{"id":100821,"date":"2021-07-23T10:22:39","date_gmt":"2021-07-23T08:22:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-firewalld-1-0"},"modified":"2021-07-23T10:22:39","modified_gmt":"2021-07-23T08:22:39","slug":"vypusk-firewalld-1-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/vypusk-firewalld-1-0","title":{"rendered":"Udgivelsen af firewalld 1.0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Release af den dynamisk administrerede firewall firewalld 1.0 er blevet pr\u00e6senteret, implementeret som et lag oven p\u00e5 packetfiltrene nftables og iptables. Firewalld k\u00f8rer som en baggrundsproces, der g\u00f8r det muligt at \u00e6ndre firewallregler dynamisk via D-Bus uden at genstarte firewallreglerne og uden at afbryde etablerede forbindelser. Projektet anvendes allerede i mange Linux-distributioner, herunder RHEL 7+, Fedora 18+ og SUSE\/openSUSE 15+. Koden til firewalld er skrevet i Python og distribueres under GPLv2-licensen.      <\/p>\n<p>For at administrere firewallen bruges v\u00e6rkt\u00f8jet firewall-cmd, som ved oprettelse af regler baserer sig ikke p\u00e5 <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/da\/lir\/ipv4\/\"   title=\"IP-adresser\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"837\">IP-adresser<\/a>, netv\u00e6rksgr\u00e6nseflader og portnumre, samt tjenestens navne (for eksempel, for at \u00e5bne adgang til SSH, skal du udf\u00f8re &#171;firewall-cmd &#8212;add &#8212;service=ssh&#187;, for at lukke SSH &#8212; &#171;firewall-cmd &#8212;remove &#8212;service=ssh&#187;). Til \u00e6ndring af konfigurationen af firewallen kan ogs\u00e5 det grafiske interface firewall-config (GTK) og applet firewall-applet (Qt) anvendes. Der er underst\u00f8ttelse af firewallstyring gennem D-BUS API firewalld i projekter som NetworkManager, libvirt, podman, docker og fail2ban.    <\/p>\n<p>Den betydelige \u00e6ndring af versionsnummeret skyldes \u00e6ndringer, der bryder bagudkompatibiliteten og \u00e6ndrer adf\u00e6rden ved arbejdet med zoner. Alle de filtreringsparametre, der er defineret i zonen, anvendes nu kun for trafik, der er adresseret til den v\u00e6rtsmaskine, hvor firewalld k\u00f8rer, og for at filtrere transittrafik er det n\u00f8dvendigt at indstille politikker. De mest bem\u00e6rkelsesv\u00e6rdige \u00e6ndringer:  <\/p>\n<ul>\n<li class=\"l\"> Backend der gjorde det muligt at fungere oven p\u00e5 iptables er blevet markeret som for\u00e6ldet. Underst\u00f8ttelse af iptables vil blive opretholdt i den n\u00e6rmeste fremtid, men denne backend vil ikke blive videreudviklet.\n<li class=\"l\"> Indstillet og aktiveret som standard for alle nye zoner, er intrazon-forwarding-tilstand, som tillader fri bev\u00e6gelse af pakker mellem netv\u00e6rksgr\u00e6nseflader eller trafik- kilder inden for \u00e9n zone (public, block, trusted, internal osv.). For at genoprette den tidligere adf\u00e6rd og forbyde omdirigering af pakker inden for \u00e9n zone kan du bruge kommandoen &#171;firewall-cmd &#8212;permanent &#8212;zone public &#8212;remove-forward&#187;.\n<li class=\"l\"> Reglerne relateret til adresseovers\u00e6ttelse (NAT) er flyttet til protokolfamilien &#171;inet&#187; (tidligere blev de tilf\u00f8jet i familierne &#171;ip&#187; og &#171;ip6&#187;, hvilket f\u00f8rte til behovet for at duplikere regler for IPv4 og IPv6). \u00c6ndringen har gjort det muligt at undg\u00e5 dubletter ved brug af ipset &#8212; i stedet for tre kopier af ipset-poster anvendes nu \u00e9n.\n<li class=\"l\"> Handling &#171;default&#187;, angivet i parameteren &#171;&#8212;set-target&#187;, er nu lig med &#171;reject&#187;, dvs. alle pakker, der ikke falder ind under specifikke regler i zonen, vil som standard blive blokeret. Der er kun lavet en undtagelse for ICMP-pakker, som stadig vil blive tilladt. For at genoprette den gamle adf\u00e6rd for den offentligt tilg\u00e6ngelige zone &#171;trusted&#187; kan f\u00f8lgende regler anvendes:       firewall-cmd &#8212;permanent &#8212;new-policy allowForward      firewall-cmd &#8212;permanent &#8212;policy allowForward &#8212;set-target ACCEPT     firewall-cmd &#8212;permanent &#8212;policy allowForward &#8212;add-ingress-zone public     firewall-cmd &#8212;permanent &#8212;policy allowForward &#8212;add-egress-zone trusted     firewall-cmd &#8212;reload\n<li class=\"l\"> Politikker med positiv prioritet udf\u00f8res nu direkte f\u00f8r udf\u00f8relsen af reglen &#171;&#8212;set-target catch-all&#187;, dvs. i \u00f8jeblikket, der g\u00e5r forud for tilf\u00f8jelsen af de endelige regler drop, reject eller accept, ogs\u00e5 for zoner, hvor &#171;&#8212;set-target drop|reject|accept&#187; anvendes.