The release of the dynamically managed firewall firewalld 1.0 has been announced. It is implemented as a wrapper over the packet filters nftables and iptables. Firewalld runs as a background process, allowing dynamic changes to the packet filter rules via D-Bus, without the need to reload the packet filter rules or interrupt established connections. The project is already being used in many Linux distributions, including RHEL 7+, Fedora 18+, and SUSE/openSUSE 15+. The firewalld code is written in Python and is distributed under the GPLv2 license.
The firewall is managed using the utility firewall-cmd, which creates rules based not on (the key to connect to is specified, and iroh finds the associated host and establishes an encrypted connection using the QUIC protocol). Direct P2P connections are established whenever possible, but if not, it falls back to using relays, which are also employed for host discovery by keys. You can run your own relay or connect to public relays supported by the community., network interfaces, and port numbers, as well as service names (for instance, to allow SSH access, one would execute "firewall-cmd --add --service=ssh", and to close SSH access -- "firewall-cmd --remove --service=ssh"). The firewall configuration can also be modified using the firewall-config graphical interface (GTK) and the firewall-applet (Qt). Support for managing the firewall via the D-BUS API firewalld is available in projects such as NetworkManager, libvirt, podman, docker, and fail2ban.
The significant version number change is due to modifications that break backward compatibility and change the behavior of zone management. All parameters defined in a zone are now only applied to traffic addressed to the host running firewalld, while filtering transit traffic requires policy configuration. The most notable changes include:
- The backend that allowed operation over iptables has been deprecated. Support for iptables will be maintained in the foreseeable future, but this backend will not be further developed.
- The intra-zone-forwarding mode is now enabled and activated by default for all new zones, allowing free movement of packets between network interfaces or traffic sources within a single zone (public, block, trusted, internal, etc.). To revert to the old behavior and prohibit packet forwarding within a single zone, the command ‘firewall-cmd --permanent --zone public --remove-forward’ can be used.
- The rules related to address translation (NAT) have been moved to the ‘inet’ protocol family (previously added in the ‘ip’ and ‘ip6’ families, which required duplication of rules for IPv4 and IPv6). This change eliminated duplicates when using ipset — instead of three copies of ipset entries, now only one is used.
- The action "default" specified in the "—set-target" parameter is now equivalent to "reject", meaning that all packets not falling under specific rules in the zone will be blocked by default. The only exception is made for ICMP packets, which are still allowed. To revert to the old behavior for the publicly accessible zone "trusted", the following rules can be used: firewall-cmd —permanent —new-policy allowForward firewall-cmd —permanent —policy allowForward —set-target ACCEPT firewall-cmd —permanent —policy allowForward —add-ingress-zone public firewall-cmd —permanent —policy allowForward —add-egress-zone trusted firewall-cmd —reload
- Policies with a positive priority are now executed directly before the execution of the "—set-target catch-all" rule, i.e., at the moment preceding the addition of the final rules drop, reject, or accept, including for zones using "—set-target drop|reject|accept".
- Blocking ICMP now only applies to incoming packets addressed to the current host (input) and does not affect packets forwarded between zones (forward).
- The tftp-client service, intended for tracking connections for the TFTP protocol but found to be unusable, has been removed.
- The "direct" interface, which allowed for directly substituting ready-made packet filtering rules, has been deprecated. The need for this interface has vanished after the addition of the ability to filter redirected and outgoing packets.
- A parameter CleanupModulesOnExit has been added, which by default has been changed to "no". This parameter allows management of unloading kernel modules after firewalld shuts down.
- The use of ipset is now allowed when defining the target system (destination).
- Definitions for WireGuard, Kubernetes, and netbios-ns services have been added.
- Autocomplete rules for zsh have been implemented.
- Support for Python 2 has been discontinued.
- The dependency list has been shortened. For firewalld to work, in addition to the Linux kernel, only the python libraries dbus, gobject, and nftables are now required, while the packages ebtables, ipset and iptables have been moved to optional. The python libraries decorator and slip have been removed from the dependencies.
Source: opennet.ru
