: 13389/tcp

masquerade: yes

forward-ports:

icmp-blocks:

rich rules:

ポート転送を設定

[root@host02 ~]# firewall-cmd --add-forward-port=port=13389:proto=tcp:toport=3389:toaddr=192.168.1.11
success
[root@host02 ~]# firewall-cmd --list-all
public (default, active)
  interfaces: eno16777736
  sources:
  services: dhcpv6-client http ssh
  ports: 13389/tcp
  masquerade: yes
  forward-ports: port=13389:proto=tcp:toport=3389:toaddr=192.168.1.11
  icmp-blocks:
  rich rules:

[root@host02 ~]# firewall-cmd --add-forward-port=port=13389:proto=tcp:toport=3389:toaddr=192.168.1.11

success

[root@host02 ~]# firewall-cmd --list-all

public (default, active)

interfaces: eno16777736

sources:

services: dhcpv6-client http ssh

ports: 13389/tcp

masquerade: yes

forward-ports: port=13389:proto=tcp:toport=3389:toaddr=192.168.1.11

icmp-blocks:

rich rules:

これでWindows PCから”mstsc /v CentOS_ip:13389″を実行すればWindows Serverへのリモートデスクトップ接続ができました。
いつもはsshdのポート転送で接続していましたが、この方法も構築時の候補の一つになりそうです。

■ man firewall-cmd

FIREWALL-CMD(1)                  firewall-cmd                  FIREWALL-CMD(1)

NAME
       firewall-cmd - firewalld command line client

SYNOPSIS
       firewall-cmd [OPTIONS...]

DESCRIPTION
       firewall-cmd is the command line client of the firewalld daemon. It
       provides interface to manage runtime and permanent configuration.

       The runtime configuration in firewalld is separated from the permanent
       configuration. This means that things can get changed in the runtime or
       permanent configuration.

OPTIONS
       The following options are supported:

   General Options
       -h, --help
           Prints a short help text and exits.

       -V, --version
           Print the version string of firewalld. This option is not
           combinable with other options.

       -q, --quiet
           Do not print status messages.

   Status Options
       --state
           Check whether the firewalld daemon is active (i.e. running).
           Returns an exit code 0 if it is active, NOT_RUNNING otherwise (see
           the section called “EXIT CODES”). This will also print the state to
           STDOUT.

       --reload
           Reload firewall rules and keep state information. Current permanent
           configuration will become new runtime configuration, i.e. all
           runtime only changes done until reload are lost with reload if they
           have not been also in permanent configuration.

       --complete-reload
           Reload firewall completely, even netfilter kernel modules. This
           will most likely terminate active connections, because state
           information is lost. This option should only be used in case of
           severe firewall problems. For example if there are state
           information problems that no connection can be established with
           correct firewall rules.

   Permanent Options
       --permanent
           The permanent option --permanent can be used to set options
           permanently. These changes are not effective immediately, only
           after service restart/reload or system reboot. Without the
           --permanent option, a change will only be part of the runtime
           configuration. The --permanent option can not be used with all
           options.

           If you want to make a change in runtime and permanent
           configuration, use the same call with and without the--permanent
           option.

           The --permanent option can be optionally added to all options
           further down where it is supported.

   Zone Options
       --get-default-zone
           Print default zone for connections and interfaces.

       --set-default-zone=zone
           Set default zone for connections and interfaces where no zone has
           been selected. Setting the default zone changes the zone for the
           connections or interfaces, that are using the default zone.

           This is a runtime and permanent change.

       --get-active-zones
           Print currently active zones altogether with interfaces and sources
           used in these zones. Active zones are zones, that have a binding to
           an interface or source. The output format is:

               zone1
                 interfaces: interface1 interface2 ..
                 sources: source1 ..
               zone2
                 interfaces: interface3 ..
               zone3
                 sources: source2 ..


           If there are no interfaces or sources bound to the zone, the
           corresponding line will be omitted.

       [--permanent] --get-zones
           Print predefined zones as a space separated list.

       [--permanent] --get-services
           Print predefined services as a space separated list.

       [--permanent] --get-icmptypes
           Print predefined icmptypes as a space separated list.

       [--permanent] --get-zone-of-interface=interface
           Print the name of the zone the interface is bound to or no zone.

       [--permanent] --get-zone-of-source=source[/mask]
           Print the name of the zone the source[/mask] is bound to or no
           zone.

       [--permanent] --list-all-zones
           List everything added for or enabled in all zones. The output
           format is:

               zone1
                 interfaces: interface1 ..
                 sources: source1 ..
                 services: service1 ..
                 ports: port1 ..
                 forward-ports:
                       forward-port1
                       ..
                 icmp-blocks: icmp-type1 ..
                 rich rules:
                       rich-rule1
                       ..
               ..



       --permanent --new-zone=zone
           Add a new permanent zone.

       --permanent --delete-zone=zone
           Delete an existing permanent zone.

       --permanent [--zone=zone] --get-target
           Get the target of a permanent zone.

       --permanent [--zone=zone] --set-target=target
           Set the target of a permanent zone.  target is one of: default,
           ACCEPT, DROP, %%REJECT%%

   Options to Adapt and Query Zones
       Options in this section affect only one particular zone. If used with
       --zone=zone option, they affect the zone zone. If the option is
       omitted, they affect default zone (see --get-default-zone).

       [--permanent] [--zone=zone] --list-all
           List everything added for or enabled in zone. If zone is omitted,
           default zone will be used.

       [--permanent] [--zone=zone] --list-services
           List services added for zone as a space separated list. If zone is
           omitted, default zone will be used.

       [--permanent] [--zone=zone] --add-service=service [--timeout=timeval]
           Add a service for zone. If zone is omitted, default zone will be
           used. This option can be specified multiple times. If a timeout is
           supplied, the rule will be active for the specified amount of time
           and will be removed automatically afterwards.  timeval is either a
           number (of seconds) or number followed by one of characters s
           (seconds), m (minutes), h (hours), for example 20m or 1h.

           The service is one of the firewalld provided services. To get a
           list of the supported services, use firewall-cmd --get-services.

           The --timeout option is not combinable with the --permanent option.

       [--permanent] [--zone=zone] --remove-service=service
           Remove a service from zone. This option can be specified multiple
           times. If zone is omitted, default zone will be used.

       [--permanent] [--zone=zone] --query-service=service
           Return whether service has been added for zone. If zone is omitted,
           default zone will be used. Returns 0 if true, 1 otherwise.

       [--permanent] [--zone=zone] --list-ports
           List ports added for zone as a space separated list. A port is of
           the form portid[-portid]/protocol, it can be either a port and
           protocol pair or a port range with a protocol. If zone is omitted,
           default zone will be used.

       [--permanent] [--zone=zone] --add-port=portid[-portid]/protocol
       [--timeout=timeval]
           Add the port for zone. If zone is omitted, default zone will be
           used. This option can be specified multiple times. If a timeout is
           supplied, the rule will be active for the specified amount of time
           and will be removed automatically afterwards.  timeval is either a
           number (of seconds) or number followed by one of characters s
           (seconds), m (minutes), h (hours), for example 20m or 1h.

