{"id":100821,"date":"2021-07-23T10:22:39","date_gmt":"2021-07-23T08:22:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-firewalld-1-0"},"modified":"2021-07-23T10:22:39","modified_gmt":"2021-07-23T08:22:39","slug":"vypusk-firewalld-1-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-firewalld-1-0","title":{"rendered":"Sortie de firewalld 1.0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>La version dynamique du pare-feu firewalld 1.0 a \u00e9t\u00e9 publi\u00e9e, mise en \u0153uvre sous la forme d'un wrapper au-dessus des filtres de paquets nftables et iptables. Firewalld fonctionne comme un processus en arri\u00e8re-plan, permettant de modifier dynamiquement les r\u00e8gles du filtre de paquets via D-Bus, sans avoir besoin de red\u00e9marrer les r\u00e8gles du filtre de paquets et sans interrompre les connexions \u00e9tablies. Le projet est d\u00e9j\u00e0 utilis\u00e9 dans de nombreuses distributions Linux, y compris RHEL 7+, Fedora 18+ et SUSE\/openSUSE 15+. Le code de firewalld est \u00e9crit en Python et distribu\u00e9 sous la licence GPLv2.      <\/p>\n<p>Pour g\u00e9rer le pare-feu, on utilise l'outil firewall-cmd, qui, lors de la cr\u00e9ation de r\u00e8gles, se base non pas sur <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/fr\/lir\/ipv4\/\"   title=\"adresses IP\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"837\">adresses IP<\/a>, des interfaces r\u00e9seau et des num\u00e9ros de ports, ainsi que des noms de services (par exemple, pour ouvrir l'acc\u00e8s \u00e0 SSH, il faut ex\u00e9cuter \u00ab firewall-cmd \u2014add \u2014service=ssh \u00bb, pour fermer SSH \u2014 \u00ab firewall-cmd \u2014remove \u2014service=ssh \u00bb). Pour modifier la configuration du pare-feu, l'interface graphique firewall-config (GTK) et l'applet firewall-applet (Qt) peuvent \u00e9galement \u00eatre utilis\u00e9es. La gestion du pare-feu via l'API D-BUS de firewalld est prise en charge dans des projets tels que NetworkManager, libvirt, podman, docker et fail2ban.    <\/p>\n<p>Le changement significatif du num\u00e9ro de version est d\u00fb \u00e0 des modifications qui rompent la compatibilit\u00e9 descendante et modifient le comportement de la gestion des zones. Tous les param\u00e8tres de filtrage d\u00e9finis dans une zone s'appliquent d\u00e9sormais uniquement au trafic destin\u00e9 \u00e0 l'h\u00f4te sur lequel firewalld est ex\u00e9cut\u00e9, tandis que pour le filtrage du trafic transit, des politiques doivent \u00eatre configur\u00e9es. Les changements les plus notables sont :  <\/p>\n<ul>\n<li class=\"l\"> Le backend permettant de fonctionner au-dessus d'iptables est d\u00e9clar\u00e9 obsol\u00e8te. Le support d'iptables sera maintenu dans un avenir proche, mais ce backend ne sera plus d\u00e9velopp\u00e9.\n<li class=\"l\"> Le mode intra-zone-forwarding est activ\u00e9 par d\u00e9faut pour toutes les nouvelles zones, permettant le libre mouvement des paquets entre les interfaces r\u00e9seau ou les sources de trafic au sein d'une m\u00eame zone (publique, bloc, de confiance, interne, etc.). Pour revenir \u00e0 l'ancien comportement et interdire le redirectionnement des paquets au sein d'une m\u00eame zone, vous pouvez utiliser la commande \u00ab firewall-cmd \u2014permanent \u2014zone public \u2014remove-forward \u00bb.\n<li class=\"l\"> Les r\u00e8gles li\u00e9es \u00e0 la traduction d'adresses (NAT) ont \u00e9t\u00e9 d\u00e9plac\u00e9es dans le groupe de protocoles \u00ab inet \u00bb (elles \u00e9taient auparavant ajout\u00e9es dans les groupes \u00ab ip \u00bb et \u00ab ip6 \u00bb, ce qui entra\u00eenait des duplications des r\u00e8gles pour IPv4 et IPv6). Ce changement a permis d'\u00e9liminer les doublons lors de l'utilisation d'ipset \u2014 au lieu de trois copies des enregistrements ipset, une seule est maintenant utilis\u00e9e.\n<li class=\"l\"> L'action \u00ab default \u00bb, sp\u00e9cifi\u00e9e dans le param\u00e8tre \u00ab \u2014set-target \u00bb, est d\u00e9sormais \u00e9quivalente \u00e0 \u00ab reject \u00bb, c'est-\u00e0-dire que tous les paquets ne correspondant pas \u00e0 des r\u00e8gles sp\u00e9cifiques dans la zone seront bloqu\u00e9s par d\u00e9faut. Une exception est pr\u00e9vue pour les paquets ICMP, qui continuent d'\u00eatre autoris\u00e9s. Pour revenir \u00e0 l'ancien comportement pour la zone publique \u00ab trusted \u00bb, vous pouvez utiliser les r\u00e8gles : firewall-cmd \u2014permanent \u2014new-policy allowForward firewall-cmd \u2014permanent \u2014policy allowForward \u2014set-target ACCEPT firewall-cmd \u2014permanent \u2014policy allowForward \u2014add-ingress-zone public firewall-cmd \u2014permanent \u2014policy allowForward \u2014add-egress-zone trusted firewall-cmd \u2014reload.