{"id":100821,"date":"2021-07-23T10:22:39","date_gmt":"2021-07-23T08:22:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-firewalld-1-0"},"modified":"2021-07-23T10:22:39","modified_gmt":"2021-07-23T08:22:39","slug":"vypusk-firewalld-1-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/vypusk-firewalld-1-0","title":{"rendered":"Vyd\u00e1n\u00ed firewalld 1.0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Byla vyd\u00e1na verze dynamicky \u0159\u00edzen\u00e9ho firewallu firewalld 1.0, implementovan\u00e9ho jako wrapper nad paketov\u00fdmi filtry nftables a iptables. Firewalld b\u011b\u017e\u00ed jako na pozad\u00ed spu\u0161t\u011bn\u00fd proces, kter\u00fd umo\u017e\u0148uje dynamicky m\u011bnit pravidla paketov\u00e9ho filtru p\u0159es D-Bus, ani\u017e by bylo nutn\u00e9 restartovat pravidla a p\u0159eru\u0161it existuj\u00edc\u00ed spojen\u00ed. Projekt je ji\u017e pou\u017e\u00edv\u00e1n v mnoha distribuc\u00edch Linuxu, v\u010detn\u011b RHEL 7+, Fedora 18+ a SUSE\/openSUSE 15+. K\u00f3d firewalld je naps\u00e1n v Pythonu a je distribuov\u00e1n pod licenc\u00ed GPLv2.      <\/p>\n<p>Pro spr\u00e1vu firewallu se pou\u017e\u00edv\u00e1 n\u00e1stroj firewall-cmd, kter\u00fd p\u0159i vytv\u00e1\u0159en\u00ed pravidel vych\u00e1z\u00ed nikoli z <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/cs\/lir\/ipv4\/\"   title=\"IP adress\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"837\">IP adress<\/a>, s\u00ed\u0165ov\u00fdch rozhran\u00ed a \u010d\u00edsel port\u016f, zat\u00edmco n\u00e1zvy slu\u017eeb (nap\u0159\u00edklad pro povolen\u00ed p\u0159\u00edstupu k SSH je t\u0159eba spustit &#171;firewall-cmd &#8212;add &#8212;service=ssh&#187;, pro zablokov\u00e1n\u00ed SSH &#8212; &#171;firewall-cmd &#8212;remove &#8212;service=ssh&#187;). Pro zm\u011bnu konfigurace firewallu m\u016f\u017ee b\u00fdt tak\u00e9 pou\u017eit grafick\u00fd rozhran\u00ed firewall-config (GTK) a applet firewall-applet (Qt). Podpora spr\u00e1vy firewallu prost\u0159ednictv\u00edm D-BUS API firewalld je dostupn\u00e1 v projektech, jako jsou NetworkManager, libvirt, podman, docker a fail2ban.    <\/p>\n<p>V\u00fdznamn\u00e1 zm\u011bna \u010d\u00edsla verze souvis\u00ed se zm\u011bnami, kter\u00e9 nejsou zp\u011btn\u011b kompatibiln\u00ed a m\u011bn\u00ed chov\u00e1n\u00ed p\u0159i pr\u00e1ci se z\u00f3nami. V\u0161echny parametry filtrov\u00e1n\u00ed definovan\u00e9 v z\u00f3n\u011b se nyn\u00ed vztahuj\u00ed pouze na provoz adresovan\u00fd hostiteli, na kter\u00e9m b\u011b\u017e\u00ed firewalld, pro filtrov\u00e1n\u00ed transitn\u00edho provozu je nutn\u00e1 konfigurace politik. Nejpozoruhodn\u011bj\u0161\u00ed zm\u011bny:  <\/p>\n<ul>\n<li class=\"l\"> Byl vy\u0159azen backend, kter\u00fd umo\u017e\u0148oval fungov\u00e1n\u00ed nad iptables. Podpora iptables bude zachov\u00e1na v dohledn\u00e9 budoucnosti, ale tento backend se ji\u017e nebude vyv\u00edjet.\n<li class=\"l\"> Intra-zone-forwarding is enabled and activated by default for all new zones, allowing free movement of packets between network interfaces or traffic sources within the same zone (public, block, trusted, internal, etc.). To revert to the old behavior and prohibit packet forwarding within the same zone, the command \u00abfirewall-cmd \u2014permanent \u2014zone public \u2014remove-forward\u00bb can be used.\n<li class=\"l\"> Rules related to address translation (NAT) have been moved to the \u2018inet\u2019 protocol family (previously added in the \u2018ip\u2019 and \u2018ip6\u2019 families, which required duplicating rules for IPv4 and IPv6). This change eliminated duplicates when using ipset \u2014 instead of three copies of ipset entries, only one is now used.\n<li class=\"l\"> The \u2018default\u2019 action specified in the \u2018\u2014set-target\u2019 parameter is now equivalent to \u2018reject\u2019, meaning that all packets not covered by specific zone rules will be blocked by default. An exception is made for ICMP packets, which are still allowed. To revert to the old behavior for the publicly accessible \u2018trusted\u2019 zone, the following rules can be used:       firewall-cmd \u2014permanent \u2014new-policy allowForward      firewall-cmd \u2014permanent \u2014policy allowForward \u2014set-target ACCEPT     firewall-cmd \u2014permanent \u2014policy allowForward \u2014add-ingress-zone public     firewall-cmd \u2014permanent \u2014policy allowForward \u2014add-egress-zone trusted     firewall-cmd \u2014reload\n<li class=\"l\"> Policies with positive priority are now executed just before the \u2018\u2014set-target catch-all\u2019 rule is applied, i.e., at the moment preceding the addition of final drop, reject, or accept rules, including for zones where \u2018\u2014set-target drop|reject|accept\u2019 is used.