{"id":100821,"date":"2021-07-23T10:22:39","date_gmt":"2021-07-23T08:22:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-firewalld-1-0"},"modified":"2021-07-23T10:22:39","modified_gmt":"2021-07-23T08:22:39","slug":"vypusk-firewalld-1-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/vypusk-firewalld-1-0","title":{"rendered":"Rilascio di firewalld 1.0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>\u00c8 stato presentato il rilascio del firewall dinamicamente gestito firewalld 1.0, implementato come un'interfaccia sopra ai filtri dei pacchetti nftables e iptables. Firewalld viene eseguito come processo in background, consentendo di modificare dinamicamente le regole del filtro dei pacchetti tramite D-Bus, senza la necessit\u00e0 di ricaricare le regole del filtro dei pacchetti e senza interrompere le connessioni stabilite. Il progetto \u00e8 gi\u00e0 in uso in molte distribuzioni Linux, tra cui RHEL 7+, Fedora 18+ e SUSE\/openSUSE 15+. Il codice di firewalld \u00e8 scritto in Python ed \u00e8 distribuito sotto licenza GPLv2.      <\/p>\n<p>Per gestire il firewall viene utilizzata l'utility firewall-cmd, che si basa non su <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/it\/lir\/ipv4\/\"   title=\"indirizzi IP\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"837\">indirizzi IP<\/a>, interfacce di rete e numeri di porta, mentre i nomi dei servizi (ad esempio, per consentire l'accesso a SSH \u00e8 necessario eseguire &#171;firewall-cmd &#8212;add &#8212;service=ssh&#187;, per chiudere SSH &#8212; &#171;firewall-cmd &#8212;remove &#8212;service=ssh&#187;). Per modificare la configurazione del firewall pu\u00f2 essere utilizzata anche l'interfaccia grafica firewall-config (GTK) e l'applet firewall-applet (Qt). Il supporto per la gestione del firewall tramite l'API D-BUS di firewalld \u00e8 presente in progetti come NetworkManager, libvirt, podman, docker e fail2ban.    <\/p>\n<p>Il significativo cambiamento del numero di versione \u00e8 legato all'introduzione di modifiche che compromettono la compatibilit\u00e0 inversa e alterano il comportamento di gestione delle zone. Tutti i parametri di filtraggio definiti in una zona si applicano ora solo al traffico diretto all'host su cui \u00e8 in esecuzione firewalld, mentre per il filtraggio del traffico transitivo \u00e8 necessaria la configurazione delle politiche. Le modifiche pi\u00f9 evidenti sono:  <\/p>\n<ul>\n<li class=\"l\"> \u00c8 stata dichiarata obsoleta l'interfaccia backend che consentiva di lavorare sopra iptables. Il supporto per iptables verr\u00e0 mantenuto nel prossimo futuro, ma questo backend non verr\u00e0 ulteriormente sviluppato.\n<li class=\"l\"> Intra-zone-forwarding \u00e8 abilitato e attivato per impostazione predefinita per tutte le nuove zone, consentendo il libero movimento dei pacchetti tra interfacce di rete o sorgenti di traffico all'interno di una stessa zona (pubblica, blocco, fidata, interna, ecc.). Per ripristinare il comportamento precedente e vietare il reindirizzamento dei pacchetti all'interno di una stessa zona, \u00e8 possibile utilizzare il comando \u00abfirewall-cmd \u2014permanent \u2014zone public \u2014remove-forward\u00bb.\n<li class=\"l\"> Le regole relative alla traduzione degli indirizzi (NAT) sono state spostate nella famiglia di protocolli \u00abinet\u00bb (in precedenza aggiunte nelle famiglie \u00abip\u00bb e \u00abip6\u00bb, il che portava alla necessit\u00e0 di duplicare le regole per IPv4 e IPv6). La modifica ha consentito di eliminare i duplicati quando si utilizza ipset: invece di tre copie delle registrazioni ipset, ora viene utilizzata una sola copia.\n<li class=\"l\"> L'azione \u00abdefault\u00bb specificata nel parametro \u00ab\u2014set-target\u00bb \u00e8 ora equivalente a \u00abreject\u00bb, cio\u00e8 tutti i pacchetti che non rientrano nelle regole della zona saranno bloccati per impostazione predefinita. Un'eccezione \u00e8 fatta solo per i pacchetti ICMP, che continuano ad essere consentiti. Per ripristinare il comportamento precedente per la zona pubblicamente accessibile \u00abtrusted\u00bb, \u00e8 possibile utilizzare le regole: firewall-cmd \u2014permanent \u2014new-policy allowForward firewall-cmd \u2014permanent \u2014policy allowForward \u2014set-target ACCEPT firewall-cmd \u2014permanent \u2014policy allowForward \u2014add-ingress-zone public firewall-cmd \u2014permanent \u2014policy allowForward \u2014add-egress-zone trusted firewall-cmd \u2014reload\n<li class=\"l\"> Le politiche con priorit\u00e0 positiva vengono ora eseguite immediatamente prima dell'esecuzione della regola \u00ab\u2014set-target catch-all\u00bb, cio\u00e8 nel momento precedente all'aggiunta delle regole finali di drop, reject o accept, anche per le zone in cui vengono utilizzati \u00ab\u2014set-target drop|reject|accept\u00bb.