\n<li class=\"l\"> Les politiques avec une priorit\u00e9 positive sont d\u00e9sormais ex\u00e9cut\u00e9es juste avant l'ex\u00e9cution de la r\u00e8gle \u00ab \u2014set-target catch-all \u00bb, c'est-\u00e0-dire au moment pr\u00e9c\u00e9dant l'ajout des r\u00e8gles finales de type drop, reject ou accept, y compris pour les zones utilisant \u00ab \u2014set-target drop|reject|accept \u00bb.\n<li class=\"l\"> Le blocage ICMP est maintenant appliqu\u00e9 uniquement aux paquets entrants adress\u00e9s au h\u00f4te actuel (input) et n'affecte pas les paquets redirig\u00e9s entre les zones (forward).\n<li class=\"l\"> Le service tftp-client, destin\u00e9 \u00e0 suivre les connexions pour le protocole TFTP, a \u00e9t\u00e9 supprim\u00e9 car il \u00e9tait inutilisable.\n<li class=\"l\"> L'interface \u00ab direct \u00bb a \u00e9t\u00e9 d\u00e9clar\u00e9e obsol\u00e8te, permettant d'ins\u00e9rer directement les r\u00e8gles de filtrage de paquets. Ce besoin a disparu apr\u00e8s l'ajout de la capacit\u00e9 de filtrer les paquets redirig\u00e9s et sortants.\n<li class=\"l\"> Un param\u00e8tre CleanupModulesOnExit a \u00e9t\u00e9 ajout\u00e9, qui est par d\u00e9faut d\u00e9fini sur \u00ab no \u00bb. Gr\u00e2ce \u00e0 ce param\u00e8tre, vous pouvez g\u00e9rer le d\u00e9chargement des modules du noyau apr\u00e8s l'ach\u00e8vement de firewalld.\n<li class=\"l\"> L'utilisation d'ipset est autoris\u00e9e lors de la d\u00e9finition du syst\u00e8me cible (destination).\n<li class=\"l\"> Ajout\u00e9es les d\u00e9finitions des services WireGuard, Kubernetes et netbios-ns.\n<li class=\"l\"> Des r\u00e8gles d'auto-compl\u00e9tion pour zsh ont \u00e9t\u00e9 mises en \u0153uvre.\n<li class=\"l\"> Le support de Python 2 a \u00e9t\u00e9 arr\u00eat\u00e9.\n<li class=\"l\"> La liste des d\u00e9pendances a \u00e9t\u00e9 r\u00e9duite. Pour faire fonctionner firewalld, \u00e0 part le noyau Linux, seules les biblioth\u00e8ques python dbus, gobject et nftables sont d\u00e9sormais n\u00e9cessaires, tandis que les paquets ebtables, ipset et iptables sont class\u00e9s comme optionnels. Les biblioth\u00e8ques python decorator et slip ont \u00e9t\u00e9 supprim\u00e9es des d\u00e9pendances.    <\/ul>\n<p>Source : <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=55537\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables. Firewalld \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0432 \u0432\u0438\u0434\u0435 \u0444\u043e\u043d\u043e\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 D-Bus, \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043f\u0440\u0430\u0432\u0438\u043b \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 \u0438 \u0431\u0435\u0437 \u0440\u0430\u0437\u0440\u044b\u0432\u0430 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439. \u041f\u0440\u043e\u0435\u043a\u0442 \u0443\u0436\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux, \u0432\u043a\u043b\u044e\u0447\u0430\u044f RHEL 7+, Fedora 18+ [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100821","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-firewalld-1-0\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"fr_FR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a firewalld 1.0 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-firewalld-1-0\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-07-23T08:22:39+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-07-23T08:22:39+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Lancement de firewalld 1.0 | ProHoster","description":"Le lancement de firewalld 1.0, un pare-feu dynamiquement g\u00e9r\u00e9, a \u00e9t\u00e9 annonc\u00e9, r\u00e9alis\u00e9 sous la forme d'un lien au-dessus des filtres de paquets nftables et iptables.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-firewalld-1-0","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a firewalld 1.0 | ProHoster","og:description":"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-firewalld-1-0","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-07-23T08:22:39+00:00","article:modified_time":"2021-07-23T08:22:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100821","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-07-24 00:03:32","updated":"2026-02-08 20:40:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/100821","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=100821"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/100821\/revisions"}],"predecessor-version":[{"id":158028,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/100821\/revisions\/158028"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=100821"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=100821"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=100821"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}