           The port can either be a single port number or a port range
           portid-portid. The protocol can either be tcp or udp.

           The --timeout option is not combinable with the --permanent option.

       [--permanent] [--zone=zone] --remove-port=portid[-portid]/protocol
           Remove the port from zone. If zone is omitted, default zone will be
           used. This option can be specified multiple times.

       [--permanent] [--zone=zone] --query-port=portid[-portid]/protocol
           Return whether the port has been added for zone. If zone is
           omitted, default zone will be used. Returns 0 if true, 1 otherwise.

       [--permanent] [--zone=zone] --list-icmp-blocks
           List Internet Control Message Protocol (ICMP) type blocks added for
           zone as a space separated list. If zone is omitted, default zone
           will be used.

       [--permanent] [--zone=zone] --add-icmp-block=icmptype
       [--timeout=timeval]
           Add an ICMP block for icmptype for zone. If zone is omitted,
           default zone will be used. This option can be specified multiple
           times. If a timeout is supplied, the rule will be active for the
           specified amount of time and will be removed automatically
           afterwards.  timeval is either a number (of seconds) or number
           followed by one of characters s (seconds), m (minutes), h (hours),
           for example 20m or 1h.

           The icmptype is the one of the icmp types firewalld supports. To
           get a listing of supported icmp types: firewall-cmd --get-icmptypes

           The --timeout option is not combinable with the --permanent option.

       [--permanent] [--zone=zone] --remove-icmp-block=icmptype
           Remove the ICMP block for icmptype from zone. If zone is omitted,
           default zone will be used. This option can be specified multiple
           times.

       [--permanent] [--zone=zone] --query-icmp-block=icmptype
           Return whether an ICMP block for icmptype has been added for zone.
           If zone is omitted, default zone will be used. Returns 0 if true, 1
           otherwise.

       [--permanent] [--zone=zone] --list-forward-ports
           List IPv4 forward ports added for zone as a space separated list.
           If zone is omitted, default zone will be used.

           For IPv6 forward ports, please use the rich language.

       [--permanent] [--zone=zone]
       --add-forward-port=port=portid[-portid]:proto=protocol[:toport=portid[-portid]][:toaddr=address[/mask]]
       [--timeout=timeval]
           Add the IPv4 forward port for zone. If zone is omitted, default
           zone will be used. This option can be specified multiple times. If
           a timeout is supplied, the rule will be active for the specified
           amount of time and will be removed automatically afterwards.
           timeval is either a number (of seconds) or number followed by one
           of characters s (seconds), m (minutes), h (hours), for example 20m
           or 1h.

           The port can either be a single port number portid or a port range
           portid-portid. The protocol can either be tcp or udp. The
           destination address is a simple IP address.

           The --timeout option is not combinable with the --permanent option.

           For IPv6 forward ports, please use the rich language.

       [--permanent] [--zone=zone]
       --remove-forward-port=port=portid[-portid]:proto=protocol[:toport=portid[-portid]][:toaddr=address[/mask]]
           Remove the IPv4 forward port from zone. If zone is omitted, default
           zone will be used. This option can be specified multiple times.

           For IPv6 forward ports, please use the rich language.

       [--permanent] [--zone=zone]
       --query-forward-port=port=portid[-portid]:proto=protocol[:toport=portid[-portid]][:toaddr=address[/mask]]
           Return whether the IPv4 forward port has been added for zone. If
           zone is omitted, default zone will be used. Returns 0 if true, 1
           otherwise.

           For IPv6 forward ports, please use the rich language.

       [--permanent] [--zone=zone] --add-masquerade [--timeout=timeval]
           Enable IPv4 masquerade for zone. If zone is omitted, default zone
           will be used. If a timeout is supplied, masquerading will be active
           for the specified amount of time.  timeval is either a number (of
           seconds) or number followed by one of characters s (seconds), m
           (minutes), h (hours), for example 20m or 1h. Masquerading is useful
           if the machine is a router and machines connected over an interface
           in another zone should be able to use the first connection.

           The --timeout option is not combinable with the --permanent option.

           For IPv6 masquerading, please use the rich language.

       [--permanent] [--zone=zone] --remove-masquerade
           Disable IPv4 masquerade for zone. If zone is omitted, default zone
           will be used. If the masquerading was enabled with a timeout, it
           will be disabled also.

           For IPv6 masquerading, please use the rich language.

       [--permanent] [--zone=zone] --query-masquerade
           Return whether IPv4 masquerading has been enabled for zone. If zone
           is omitted, default zone will be used. Returns 0 if true, 1
           otherwise.

           For IPv6 masquerading, please use the rich language.

       [--permanent] [--zone=zone] --list-rich-rules
           List rich language rules added for zone as a newline separated
           list. If zone is omitted, default zone will be used.

       [--permanent] [--zone=zone] --add-rich-rule='rule' [--timeout=timeval]
           Add rich language rule 'rule' for zone. This option can be
           specified multiple times. If zone is omitted, default zone will be
           used. If a timeout is supplied, the rule will be active for the
           specified amount of time and will be removed automatically
           afterwards.  timeval is either a number (of seconds) or number
           followed by one of characters s (seconds), m (minutes), h (hours),
           for example 20m or 1h.

           For the rich language rule syntax, please have a look at
           firewalld.richlanguage(5).

           The --timeout option is not combinable with the --permanent option.

       [--permanent] [--zone=zone] --remove-rich-rule='rule'
           Remove rich language rule 'rule' from zone. This option can be
           specified multiple times. If zone is omitted, default zone will be
           used.

           For the rich language rule syntax, please have a look at
           firewalld.richlanguage(5).

       [--permanent] [--zone=zone] --query-rich-rule='rule'
           Return whether a rich language rule 'rule' has been added for zone.
           If zone is omitted, default zone will be used. Returns 0 if true, 1
           otherwise.

           For the rich language rule syntax, please have a look at
           firewalld.richlanguage(5).

   Options to Handle Bindings of Interfaces
       Binding an interface to a zone means that this zone settings are used
       to restrict traffic via the interface.

       Options in this section affect only one particular zone. If used with
       --zone=zone option, they affect the zone zone. If the option is
       omitted, they affect default zone (see --get-default-zone).

       For a list of predefined zones use firewall-cmd --get-zones.

       An interface name is a string up to 16 characters long, that may not
       contain ' ', '/', '!' and '*'.

       [--permanent] [--zone=zone] --list-interfaces
           List interfaces that are bound to zone zone as a space separated
           list. If zone is omitted, default zone will be used.

       [--permanent] [--zone=zone] --add-interface=interface
           Bind interface interface to zone zone. If zone is omitted, default
           zone will be used.

           As a end user you don't need this in most cases, because
           NetworkManager adds interfaces into zones automatically. For
           permanent association of interface with a zone, see 'How to set or
           change a zone for a connection?' in firewalld.zones(5).

       [--zone=zone] --change-interface=interface
           Change zone the interface interface is bound to to zone zone. If
           zone is omitted, default zone will be used. If old and new zone are
           the same, the call will be ignored without an error. If the
           interface has not been bound to a zone before, it will behave like
           --add-interface.