\n<li class=\"l\"> Il blocco ICMP ora si applica solo ai pacchetti in entrata indirizzati all'host corrente (input) e non influisce sui pacchetti inoltrati tra le zone (forward).\n<li class=\"l\"> Il servizio tftp-client, destinato a monitorare le connessioni per il protocollo TFTP ma reso inutilizzabile, \u00e8 stato rimosso.\n<li class=\"l\"> L'interfaccia \u00abdirect\u00bb \u00e8 stata dichiarata obsoleta, consentendo di inserire direttamente le regole pronte per il filtraggio dei pacchetti. La necessit\u00e0 di questa interfaccia \u00e8 venuta meno dopo l'aggiunta della possibilit\u00e0 di filtrare i pacchetti reindirizzati e in uscita.\n<li class=\"l\"> \u00c8 stato aggiunto il parametro CleanupModulesOnExit, che per impostazione predefinita \u00e8 stato modificato in \u00abno\u00bb. Con questo parametro \u00e8 possibile gestire il caricamento dei moduli del kernel dopo la chiusura di firewalld.\n<li class=\"l\"> \u00c8 stato autorizzato l'uso di ipset nella definizione del sistema di destinazione (destination).\n<li class=\"l\"> Sono state aggiunte le definizioni dei servizi WireGuard, Kubernetes e netbios-ns.\n<li class=\"l\"> \u00c8 stata implementata la regola di completamento automatico per zsh.\n<li class=\"l\"> \u00c8 terminato il supporto per Python 2.\n<li class=\"l\"> \u00c8 stata ridotto l'elenco delle dipendenze. Per il funzionamento di firewalld, oltre al kernel Linux, sono ora richieste solo le librerie Python dbus, gobject e nftables, mentre i pacchetti ebtables, ipset e iptables sono stati classificati come opzionali. Dall'elenco delle dipendenze sono state rimosse le librerie Python decorator e slip.    <\/ul>\n<p>Fonte: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=55537\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables. Firewalld \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0432 \u0432\u0438\u0434\u0435 \u0444\u043e\u043d\u043e\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 D-Bus, \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043f\u0440\u0430\u0432\u0438\u043b \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 \u0438 \u0431\u0435\u0437 \u0440\u0430\u0437\u0440\u044b\u0432\u0430 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439. \u041f\u0440\u043e\u0435\u043a\u0442 \u0443\u0436\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux, \u0432\u043a\u043b\u044e\u0447\u0430\u044f RHEL 7+, Fedora 18+ [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100821","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/it\/blog\/news\/vypusk-firewalld-1-0\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"it_IT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a firewalld 1.0 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/it\/blog\/news\/vypusk-firewalld-1-0\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-07-23T08:22:39+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-07-23T08:22:39+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Rilascio di firewalld 1.0 | ProHoster","description":"\u00c8 stato presentato il rilascio del firewall dinamicamente gestito firewalld 1.0, realizzato come una delega sopra i filtri dei pacchetti nftables e iptables.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/vypusk-firewalld-1-0","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a firewalld 1.0 | ProHoster","og:description":"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables.","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/vypusk-firewalld-1-0","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-07-23T08:22:39+00:00","article:modified_time":"2021-07-23T08:22:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100821","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-07-24 00:03:32","updated":"2026-02-08 20:40:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/100821","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=100821"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/100821\/revisions"}],"predecessor-version":[{"id":158028,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/100821\/revisions\/158028"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=100821"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=100821"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=100821"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}