\n<li class=\"l\"> Blokering af ICMP g\u00e6lder nu kun for de indkommende pakker, der er adresseret til den aktuelle v\u00e6rtsmaskine (input), og ber\u00f8rer ikke pakker, der videresendes mellem zoner (forward).\n<li class=\"l\"> Tjenesten tftp-client, der er beregnet til at overv\u00e5ge forbindelser til protokollen TFTP, er blevet fjernet, da den var ubrugelig.\n<li class=\"l\"> Gr\u00e6nsefladen &#171;direct&#187; er blevet erkl\u00e6ret for\u00e6ldet, hvilket gjorde det muligt at inds\u00e6tte f\u00e6rdige regler for pakkefiltrering direkte. Behovet for denne gr\u00e6nseflade er forsvundet efter tilf\u00f8jelsen af muligheden for at filtrere omdirigerede og udg\u00e5ende pakker.\n<li class=\"l\"> Parameteren CleanupModulesOnExit er blevet tilf\u00f8jet, og dens standardv\u00e6rdi er \u00e6ndret til &#171;no&#187;. Med denne parameter kan man styre aflastningen af kerne-moduler efter firewalld's afslutning.\n<li class=\"l\"> Brug af ipset er blevet tilladt ved bestemmelse af destinationssystemet (destination).\n<li class=\"l\"> Definitioner af tjenesterne WireGuard, Kubernetes og netbios-ns er blevet tilf\u00f8jet.\n<li class=\"l\"> Autocompletion regler for zsh er blevet implementeret.\n<li class=\"l\"> Underst\u00f8ttelsen af Python 2 er oph\u00f8rt.\n<li class=\"l\"> Listen over afh\u00e6ngigheder er blevet forkortet. For at f\u00e5 firewalld til at fungere kr\u00e6ves nu kun linux-kernen samt python-bibliotekerne dbus, gobject og nftables, mens pakkerne ebtables, ipset og iptables er blevet bedt om at v\u00e6re valgfrie. Python-bibliotekerne decorator og slip er blevet fjernet fra afh\u00e6ngighederne.    <\/ul>\n<p>Kilde: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=55537\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables. Firewalld \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0432 \u0432\u0438\u0434\u0435 \u0444\u043e\u043d\u043e\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 D-Bus, \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043f\u0440\u0430\u0432\u0438\u043b \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 \u0438 \u0431\u0435\u0437 \u0440\u0430\u0437\u0440\u044b\u0432\u0430 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439. \u041f\u0440\u043e\u0435\u043a\u0442 \u0443\u0436\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux, \u0432\u043a\u043b\u044e\u0447\u0430\u044f RHEL 7+, Fedora 18+ [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100821","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/da\/blog\/news\/vypusk-firewalld-1-0\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"da_DK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a firewalld 1.0 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/da\/blog\/news\/vypusk-firewalld-1-0\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-07-23T08:22:39+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-07-23T08:22:39+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Udgivelse af firewalld 1.0 | ProHoster","description":"Der er udgivet en version af den dynamisk styrede firewall firewalld 1.0, implementeret som et lag oven p\u00e5 pakke filternene nftables og iptables.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/vypusk-firewalld-1-0","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a firewalld 1.0 | ProHoster","og:description":"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/vypusk-firewalld-1-0","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-07-23T08:22:39+00:00","article:modified_time":"2021-07-23T08:22:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100821","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-07-24 00:03:32","updated":"2026-02-08 20:40:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/100821","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=100821"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/100821\/revisions"}],"predecessor-version":[{"id":158028,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/100821\/revisions\/158028"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=100821"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=100821"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=100821"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}