       [--permanent] [--zone=zone] --query-interface=interface
           Query whether interface interface is bound to zone zone. Returns 0
           if true, 1 otherwise.

       [--permanent] [--zone=zone] --remove-interface=interface
           Remove binding of interface interface from zone zone. If zone is
           omitted, default zone will be used.

   Options to Handle Bindings of Sources
       Binding a source to a zone means that this zone settings will be used
       to restrict traffic from this source.

       A source address or address range is either an IP address or a network
       IP address with a mask for IPv4 or IPv6. For IPv4, the mask can be a
       network mask or a plain number. For IPv6 the mask is a plain number.
       The use of host names is not supported.

       Options in this section affect only one particular zone. If used with
       --zone=zone option, they affect the zone zone. If the option is
       omitted, they affect default zone (see --get-default-zone).

       For a list of predefined zones use firewall-cmd [--permanent]
       --get-zones.

       [--permanent] [--zone=zone] --list-sources
           List sources that are bound to zone zone as a space separated list.
           If zone is omitted, default zone will be used.

       [--permanent] [--zone=zone] --add-source=source[/mask]
           Bind source source[/mask] to zone zone. If zone is omitted, default
           zone will be used.

       [--zone=zone] --change-source=source[/mask]
           Change zone the source source[/mask] is bound to to zone zone. If
           zone is omitted, default zone will be used. If old and new zone are
           the same, the call will be ignored without an error. If the source
           has not been bound to a zone before, it will behave like
           --add-source.

       [--permanent] [--zone=zone] --query-source=source[/mask]
           Query whether the source source[/mask] is bound to the zone zone.
           Returns 0 if true, 1 otherwise.

       [--permanent] [--zone=zone] --remove-source=source[/mask]
           Remove binding of source source[/mask] from zone zone. If zone is
           omitted, default zone will be used.

   Service Options
       --permanent --new-service=service
           Add a new permanent service.

       --permanent --delete-service=service
           Delete an existing permanent service.

   Internet Control Message Protocol (ICMP) type Options
       --permanent --new-icmptype=icmptype
           Add a new permanent icmptype.

       --permanent --delete-icmptype=icmptype
           Delete an existing permanent icmptype.

   Direct Options
       The direct options give a more direct access to the firewall. These
       options require user to know basic iptables concepts, i.e.  table
       (filter/mangle/nat/...), chain (INPUT/OUTPUT/FORWARD/...), commands
       (-A/-D/-I/...), parameters (-p/-s/-d/-j/...) and targets
       (ACCEPT/DROP/REJECT/...).

       Direct options should be used only as a last resort when it's not
       possible to use for example --add-service=service or
       --add-rich-rule='rule'.

       The first argument of each option has to be ipv4 or ipv6 or eb. With
       ipv4 it will be for IPv4 (iptables(8)), with ipv6 for IPv6
       (ip6tables(8)) and with eb for ethernet bridges (ebtables(8)).

       [--permanent] --direct --get-all-chains
           Get all chains added to all tables.

           This option concerns only chains previously added with --direct
           --add-chain.

       [--permanent] --direct --get-chains { ipv4 | ipv6 | eb } table
           Get all chains added to table table as a space separated list.

           This option concerns only chains previously added with --direct
           --add-chain.

       [--permanent] --direct --add-chain { ipv4 | ipv6 | eb } table chain
           Add a new chain with name chain to table table.

           There already exist basic chains to use with direct options, for
           example INPUT_direct chain (see iptables-save | grep direct output
           for all of them). These chains are jumped into before chains for
           zones, i.e. every rule put into INPUT_direct will be checked before
           rules in zones.

       [--permanent] --direct --remove-chain { ipv4 | ipv6 | eb } table chain
           Remove the chain with name chain from table table.

       [--permanent] --direct --query-chain { ipv4 | ipv6 | eb } table chain
           Return whether a chain with name chain exists in table table.
           Returns 0 if true, 1 otherwise.

           This option concerns only chains previously added with --direct
           --add-chain.

       [--permanent] --direct --get-all-rules
           Get all rules added to all chains in all tables as a newline
           separated list of the priority and arguments.

       [--permanent] --direct --get-rules { ipv4 | ipv6 | eb } table chain
           Get all rules added to chain chain in table table as a newline
           separated list of the priority and arguments.

       [--permanent] --direct --add-rule { ipv4 | ipv6 | eb } table chain
       priority args
           Add a rule with the arguments args to chain chain in table table
           with priority priority.

           The priority is used to order rules. Priority 0 means add rule on
           top of the chain, with a higher priority the rule will be added
           further down. Rules with the same priority are on the same level
           and the order of these rules is not fixed and may change. If you
           want to make sure that a rule will be added after another one, use
           a low priority for the first and a higher for the following.

       [--permanent] --direct --remove-rule { ipv4 | ipv6 | eb } table chain
       priority args
           Remove a rule with priority and the arguments args from chain chain
           in table table.

       [--permanent] --direct --remove-rules { ipv4 | ipv6 | eb } table chain
           Remove all rules in the chain with name chain exists in table
           table.

           This option concerns only rules previously added with --direct
           --add-rule in this chain.

       [--permanent] --direct --query-rule { ipv4 | ipv6 | eb } table chain
       priority args
           Return whether a rule with priority and the arguments args exists
           in chain chain in table table. Returns 0 if true, 1 otherwise.

       --direct --passthrough { ipv4 | ipv6 | eb } args
           Pass a command through to the firewall.  args can be all iptables,
           ip6tables and ebtables command line arguments. This command is
           untracked, which means that firewalld is not able to provide
           information about this command later on, also not a listing of the
           untracked passthoughs.

       [--permanent] --direct --get-all-passthroughs
           Get all passthrough rules as a newline separated list of the ipv
           value and arguments.

       [--permanent] --direct --get-passthroughs { ipv4 | ipv6 | eb }
           Get all passthrough rules for the ipv value as a newline separated
           list of the priority and arguments.

       [--permanent] --direct --add-passthrough { ipv4 | ipv6 | eb } args
           Add a passthrough rule with the arguments args for the ipv value.

       [--permanent] --direct --remove-passthrough { ipv4 | ipv6 | eb } args
           Remove a passthrough rule with the arguments args for the ipv
           value.

       [--permanent] --direct --query-passthrough { ipv4 | ipv6 | eb } args
           Return whether a passthrough rule with the arguments args exists
           for the ipv value. Returns 0 if true, 1 otherwise.

   Lockdown Options
       Local applications or services are able to change the firewall
       configuration if they are running as root (example: libvirt) or are
       authenticated using PolicyKit. With this feature administrators can
       lock the firewall configuration so that only applications on lockdown
       whitelist are able to request firewall changes.

       The lockdown access check limits D-Bus methods that are changing
       firewall rules. Query, list and get methods are not limited.

       The lockdown feature is a very light version of user and application
       policies for firewalld and is turned off by default.

       --lockdown-on
           Enable lockdown. Be careful - if firewall-cmd is not on lockdown
           whitelist when you enable lockdown you won't be able to disable it
           again with firewall-cmd, you would need to edit firewalld.conf.

