==========
Firewalld:
==========
:Title:   firewalld
:Author:  Douglas O'Leary <dkoleary@olearycomputers.com>
:Description:  notes on firewalld
:Date created: 12/15/17
:Date updated:
:Disclaimer: Standard: Use the information that follows at your own risk.  If you screw up a system, don't blame it on me...

<sigh>

Commands:
=========

systemctl status firewalld
  Displays firewalld status

firewall-cmd --get-services:
  List pre-defined services but all on one line.

firewall-cmd --add-service=ftp
  Add ftp to the list of services avaiable for the active zone

firewall-cmd --get-active-zone
  Displays the current/active zone

firewall-cmd --get-default-zone
  Displays the default zone

firewall-cmd --get-zones
  Displays all available zones.  Not overly useful::

    # firewall-cmd --get-zones
    block dmz drop external home internal public trusted work

firewall-cmd --list-all-zones
  Displays much more detailed information about each zone.

fireawll-cmd --list--all [ --zone=${zone} ]
  Displays current configuration of the active (or specified) zone which
  will include the assigned interfaces.

firewall-cmd --get-zone-of-interface=${interface}
  Identify the firewall zone to which an interface is assigned.

firewall-cmd --list-services [ --zone=${zone} ]
  Displays the services that have been enabled in the active or specified zone.

IP forwarding:
==============

If using firewalld to route/nat, ensure ip_forward is set::

  # sysctl net.ipv4.ip_forward
  net.ipv4.ip_forward = 1

Interfaces:
===========

* Files in /etc/firewalld (prob should leave those alone)
* firewall-config (GUI)
* firewall-cmd (cli)

Procedures:
-----------

Adding/deleting a service:
~~~~~~~~~~~~~~~~~~~~~~~~~~

::

  firewall-cmd --add-service=${service} [ --permanent ]
  firewall-cmd --delete-service=${service} [ --permanent ]
  firewall-cmd --reload

Identify a zone for a specific interface:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

::

  # firewall-cmd --get-zone-of-interface=eth1
  public