\n<li class=\"l\"> Blokace ICMP se nyn\u00ed aplikuje pouze na p\u0159\u00edchoz\u00ed pakety adresovan\u00e9 aktu\u00e1ln\u00edmu hostu (input) a neovliv\u0148uje pakety p\u0159esm\u011brov\u00e1van\u00e9 mezi z\u00f3nami (forward).\n<li class=\"l\"> Byla odstran\u011bna slu\u017eba tftp-client, ur\u010den\u00e1 pro sledov\u00e1n\u00ed p\u0159ipojen\u00ed pro protokol TFTP, ale nach\u00e1zej\u00edc\u00ed se ve nevhodn\u00e9m stavu pro pou\u017eit\u00ed.\n<li class=\"l\"> The \u2018direct\u2019 interface, which allowed the direct insertion of ready-made packet filter rules, has been deprecated. The need for this interface has disappeared after the addition of the ability to filter redirected and outgoing packets.\n<li class=\"l\"> The CleanupModulesOnExit parameter has been added, which is set by default to \u2018no\u2019. This parameter can be used to manage the unloading of kernel modules after the firewalld service stops.\n<li class=\"l\"> Bylo povoleno pou\u017eit\u00ed ipset p\u0159i definov\u00e1n\u00ed c\u00edlov\u00e9ho syst\u00e9mu (destination).\n<li class=\"l\"> Byly p\u0159id\u00e1ny definice slu\u017eeb WireGuard, Kubernetes a netbios-ns.\n<li class=\"l\"> Byla implementov\u00e1na pravidla automatick\u00e9ho dokon\u010dov\u00e1n\u00ed pro zsh.\n<li class=\"l\"> Podpora Python 2 byla ukon\u010dena.\n<li class=\"l\"> Seznam z\u00e1vislost\u00ed byl zkr\u00e1cen. Pro provoz firewalld, krom\u011b j\u00e1dra Linux, nyn\u00ed vy\u017eaduje pouze python knihovny dbus, gobject a nftables, zat\u00edmco bal\u00ed\u010dky ebtables, ipset a iptables byly za\u0159azeny jako voliteln\u00e9. Z\u00e1vislosti python knihoven decorator a slip byly odstran\u011bny.    <\/ul>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=55537\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables. Firewalld \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0432 \u0432\u0438\u0434\u0435 \u0444\u043e\u043d\u043e\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 D-Bus, \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043f\u0440\u0430\u0432\u0438\u043b \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 \u0438 \u0431\u0435\u0437 \u0440\u0430\u0437\u0440\u044b\u0432\u0430 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439. \u041f\u0440\u043e\u0435\u043a\u0442 \u0443\u0436\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux, \u0432\u043a\u043b\u044e\u0447\u0430\u044f RHEL 7+, Fedora 18+ [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100821","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/news\/vypusk-firewalld-1-0\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a firewalld 1.0 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/news\/vypusk-firewalld-1-0\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-07-23T08:22:39+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-07-23T08:22:39+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vyd\u00e1n\u00ed firewalld 1.0 | ProHoster","description":"Bylo uvedeno vyd\u00e1n\u00ed dynamicky \u0159\u00edzen\u00e9 firewall p\u0159ehr\u00e1va\u010de firewalld 1.0, implementovan\u00e9ho ve form\u011b obalu nad filtrov\u00e1n\u00edm paket\u016f nftables a iptables.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/vypusk-firewalld-1-0","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a firewalld 1.0 | ProHoster","og:description":"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/vypusk-firewalld-1-0","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-07-23T08:22:39+00:00","article:modified_time":"2021-07-23T08:22:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100821","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-07-24 00:03:32","updated":"2026-02-08 20:40:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/100821","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=100821"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/100821\/revisions"}],"predecessor-version":[{"id":158028,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/100821\/revisions\/158028"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=100821"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=100821"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=100821"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}