           This is a runtime and permanent change.

       --lockdown-off
           Disable lockdown.

           This is a runtime and permanent change.

       --query-lockdown
           Query whether lockdown is enabled. Returns 0 if lockdown is
           enabled, 1 otherwise.

   Lockdown Whitelist Options
       The lockdown whitelist can contain commands, contexts, users and user
       ids.

       If a command entry on the whitelist ends with an asterisk '*', then all
       command lines starting with the command will match. If the '*' is not
       there the absolute command inclusive arguments must match.

       Commands for user root and others is not always the same. Example: As
       root /bin/firewall-cmd is used, as a normal user /usr/bin/firewall-cmd
       is be used on Fedora.

       The context is the security (SELinux) context of a running application
       or service. To get the context of a running application use ps -e
       --context.

       Warning: If the context is unconfined, then this will open access for
       more than the desired application.

       The lockdown whitelist entries are checked in the following order:
           1. context
           2. uid
           3. user
           4. command

       [--permanent] --list-lockdown-whitelist-commands
           List all command lines that are on the whitelist.

       [--permanent] --add-lockdown-whitelist-command=command
           Add the command to the whitelist.

       [--permanent] --remove-lockdown-whitelist-command=command
           Remove the command from the whitelist.

       [--permanent] --query-lockdown-whitelist-command=command
           Query whether the command is on the whitelist. Returns 0 if true, 1
           otherwise.

       [--permanent] --list-lockdown-whitelist-contexts
           List all contexts that are on the whitelist.

       [--permanent] --add-lockdown-whitelist-context=context
           Add the context context to the whitelist.

       [--permanent] --remove-lockdown-whitelist-context=context
           Remove the context from the whitelist.

       [--permanent] --query-lockdown-whitelist-context=context
           Query whether the context is on the whitelist. Returns 0 if true, 1
           otherwise.

       [--permanent] --list-lockdown-whitelist-uids
           List all user ids that are on the whitelist.

       [--permanent] --add-lockdown-whitelist-uid=uid
           Add the user id uid to the whitelist.

       [--permanent] --remove-lockdown-whitelist-uid=uid
           Remove the user id uid from the whitelist.

       [--permanent] --query-lockdown-whitelist-uid=uid
           Query whether the user id uid is on the whitelist. Returns 0 if
           true, 1 otherwise.

       [--permanent] --list-lockdown-whitelist-users
           List all user names that are on the whitelist.

       [--permanent] --add-lockdown-whitelist-user=user
           Add the user name user to the whitelist.

       [--permanent] --remove-lockdown-whitelist-user=user
           Remove the user name user from the whitelist.

       [--permanent] --query-lockdown-whitelist-user=user
           Query whether the user name user is on the whitelist. Returns 0 if
           true, 1 otherwise.

   Panic Options
       --panic-on
           Enable panic mode. All incoming and outgoing packets are dropped,
           active connections will expire. Enable this only if there are
           serious problems with your network environment. For example if the
           machine is getting hacked in.

           This is a runtime only change.

       --panic-off
           Disable panic mode. After disabling panic mode established
           connections might work again, if panic mode was enabled for a short
           period of time.

           This is a runtime only change.

       --query-panic
           Returns 0 if panic mode is enabled, 1 otherwise.

EXAMPLES
       For more examples see http://fedoraproject.org/wiki/FirewallD

   Example 1
       Enable http service in default zone. This is runtime only change, i.e.
       effective until restart.

           firewall-cmd --add-service=http



   Example 2
       Enable port 443/tcp immediately and permanently in default zone. To
       make the change effective immediately and also after restart we need
       two commands. The first command makes the change in runtime
       configuration, i.e. makes it effective immediately, until restart. The
       second command makes the change in permanent configuration, i.e. makes
       it effective after restart.

           firewall-cmd --add-port=443/tcp
           firewall-cmd --permanent --add-port=443/tcp



EXIT CODES
       On success 0 is returned. On failure the output is red colored and exit
       code is either 2 in case of wrong command-line option usage or one of
       the following error codes in other cases:

       lqqqqqqqqqqqqqqqqqqqqwqqqqqqk
       xString              x Code x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xALREADY_ENABLED     x   11 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xNOT_ENABLED         x   12 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xCOMMAND_FAILED      x   13 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xNO_IPV6_NAT         x   14 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xPANIC_MODE          x   15 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xZONE_ALREADY_SET    x   16 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xUNKNOWN_INTERFACE   x   17 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xZONE_CONFLICT       x   18 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xBUILTIN_CHAIN       x   19 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xEBTABLES_NO_REJECT  x   20 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xNOT_OVERLOADABLE    x   21 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xNO_DEFAULTS         x   22 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xBUILTIN_ZONE        x   23 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xBUILTIN_SERVICE     x   24 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xBUILTIN_ICMPTYPE    x   25 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xNAME_CONFLICT       x   26 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xNAME_MISMATCH       x   27 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xPARSE_ERROR         x   28 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xACCESS_DENIED       x   29 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xUNKNOWN_SOURCE      x   30 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xRT_TO_PERM_FAILED   x   31 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_ACTION      x  100 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_SERVICE     x  101 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_PORT        x  102 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_PROTOCOL    x  103 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_INTERFACE   x  104 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_ADDR        x  105 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_FORWARD     x  106 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_ICMPTYPE    x  107 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_TABLE       x  108 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_CHAIN       x  109 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_TARGET      x  110 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_IPV         x  111 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_ZONE        x  112 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_PROPERTY    x  113 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_VALUE       x  114 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_OBJECT      x  115 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_NAME        x  116 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_FILENAME    x  117 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_DIRECTORY   x  118 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_TYPE        x  119 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_SETTING     x  120 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_DESTINATION x  121 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_RULE        x  122 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_LIMIT       x  123 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_FAMILY      x  124 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_LOG_LEVEL   x  125 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_AUDIT_TYPE  x  126 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_MARK        x  127 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_CONTEXT     x  128 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_COMMAND     x  129 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_USER        x  130 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_UID         x  131 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_MODULE      x  132 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xINVALID_PASSTHROUGH x  133 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xMISSING_TABLE       x  200 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xMISSING_CHAIN       x  201 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xMISSING_PORT        x  202 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xMISSING_PROTOCOL    x  203 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xMISSING_ADDR        x  204 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xMISSING_NAME        x  205 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xMISSING_SETTING     x  206 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xMISSING_FAMILY      x  207 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xNOT_RUNNING         x  252 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xNOT_AUTHORIZED      x  253 x
       tqqqqqqqqqqqqqqqqqqqqnqqqqqqu
       xUNKNOWN_ERROR       x  254 x
       mqqqqqqqqqqqqqqqqqqqqvqqqqqqj

SEE ALSO
       firewall-applet(1), firewalld(1), firewall-cmd(1), firewall-config(1),
       firewalld.conf(5), firewalld.direct(5), firewalld.icmptype(5),
       firewalld.lockdown-whitelist(5), firewall-offline-cmd(1),
       firewalld.richlanguage(5), firewalld.service(5), firewalld.zone(5),
       firewalld.zones(5)

