Hello! Welcome to your next lesson on network administration.
In our last session, you learned how to use the ss command to see which services are listening for connections on your local machine. You can now confirm that your Python server is running and what port it's using. But there's a crucial second question: just because a service is listening, can anyone from the network actually connect to it? That's the job of the firewall.
This lesson introduces you to firewalld, the default firewall management tool on Fedora. We'll tackle the learning outcome: Explain the basics of firewalld zones and services on Fedora. This is the first of two lessons on the topic. Here, we will focus on understanding what the firewall is doing. In the next lesson, we'll learn how to change its rules to allow traffic to your web applications.
1. What is firewalld?
On any modern operating system, a firewall acts as a gatekeeper, controlling incoming and outgoing network traffic based on a set of security rules. Fedora uses a powerful and flexible firewall management tool called firewalld.
Before we dive into its commands, it's useful to understand where firewalld fits into the larger Linux networking stack.
The video "Demystifying firewalld" by BeginLinux Guru provides an excellent explanation of what firewalld is and how it relates to the underlying Linux kernel firewall, netfilter.
Watch the first 6 minutes and 23 seconds of the video. The key takeaway is that firewalld is not the firewall itself, but a user-friendly tool to manage the real firewall that lives in the Linux kernel.
As you saw, firewalld is a front-end that makes managing firewall rules much easier than interacting with the older iptables or the newer nftables systems directly. It introduces a key concept that simplifies everything: zones.
On your Fedora system, firewalld is enabled by default. You can verify this with a simple command.
Control the firewall at the command line
Let's use a short article from Fedora Magazine to see the most basic command for interacting with the firewall.
Read the first two paragraphs under the heading "Firewall zones". This will show you the command to check if the firewall is running.
As the article shows, you can run sudo firewall-cmd --state to confirm it's active.
2. The Core Concept: Zones
The most important concept to understand in firewalld is the zone. A zone is a pre-defined set of rules that determines the level of trust for network connections. Instead of creating complex rules from scratch, you assign your network interfaces (like your Wi-Fi card or Ethernet port) to a zone, and it inherits that zone's rules.
For example, you would assign your interface to a trusted zone on a secure home network, but you would use a more restrictive public zone when connected to the Wi-Fi at a coffee shop.
A beginner's guide to firewalld in Linux
This Red Hat article, "A beginner's guide to firewalld in Linux," gives a clear explanation of zones and how to inspect them.
Read the section "All about zones." Focus on understanding what a zone is and see the commands for listing all available zones and viewing the complete configuration of a specific zone.
To summarize the key commands for inspecting zones:
firewall-cmd --get-zones: Lists all available zones.firewall-cmd --get-default-zone: Shows the zone used for new interfaces.firewall-cmd --get-active-zones: Shows which zones are currently active and which network interfaces are assigned to them. This is the most important one for understanding your current security posture.firewall-cmd --list-all: Shows the complete configuration (allowed services, ports, etc.) for the default zone.firewall-cmd --zone=<zone_name> --list-all: Shows the complete configuration for a specific zone.
Zones like block and drop provide a powerful way to completely deny traffic from certain sources. Watching a demonstration of their effects makes the concept of different trust levels very clear.
Manage Firewall Part 1 - RHCSA v9 Review
This video clip from the "Manage Firewall Part 1" tutorial by beanologi gives a practical demonstration of the difference between the block and drop zones. This will help solidify your understanding of how zones enforce different behaviors.
Watch from 14:37 to 19:09. You don't need to perform the commands yourself. Just observe how pinging a machine responds differently when the source IP is added to the block zone (which sends a 'reject' message) versus the drop zone (which silently ignores the traffic).
3. Services and Ports in a Zone
A zone's rules are primarily defined by the services and ports it allows.
- Port: A numbered endpoint, like port
80for HTTP traffic. - Service: A human-readable name for a standard port and protocol combination. For example, the
httpservice is a shortcut for port80/tcp.firewalldcomes with definitions for many common services likessh,https,ftp, etc.
When you want to allow traffic for a web server, you can either open port 80 specifically or, more conveniently, allow the http service.
Manage Firewall Part 1 - RHCSA v9 Review
Let's return to the "Manage Firewall Part 1" video to see how you can view the services and ports associated with a zone.
Watch from 06:33 to 07:57. This segment demonstrates the essential commands for inspecting a zone's configuration: --list-all, --list-services, and --list-ports.
The graphical Cockpit web console, which is available on Fedora, also provides a nice visual representation of how services relate to a zone.
4. Do-It-Yourself: Exploring Your Firewall
Now it's time to apply these concepts and investigate the firewall on your own Fedora system. Open your terminal and run the following commands.
Task 1: Check the Status
Confirm that your firewall is active.
sudo firewall-cmd --state
Task 2: Identify Your Active Zone
Find out which zone your network connection is using. On a default Fedora KDE installation, this will likely be the FedoraWorkstation zone.
sudo firewall-cmd --get-active-zones
You'll see your network interface name (e.g., wlp2s0 for Wi-Fi or enp1s0 for Ethernet) listed under its assigned zone.
Task 3: List All Services in Your Active Zone
Now that you know your active zone, inspect it to see what services are allowed by default. Replace FedoraWorkstation with your actual active zone if it's different.
sudo firewall-cmd --zone=FedoraWorkstation --list-services
Are you surprised by what's allowed? You'll likely see ssh (allowing remote login) and dhcpv6-client (for network configuration).
Task 4: Get the Full Picture
Use --list-all to see a complete summary of your active zone's configuration.
sudo firewall-cmd --list-all
This command combines the information from several other commands and is one of the most useful for a quick overview.
Task 5: Compare Zones
Let's compare the rules of your active zone with the public zone. This will highlight how different zones offer different levels of protection.
sudo firewall-cmd --zone=public --list-all
Note the differences in the services: line between the output of this command and the previous one. This demonstrates the core value of zones—providing different rule sets for different contexts.
Conclusion
Excellent work. You've now explored the fundamental concepts of firewalld on your Fedora system. When deploying a web application, you can't just start a service and expect it to be accessible; you must also configure the firewall to allow traffic to it. Understanding these basics is the first and most crucial step.
Key Takeaways:
firewalldis the modern, user-friendly tool for managing firewall rules on Fedora.- The core concept is the zone, which is a collection of rules defining a specific level of trust.
- Your computer's network interfaces are assigned to zones, inheriting their rules.
- A zone's configuration primarily consists of the services (e.g.,
http) and ports it allows. - You can inspect your firewall's entire configuration from the command line using
firewall-cmd.
In our next lesson, we will move from inspecting to modifying. You'll learn how to use firewall-cmd to open the http and https ports, making your future Django projects accessible over the network, and how to make those changes permanent so they survive a reboot.