Managing Firewalls with netfilter and firewalld

1. The Linux Firewall Architecture

Before we start typing commands, it's essential to understand how the components of the Linux firewall fit together. Your preference for starting with theory will be well-served here, as a good mental model makes the practical steps much more intuitive.

At the very core of Linux networking security is a framework inside the kernel called Netfilter. It's the actual engine that inspects, modifies, and filters every network packet that enters, leaves, or passes through your system.

However, users and administrators don't interact with Netfilter directly. We use user-space tools to create rules that are then fed to Netfilter. This creates a layered architecture.

The following short video provides an excellent overview of this hierarchy.

To summarize the key architectural layers you just saw:

1. Netfilter (The Engine): Resides in the Linux kernel and does the actual packet filtering.
2. iptables / nftables (The Backend): These are lower-level command-line tools that translate rules into a format Netfilter can understand. Historically, iptables was the standard. Modern systems, like recent Red Hat-based distributions, use the more advanced nftables.
3. firewalld (The Frontend): This is a high-level service (a daemon) that provides a user-friendly way to manage the firewall. It communicates with nftables (or iptables on older systems) on your behalf.

For the CompTIA Linux+ exam and for most administrative work, you will primarily interact with a frontend like firewalld (on RHEL/CentOS/Fedora) or ufw (on Debian/Ubuntu). The key takeaway is that when you use firewalld, you are using a powerful management layer, not replacing the core Netfilter engine.

A crucial point is to pick one tool and stick with it. If you use firewalld, you should not try to simultaneously manage rules directly with nftables or iptables commands. Doing so can lead to confusing and conflicting rule sets that are difficult to troubleshoot.

2. Core Concepts of firewalld

firewalld introduces a few key concepts that make it powerful and flexible. The most important are Zones and Services.

• Zones: A zone is a collection of rules that defines a level of trust for a network connection. Your server's network interfaces (like eth0) are assigned to a zone, and all traffic coming through that interface is judged by that zone's rules. The default zone is typically public, which is appropriate for untrusted public networks. Other predefined zones include home, work, and trusted, each with progressively more permissive default settings.
• Services: A service is simply a predefined rule that includes the port number(s) and protocol for a common network service. For example, the http service is a shortcut for TCP port 80. The ssh service is a shortcut for TCP port 22. This saves you from having to remember specific port numbers.

Let's watch a practical demonstration that ties these concepts together.

Runtime vs. Permanent Configuration

As highlighted in the video, this is one of the most important concepts when using firewalld.

• Runtime: The firewall's currently active rules. Changes made here are immediate but are lost when the server reboots or the firewalld service is restarted. This is great for temporary testing.
• Permanent: The saved configuration stored in files on the disk (in /etc/firewalld/). These rules are not active until the firewall is reloaded.

The standard workflow for making a lasting change is:

1. Add the rule to the permanent configuration using the --permanent flag.
2. Reload the firewall to make the permanent configuration become the new runtime configuration using firewall-cmd --reload.

3. Managing Firewall Rules with firewall-cmd

Now let's put this theory into practice on your virtual machine. We will use the firewall-cmd command-line tool to perform common administrative tasks.

The following article provides a great set of reference commands. We will walk through the most essential ones.

Step 1: Check Firewall Status

First, ensure the firewalld service is running and check its state.

# Check if the service is active and enabled to start on boot
sudo systemctl status firewalld

# Get a simple running/not running status from firewalld itself
sudo firewall-cmd --state

Step 2: List Current Rules

Let's see the rules for the default zone. Your network interface is likely in the public zone.

# List all configuration for the default zone (public)
sudo firewall-cmd --list-all

You will see the zone name, the interfaces assigned to it, and lists of active services, ports, and more. By default, ssh and dhcpv6-client are often allowed.

Step 3: Add a Service (e.g., HTTP)

Imagine you have a web server running. You need to open port 80 to allow web traffic.

# Add the http service to the permanent configuration
sudo firewall-cmd --permanent --add-service=http

# Now, reload the firewall to apply the change
sudo firewall-cmd --reload

# Verify the service has been added
sudo firewall-cmd --list-all

You should now see http in the list of services.

Step 4: Add a Specific Port

What if you're running a web application on a non-standard port, like 8080? You can add the port directly.

# Add TCP port 8080 to the permanent configuration
sudo firewall-cmd --permanent --add-port=8080/tcp

# Reload to apply
sudo firewall-cmd --reload

# Verify by listing all rules, or more specifically, the ports
sudo firewall-cmd --list-ports

Step 5 (Advanced): Using Rich Rules

Sometimes you need more granular control than simply opening a port to the entire world. Rich rules allow for complex statements, such as allowing traffic from a specific IP address only.

For example, to allow traffic on port 8080 only from a specific machine on your local network (e.g., 192.168.1.100):

# Add a rich rule to allow a specific source IP to a specific port
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.100" port protocol="tcp" port="8080" accept'

# Reload to apply
sudo firewall-cmd --reload

# You can see your rich rules with --list-rich-rules
sudo firewall-cmd --list-rich-rules

This is a powerful feature for creating highly specific security policies.

Conclusion

In this lesson, we demystified the Linux firewall, moving from the low-level Netfilter kernel framework up to the user-friendly firewalld service. You've learned the theory behind its architecture and gained practical experience managing rules.

Key Takeaways:

• The Linux firewall is a layered system: Netfilter (kernel engine) -> nftables (backend) -> firewalld (frontend manager).
• firewalld uses Zones to apply different trust levels to network interfaces and Services as shortcuts for common ports.
• Changes can be runtime (immediate but temporary) or permanent (saved but require a reload). Always use --permanent for lasting changes.
• The firewall-cmd tool is your primary interface for managing rules, with key commands like --list-all, --add-service, --add-port, and --reload.
• Rich rules provide advanced, fine-grained control over traffic based on source, destination, and ports.

Preview of the Next Lesson:

You've now configured two critical layers of defense: secure remote access with SSH and network-level filtering with firewalld. But how do you know if these defenses are being tested? How do you investigate suspicious activity? In our next lesson, we will dive into system monitoring by learning how to analyze systemd journal entries and traditional log files for security events.