NOTES
       firewalld home page at fedorahosted.org:
           http://fedorahosted.org/firewalld/

       More documentation with examples:
           http://fedoraproject.org/wiki/FirewallD

AUTHORS
       Thomas Woerner <twoerner@redhat.com>
           Developer

       Jiri Popelka <jpopelka@redhat.com>
           Developer



firewalld 0.3.9                                                FIREWALL-CMD(1)

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

365

366

367

368

369

370

371

372

373

374

375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

401

402

403

404

405

406

407

408

409

410

411

412

413

414

415

416

417

418

419

420

421

422

423

424

425

426

427

428

429

430

431

432

433

434

435

436

437

438

439

440

441

442

443

444

445

446

447

448

449

450

451

452

453

454

455

456

457

458

459

460

461

462

463

464

465

466

467

468

469

470

471

472

473

474

475

476

477

478

479

480

481

482

483

484

485

486

487

488

489

490

491

492

493

494

495

496

497

498

499

500

501

502

503

504

505

506

507

508

509

510

511

512

513

514

515

516

517

518

519

520

521

522

523

524

525

526

527

528

529

530

531

532

533

534

535

536

537

538

539

540

541

542

543

544

545

546

547

548

549

550

551

552

553

554

555

556

557

558

559

560

561

562

563

564

565

566

567

568

569

570

571

572

573

574

575

576

577

578

579

580

581

582

583

584

585

586

587

588

589

590

591

592

593

594

595

596

597

598

599

600

601

602

603

604

605

606

607

608

609

610

611

612

613

614

615

616

617

618

619

620

621

622

623

624

625

626

627

628

629

630

631

632

633

634

635

636

637

638

639

640

641

642

643

644

645

646

647

648

649

650

651

652

653

654

655

656

657

658

659

660

661

662

663

664

665

666

667

668

669

670

671

672

673

674

675

676

677

678

679

680

681

682

683

684

685

686

687

688

689

690

691

692

693

694

695

696

697

698

699

700

701

702

703

704

705

706

707

708

709

710

711

712

713

714

715

716

717

718

719

720

721

722

723

724

725

726

727

728

729

730

731

732

733

734

735

736

737

738

739

740

741

742

743

744

745

746

747

748

749

750

751

752

753

754

755

756

757

758

759

760

761

762

763

764

765

766

767

768

769

770

771

772

773

774

775

776

777

778

779

780

781

782

783

784

785

786

787

788

789

790

791

792

793

794

795

796

797

798

799

800

801

802

803

804

805

806

807

808

809

810

811

812

813

814

815

816

817

818

819

820

821

822

823

824

825

826

827

828

829

830

831

832

833

834

835

836

837

838

839

840

841

842

843

844

845

846

847

848

849

850

851

852

853

854

FIREWALL-CMD(1) firewall-cmd FIREWALL-CMD(1)

NAME

firewall-cmd - firewalld command line client

SYNOPSIS

firewall-cmd [OPTIONS...]

DESCRIPTION

firewall-cmd is the command line client of the firewalld daemon. It

provides interface to manage runtime and permanent configuration.

The runtime configuration in firewalld is separated from the permanent

configuration. This means that things can get changed in the runtime or

permanent configuration.

OPTIONS

The following options are supported:

General Options

-h, --help

Prints a short help text and exits.

-V, --version

Print the version string of firewalld. This option is not

combinable with other options.

-q, --quiet

Do not print status messages.

Status Options

--state

Check whether the firewalld daemon is active (i.e. running).

Returns an exit code 0 if it is active, NOT_RUNNING otherwise (see

the section called “EXIT CODES”). This will also print the state to

STDOUT.

--reload

Reload firewall rules and keep state information. Current permanent

configuration will become new runtime configuration, i.e. all

runtime only changes done until reload are lost with reload if they

have not been also in permanent configuration.

--complete-reload

Reload firewall completely, even netfilter kernel modules. This

will most likely terminate active connections, because state

information is lost. This option should only be used in case of

severe firewall problems. For example if there are state

information problems that no connection can be established with

correct firewall rules.

Permanent Options

--permanent

The permanent option --permanent can be used to set options

permanently. These changes are not effective immediately, only

after service restart/reload or system reboot. Without the

--permanent option, a change will only be part of the runtime

configuration. The --permanent option can not be used with all

options.

If you want to make a change in runtime and permanent

configuration, use the same call with and without the--permanent

option.

The --permanent option can be optionally added to all options

further down where it is supported.

Zone Options

--get-default-zone

Print default zone for connections and interfaces.

--set-default-zone=zone

Set default zone for connections and interfaces where no zone has

been selected. Setting the default zone changes the zone for the

connections or interfaces, that are using the default zone.

This is a runtime and permanent change.

--get-active-zones

Print currently active zones altogether with interfaces and sources

used in these zones. Active zones are zones, that have a binding to

an interface or source. The output format is:

zone1

interfaces: interface1 interface2 ..

sources: source1 ..

zone2

interfaces: interface3 ..

zone3

sources: source2 ..

If there are no interfaces or sources bound to the zone, the

corresponding line will be omitted.

[--permanent] --get-zones

Print predefined zones as a space separated list.

[--permanent] --get-services

Print predefined services as a space separated list.

[--permanent] --get-icmptypes

Print predefined icmptypes as a space separated list.

[--permanent] --get-zone-of-interface=interface

Print the name of the zone the interface is bound to or no zone.

[--permanent] --get-zone-of-source=source[/mask]

Print the name of the zone the source[/mask] is bound to or no

zone.

[--permanent] --list-all-zones

List everything added for or enabled in all zones. The output

format is:

zone1

interfaces: interface1 ..

sources: source1 ..

services: service1 ..

ports: port1 ..

forward-ports:

forward-port1

icmp-blocks: icmp-type1 ..

rich rules:

rich-rule1

--permanent --new-zone=zone

Add a new permanent zone.

--permanent --delete-zone=zone

Delete an existing permanent zone.

--permanent [--zone=zone] --get-target

Get the target of a permanent zone.

--permanent [--zone=zone] --set-target=target

Set the target of a permanent zone. target is one of: default,

ACCEPT, DROP, %%REJECT%%

Options to Adapt and Query Zones

Options in this section affect only one particular zone. If used with

--zone=zone option, they affect the zone zone. If the option is

omitted, they affect default zone (see --get-default-zone).

[--permanent] [--zone=zone] --list-all

List everything added for or enabled in zone. If zone is omitted,

default zone will be used.

[--permanent] [--zone=zone] --list-services

List services added for zone as a space separated list. If zone is

omitted, default zone will be used.

[--permanent] [--zone=zone] --add-service=service [--timeout=timeval]

Add a service for zone. If zone is omitted, default zone will be

used. This option can be specified multiple times. If a timeout is

supplied, the rule will be active for the specified amount of time

and will be removed automatically afterwards. timeval is either a

number (of seconds) or number followed by one of characters s

(seconds), m (minutes), h (hours), for example 20m or 1h.

The service is one of the firewalld provided services. To get a

list of the supported services, use firewall-cmd --get-services.

