====== Firewalld ======

===== List firewall rules =====

<cli prompt='#'>
manu-opensuse:~ # firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0 wlan0
  sources: 
  services: dhcpv6-client ms-wbt
  ports: 
  protocols: 
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 
</cli>

Check the firewall status
<cli prompt='#'>
manu-opensuse:~ # firewall-cmd --state
running
</cli>

===== Add a rule =====

<cli prompt='#'>
manu-opensuse:~ # firewall-cmd --add-service=http --zone=public --permanent
manu-opensuse:~ # firewall-cmd --add-port=1600/tcp --zone=public --permanent
manu-opensuse:~ # firewall-cmd --reload
</cli>

To remove a port use:
<cli prompt='#'>
manu-opensuse:~ # firewall-cmd --zone=public --remove-port=1555/tcp --permanent
</cli>

Config file:
<cli prompt='#'>
[root@tiprglp01 etc]# cat /etc/firewalld/zones/public.xml
<?xml version="1.0" encoding="utf-8"?>
<zone>
  <short>Public</short>
  <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
  <service name="ssh"/>
  <service name="dhcpv6-client"/>
  <port protocol="tcp" port="1500"/>
  <port protocol="tcp" port="11090"/>
  <port protocol="tcp" port="1550"/>
  <port protocol="tcp" port="1600"/>
  <port protocol="tcp" port="1650"/>
  <port protocol="tcp" port="1501"/>
  <port protocol="tcp" port="1581"/>
  <port protocol="tcp" port="1555"/>
  <port protocol="tcp" port="10050"/>
  <port protocol="udp" port="10050"/>
</zone>
</cli>

===== Firewall debug =====

Enable the firewall log (value between 1 and 10)
<cli prompt='#'>
[root@tiprglp01 etc]# cat /etc/sysconfig/firewalld 
# firewalld command line args
# possile values: --debug
FIREWALLD_ARGS="--debug=2"
</cli>

The log is automatically created in **/var/log/firewalld**

===== Logging all inbound and outbound traffic with firewalld direct rules =====

Rule to log all incoming traffic setting log level to 4:
<cli prompt='#'>
# firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -p all -s 0.0.0.0/0 -j LOG --log-prefix "INPUT " --log-level 4
</cli>

Rule to log all outgoing traffic setting log level to 4:
<cli prompt='#'>
# firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -p all -s 192.168.1.10 -j LOG --log-prefix "OUTPUT " --log-level 4
</cli>
With nftables as backend, direct rules are given a higher precedence than all other firewalld rules.

To check if the rules are applied:
<cli prompt='#'>
# firewall-cmd --direct --get-all-rules
</cli>

To make the rules permanent:
<cli prompt='#'>
# firewall-cmd --runtime-to-permanent
</cli>

To list all direct permanent rules:
<cli prompt='#'>
# firewall-cmd --direct --get-all-rules --permanent
</cli>
Traffic logs are written in /var/log/firewall