The --timeout option is not combinable with the --permanent option.

[--permanent] [--zone=zone] --remove-service=service

Remove a service from zone. This option can be specified multiple

times. If zone is omitted, default zone will be used.

[--permanent] [--zone=zone] --query-service=service

Return whether service has been added for zone. If zone is omitted,

default zone will be used. Returns 0 if true, 1 otherwise.

[--permanent] [--zone=zone] --list-ports

List ports added for zone as a space separated list. A port is of

the form portid[-portid]/protocol, it can be either a port and

protocol pair or a port range with a protocol. If zone is omitted,

default zone will be used.

[--permanent] [--zone=zone] --add-port=portid[-portid]/protocol

[--timeout=timeval]

Add the port for zone. If zone is omitted, default zone will be

used. This option can be specified multiple times. If a timeout is

supplied, the rule will be active for the specified amount of time

and will be removed automatically afterwards. timeval is either a

number (of seconds) or number followed by one of characters s

(seconds), m (minutes), h (hours), for example 20m or 1h.

The port can either be a single port number or a port range

portid-portid. The protocol can either be tcp or udp.

The --timeout option is not combinable with the --permanent option.

[--permanent] [--zone=zone] --remove-port=portid[-portid]/protocol

Remove the port from zone. If zone is omitted, default zone will be

used. This option can be specified multiple times.

[--permanent] [--zone=zone] --query-port=portid[-portid]/protocol

Return whether the port has been added for zone. If zone is

omitted, default zone will be used. Returns 0 if true, 1 otherwise.

[--permanent] [--zone=zone] --list-icmp-blocks

List Internet Control Message Protocol (ICMP) type blocks added for

zone as a space separated list. If zone is omitted, default zone

will be used.

[--permanent] [--zone=zone] --add-icmp-block=icmptype

[--timeout=timeval]

Add an ICMP block for icmptype for zone. If zone is omitted,

default zone will be used. This option can be specified multiple

times. If a timeout is supplied, the rule will be active for the

specified amount of time and will be removed automatically

afterwards. timeval is either a number (of seconds) or number

followed by one of characters s (seconds), m (minutes), h (hours),

for example 20m or 1h.

The icmptype is the one of the icmp types firewalld supports. To

get a listing of supported icmp types: firewall-cmd --get-icmptypes

The --timeout option is not combinable with the --permanent option.

[--permanent] [--zone=zone] --remove-icmp-block=icmptype

Remove the ICMP block for icmptype from zone. If zone is omitted,

default zone will be used. This option can be specified multiple

times.

[--permanent] [--zone=zone] --query-icmp-block=icmptype

Return whether an ICMP block for icmptype has been added for zone.

If zone is omitted, default zone will be used. Returns 0 if true, 1

otherwise.

[--permanent] [--zone=zone] --list-forward-ports

List IPv4 forward ports added for zone as a space separated list.

If zone is omitted, default zone will be used.

For IPv6 forward ports, please use the rich language.

[--permanent] [--zone=zone]

--add-forward-port=port=portid[-portid]:proto=protocol[:toport=portid[-portid]][:toaddr=address[/mask]]

[--timeout=timeval]

Add the IPv4 forward port for zone. If zone is omitted, default

zone will be used. This option can be specified multiple times. If

a timeout is supplied, the rule will be active for the specified

amount of time and will be removed automatically afterwards.

timeval is either a number (of seconds) or number followed by one

of characters s (seconds), m (minutes), h (hours), for example 20m

or 1h.

The port can either be a single port number portid or a port range

portid-portid. The protocol can either be tcp or udp. The

destination address is a simple IP address.

The --timeout option is not combinable with the --permanent option.

For IPv6 forward ports, please use the rich language.

[--permanent] [--zone=zone]

--remove-forward-port=port=portid[-portid]:proto=protocol[:toport=portid[-portid]][:toaddr=address[/mask]]

Remove the IPv4 forward port from zone. If zone is omitted, default

zone will be used. This option can be specified multiple times.

For IPv6 forward ports, please use the rich language.

[--permanent] [--zone=zone]

--query-forward-port=port=portid[-portid]:proto=protocol[:toport=portid[-portid]][:toaddr=address[/mask]]

Return whether the IPv4 forward port has been added for zone. If

zone is omitted, default zone will be used. Returns 0 if true, 1

otherwise.

For IPv6 forward ports, please use the rich language.

[--permanent] [--zone=zone] --add-masquerade [--timeout=timeval]

Enable IPv4 masquerade for zone. If zone is omitted, default zone

will be used. If a timeout is supplied, masquerading will be active

for the specified amount of time. timeval is either a number (of

seconds) or number followed by one of characters s (seconds), m

(minutes), h (hours), for example 20m or 1h. Masquerading is useful

if the machine is a router and machines connected over an interface

in another zone should be able to use the first connection.

The --timeout option is not combinable with the --permanent option.

For IPv6 masquerading, please use the rich language.

[--permanent] [--zone=zone] --remove-masquerade

Disable IPv4 masquerade for zone. If zone is omitted, default zone

will be used. If the masquerading was enabled with a timeout, it

will be disabled also.

For IPv6 masquerading, please use the rich language.

[--permanent] [--zone=zone] --query-masquerade

Return whether IPv4 masquerading has been enabled for zone. If zone

is omitted, default zone will be used. Returns 0 if true, 1

otherwise.

For IPv6 masquerading, please use the rich language.

[--permanent] [--zone=zone] --list-rich-rules

List rich language rules added for zone as a newline separated

list. If zone is omitted, default zone will be used.

[--permanent] [--zone=zone] --add-rich-rule='rule' [--timeout=timeval]

Add rich language rule 'rule' for zone. This option can be

specified multiple times. If zone is omitted, default zone will be

used. If a timeout is supplied, the rule will be active for the

specified amount of time and will be removed automatically

afterwards. timeval is either a number (of seconds) or number

followed by one of characters s (seconds), m (minutes), h (hours),

for example 20m or 1h.

For the rich language rule syntax, please have a look at

firewalld.richlanguage(5).

The --timeout option is not combinable with the --permanent option.

[--permanent] [--zone=zone] --remove-rich-rule='rule'

Remove rich language rule 'rule' from zone. This option can be

specified multiple times. If zone is omitted, default zone will be

used.

For the rich language rule syntax, please have a look at

firewalld.richlanguage(5).

[--permanent] [--zone=zone] --query-rich-rule='rule'

Return whether a rich language rule 'rule' has been added for zone.

If zone is omitted, default zone will be used. Returns 0 if true, 1

otherwise.

For the rich language rule syntax, please have a look at

firewalld.richlanguage(5).

Options to Handle Bindings of Interfaces

Binding an interface to a zone means that this zone settings are used

to restrict traffic via the interface.

Options in this section affect only one particular zone. If used with

--zone=zone option, they affect the zone zone. If the option is

omitted, they affect default zone (see --get-default-zone).

For a list of predefined zones use firewall-cmd --get-zones.

An interface name is a string up to 16 characters long, that may not

contain ' ', '/', '!' and '*'.

[--permanent] [--zone=zone] --list-interfaces

List interfaces that are bound to zone zone as a space separated

list. If zone is omitted, default zone will be used.

[--permanent] [--zone=zone] --add-interface=interface

Bind interface interface to zone zone. If zone is omitted, default

zone will be used.

As a end user you don't need this in most cases, because

NetworkManager adds interfaces into zones automatically. For

permanent association of interface with a zone, see 'How to set or

change a zone for a connection?' in firewalld.zones(5).

[--zone=zone] --change-interface=interface

Change zone the interface interface is bound to to zone zone. If

zone is omitted, default zone will be used. If old and new zone are

the same, the call will be ignored without an error. If the

interface has not been bound to a zone before, it will behave like

--add-interface.

[--permanent] [--zone=zone] --query-interface=interface

Query whether interface interface is bound to zone zone. Returns 0

if true, 1 otherwise.

[--permanent] [--zone=zone] --remove-interface=interface

Remove binding of interface interface from zone zone. If zone is

omitted, default zone will be used.

Options to Handle Bindings of Sources

Binding a source to a zone means that this zone settings will be used

to restrict traffic from this source.

A source address or address range is either an IP address or a network

IP address with a mask for IPv4 or IPv6. For IPv4, the mask can be a

network mask or a plain number. For IPv6 the mask is a plain number.

The use of host names is not supported.

Options in this section affect only one particular zone. If used with

--zone=zone option, they affect the zone zone. If the option is

omitted, they affect default zone (see --get-default-zone).

For a list of predefined zones use firewall-cmd [--permanent]

--get-zones.

[--permanent] [--zone=zone] --list-sources

List sources that are bound to zone zone as a space separated list.

If zone is omitted, default zone will be used.

[--permanent] [--zone=zone] --add-source=source[/mask]

Bind source source[/mask] to zone zone. If zone is omitted, default

zone will be used.

[--zone=zone] --change-source=source[/mask]

Change zone the source source[/mask] is bound to to zone zone. If

zone is omitted, default zone will be used. If old and new zone are

the same, the call will be ignored without an error. If the source

has not been bound to a zone before, it will behave like

--add-source.

[--permanent] [--zone=zone] --query-source=source[/mask]

Query whether the source source[/mask] is bound to the zone zone.

Returns 0 if true, 1 otherwise.

[--permanent] [--zone=zone] --remove-source=source[/mask]

Remove binding of source source[/mask] from zone zone. If zone is

omitted, default zone will be used.

Service Options

--permanent --new-service=service

Add a new permanent service.

--permanent --delete-service=service

Delete an existing permanent service.

Internet Control Message Protocol (ICMP) type Options

--permanent --new-icmptype=icmptype

Add a new permanent icmptype.

--permanent --delete-icmptype=icmptype

Delete an existing permanent icmptype.

Direct Options

The direct options give a more direct access to the firewall. These

options require user to know basic iptables concepts, i.e. table

(filter/mangle/nat/...), chain (INPUT/OUTPUT/FORWARD/...), commands

(-A/-D/-I/...), parameters (-p/-s/-d/-j/...) and targets

(ACCEPT/DROP/REJECT/...).

Direct options should be used only as a last resort when it's not

possible to use for example --add-service=service or

--add-rich-rule='rule'.

The first argument of each option has to be ipv4 or ipv6 or eb. With

ipv4 it will be for IPv4 (iptables(8)), with ipv6 for IPv6

(ip6tables(8)) and with eb for ethernet bridges (ebtables(8)).

[--permanent] --direct --get-all-chains

Get all chains added to all tables.

This option concerns only chains previously added with --direct

--add-chain.

[--permanent] --direct --get-chains { ipv4 | ipv6 | eb } table

Get all chains added to table table as a space separated list.

This option concerns only chains previously added with --direct

--add-chain.

[--permanent] --direct --add-chain { ipv4 | ipv6 | eb } table chain

Add a new chain with name chain to table table.

There already exist basic chains to use with direct options, for

example INPUT_direct chain (see iptables-save | grep direct output

for all of them). These chains are jumped into before chains for

zones, i.e. every rule put into INPUT_direct will be checked before

rules in zones.

[--permanent] --direct --remove-chain { ipv4 | ipv6 | eb } table chain

Remove the chain with name chain from table table.

[--permanent] --direct --query-chain { ipv4 | ipv6 | eb } table chain

Return whether a chain with name chain exists in table table.

Returns 0 if true, 1 otherwise.

This option concerns only chains previously added with --direct

--add-chain.

[--permanent] --direct --get-all-rules

Get all rules added to all chains in all tables as a newline

separated list of the priority and arguments.

[--permanent] --direct --get-rules { ipv4 | ipv6 | eb } table chain

Get all rules added to chain chain in table table as a newline

separated list of the priority and arguments.

[--permanent] --direct --add-rule { ipv4 | ipv6 | eb } table chain

priority args

Add a rule with the arguments args to chain chain in table table

with priority priority.

The priority is used to order rules. Priority 0 means add rule on

top of the chain, with a higher priority the rule will be added

further down. Rules with the same priority are on the same level

and the order of these rules is not fixed and may change. If you

want to make sure that a rule will be added after another one, use

a low priority for the first and a higher for the following.

[--permanent] --direct --remove-rule { ipv4 | ipv6 | eb } table chain

priority args

Remove a rule with priority and the arguments args from chain chain

in table table.

[--permanent] --direct --remove-rules { ipv4 | ipv6 | eb } table chain

Remove all rules in the chain with name chain exists in table

table.

This option concerns only rules previously added with --direct

--add-rule in this chain.

[--permanent] --direct --query-rule { ipv4 | ipv6 | eb } table chain

priority args

Return whether a rule with priority and the arguments args exists

in chain chain in table table. Returns 0 if true, 1 otherwise.

--direct --passthrough { ipv4 | ipv6 | eb } args

Pass a command through to the firewall. args can be all iptables,

ip6tables and ebtables command line arguments. This command is

untracked, which means that firewalld is not able to provide

information about this command later on, also not a listing of the

untracked passthoughs.

[--permanent] --direct --get-all-passthroughs

Get all passthrough rules as a newline separated list of the ipv

value and arguments.

[--permanent] --direct --get-passthroughs { ipv4 | ipv6 | eb }

Get all passthrough rules for the ipv value as a newline separated

list of the priority and arguments.

[--permanent] --direct --add-passthrough { ipv4 | ipv6 | eb } args

Add a passthrough rule with the arguments args for the ipv value.

[--permanent] --direct --remove-passthrough { ipv4 | ipv6 | eb } args

Remove a passthrough rule with the arguments args for the ipv

value.

[--permanent] --direct --query-passthrough { ipv4 | ipv6 | eb } args

Return whether a passthrough rule with the arguments args exists

for the ipv value. Returns 0 if true, 1 otherwise.

Lockdown Options

Local applications or services are able to change the firewall

configuration if they are running as root (example: libvirt) or are

authenticated using PolicyKit. With this feature administrators can

lock the firewall configuration so that only applications on lockdown

whitelist are able to request firewall changes.

The lockdown access check limits D-Bus methods that are changing

firewall rules. Query, list and get methods are not limited.

The lockdown feature is a very light version of user and application

policies for firewalld and is turned off by default.

--lockdown-on

Enable lockdown. Be careful - if firewall-cmd is not on lockdown

whitelist when you enable lockdown you won't be able to disable it

again with firewall-cmd, you would need to edit firewalld.conf.

This is a runtime and permanent change.

--lockdown-off

Disable lockdown.

This is a runtime and permanent change.

--query-lockdown

Query whether lockdown is enabled. Returns 0 if lockdown is

enabled, 1 otherwise.

Lockdown Whitelist Options

The lockdown whitelist can contain commands, contexts, users and user

ids.

If a command entry on the whitelist ends with an asterisk '*', then all

command lines starting with the command will match. If the '*' is not

there the absolute command inclusive arguments must match.

Commands for user root and others is not always the same. Example: As

root /bin/firewall-cmd is used, as a normal user /usr/bin/firewall-cmd

is be used on Fedora.

The context is the security (SELinux) context of a running application

or service. To get the context of a running application use ps -e

--context.

Warning: If the context is unconfined, then this will open access for

more than the desired application.

The lockdown whitelist entries are checked in the following order:

1. context

2. uid

3. user

4. command

[--permanent] --list-lockdown-whitelist-commands

List all command lines that are on the whitelist.

[--permanent] --add-lockdown-whitelist-command=command

Add the command to the whitelist.

[--permanent] --remove-lockdown-whitelist-command=command

Remove the command from the whitelist.

[--permanent] --query-lockdown-whitelist-command=command

Query whether the command is on the whitelist. Returns 0 if true, 1

otherwise.

[--permanent] --list-lockdown-whitelist-contexts

List all contexts that are on the whitelist.

[--permanent] --add-lockdown-whitelist-context=context

Add the context context to the whitelist.

[--permanent] --remove-lockdown-whitelist-context=context

Remove the context from the whitelist.

[--permanent] --query-lockdown-whitelist-context=context

Query whether the context is on the whitelist. Returns 0 if true, 1

otherwise.

[--permanent] --list-lockdown-whitelist-uids

List all user ids that are on the whitelist.

[--permanent] --add-lockdown-whitelist-uid=uid

Add the user id uid to the whitelist.

[--permanent] --remove-lockdown-whitelist-uid=uid

Remove the user id uid from the whitelist.

[--permanent] --query-lockdown-whitelist-uid=uid

Query whether the user id uid is on the whitelist. Returns 0 if

true, 1 otherwise.

[--permanent] --list-lockdown-whitelist-users

List all user names that are on the whitelist.

[--permanent] --add-lockdown-whitelist-user=user

Add the user name user to the whitelist.

[--permanent] --remove-lockdown-whitelist-user=user

Remove the user name user from the whitelist.

[--permanent] --query-lockdown-whitelist-user=user

Query whether the user name user is on the whitelist. Returns 0 if

true, 1 otherwise.

Panic Options

--panic-on

Enable panic mode. All incoming and outgoing packets are dropped,

active connections will expire. Enable this only if there are

serious problems with your network environment. For example if the

machine is getting hacked in.

This is a runtime only change.

--panic-off

Disable panic mode. After disabling panic mode established

connections might work again, if panic mode was enabled for a short

period of time.

This is a runtime only change.

--query-panic

Returns 0 if panic mode is enabled, 1 otherwise.

EXAMPLES

For more examples see http://fedoraproject.org/wiki/FirewallD

Example 1

Enable http service in default zone. This is runtime only change, i.e.

effective until restart.

firewall-cmd --add-service=http

Example 2

Enable port 443/tcp immediately and permanently in default zone. To

make the change effective immediately and also after restart we need

two commands. The first command makes the change in runtime

configuration, i.e. makes it effective immediately, until restart. The

second command makes the change in permanent configuration, i.e. makes

it effective after restart.

firewall-cmd --add-port=443/tcp

firewall-cmd --permanent --add-port=443/tcp

EXIT CODES

On success 0 is returned. On failure the output is red colored and exit

code is either 2 in case of wrong command-line option usage or one of

the following error codes in other cases:

lqqqqqqqqqqqqqqqqqqqqwqqqqqqk

xString x Code x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xALREADY_ENABLED x 11 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xNOT_ENABLED x 12 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xCOMMAND_FAILED x 13 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xNO_IPV6_NAT x 14 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xPANIC_MODE x 15 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xZONE_ALREADY_SET x 16 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xUNKNOWN_INTERFACE x 17 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xZONE_CONFLICT x 18 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xBUILTIN_CHAIN x 19 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xEBTABLES_NO_REJECT x 20 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xNOT_OVERLOADABLE x 21 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xNO_DEFAULTS x 22 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xBUILTIN_ZONE x 23 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xBUILTIN_SERVICE x 24 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xBUILTIN_ICMPTYPE x 25 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xNAME_CONFLICT x 26 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xNAME_MISMATCH x 27 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xPARSE_ERROR x 28 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xACCESS_DENIED x 29 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xUNKNOWN_SOURCE x 30 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xRT_TO_PERM_FAILED x 31 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_ACTION x 100 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_SERVICE x 101 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_PORT x 102 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_PROTOCOL x 103 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_INTERFACE x 104 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_ADDR x 105 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_FORWARD x 106 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_ICMPTYPE x 107 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_TABLE x 108 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_CHAIN x 109 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_TARGET x 110 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_IPV x 111 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_ZONE x 112 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_PROPERTY x 113 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_VALUE x 114 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_OBJECT x 115 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_NAME x 116 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_FILENAME x 117 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_DIRECTORY x 118 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_TYPE x 119 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_SETTING x 120 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_DESTINATION x 121 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_RULE x 122 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_LIMIT x 123 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_FAMILY x 124 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_LOG_LEVEL x 125 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_AUDIT_TYPE x 126 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_MARK x 127 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_CONTEXT x 128 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_COMMAND x 129 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_USER x 130 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_UID x 131 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_MODULE x 132 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xINVALID_PASSTHROUGH x 133 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xMISSING_TABLE x 200 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xMISSING_CHAIN x 201 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xMISSING_PORT x 202 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xMISSING_PROTOCOL x 203 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xMISSING_ADDR x 204 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xMISSING_NAME x 205 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xMISSING_SETTING x 206 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xMISSING_FAMILY x 207 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xNOT_RUNNING x 252 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xNOT_AUTHORIZED x 253 x

tqqqqqqqqqqqqqqqqqqqqnqqqqqqu

xUNKNOWN_ERROR x 254 x

mqqqqqqqqqqqqqqqqqqqqvqqqqqqj

RootLinks Co., Ltd.

CentOS 7のFirewallでforward-portsの設定

Leave a Reply Cancel Reply

2015年6月
日	月	火	水	木	金	土
	1	2	3	4	5	6
7	8	9	10	11	12	13
14	15	16	17	18	19	20
21	22	23	24	25	26	27
28	29	30

RootLinks Co., Ltd.

CentOS 7のFirewallでforward-portsの設定

Related posts:

Leave a Reply Cancel Reply