{"id":100821,"date":"2021-07-23T10:22:39","date_gmt":"2021-07-23T08:22:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-firewalld-1-0"},"modified":"2021-07-23T10:22:39","modified_gmt":"2021-07-23T08:22:39","slug":"vypusk-firewalld-1-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/vypusk-firewalld-1-0","title":{"rendered":"Uscita di firewalld 1.0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>\u00c8 stato rilasciato il firewall dinamico firewalld 1.0, implementato come interfaccia sopra i filtri pacchetti nftables e iptables. Firewalld viene eseguito come processo in background, consentendo di modificare dinamicamente le regole del filtro dei pacchetti tramite D-Bus, senza la necessit\u00e0 di ricaricare le regole del filtro dei pacchetti e senza interrompere le connessioni stabilite. Il progetto \u00e8 gi\u00e0 utilizzato in molte distribuzioni Linux, tra cui RHEL 7+, Fedora 18+ e SUSE\/openSUSE 15+. Il codice di firewalld \u00e8 scritto in Python ed \u00e8 rilasciato sotto la licenza GPLv2.      <\/p>\n<p>Per gestire il firewall si utilizza lo strumento firewall-cmd, che nella creazione delle regole si basa non su <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/it\/lir\/ipv4\/\"   title=\"IP addresses\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"837\">IP addresses<\/a>, interfacce di rete e numeri di porta, e tramite nomi di servizio (ad esempio, per consentire l'accesso a SSH \u00e8 necessario eseguire &#171;firewall-cmd &#8212;add &#8212;service=ssh&#187;, per chiudere SSH &#8212; &#171;firewall-cmd &#8212;remove &#8212;service=ssh&#187;). Per modificare la configurazione del firewall pu\u00f2 essere utilizzata anche l'interfaccia grafica firewall-config (GTK) e l'applet firewall-applet (Qt). Il supporto per la gestione del firewall tramite D-BUS API firewalld \u00e8 presente in progetti come NetworkManager, libvirt, podman, docker e fail2ban.    <\/p>\n<p>Una modifica significativa del numero di versione \u00e8 legata a cambiamenti che rompono la compatibilit\u00e0 retroattiva e modificano il comportamento della gestione delle zone. Tutti i parametri di filtraggio definiti nella zona ora si applicano solo al traffico indirizzato all'host su cui \u00e8 in esecuzione firewalld, mentre per filtrare il traffico di transito \u00e8 necessaria la configurazione delle politiche. Le modifiche pi\u00f9 rilevanti includono:  <\/p>\n<ul>\n<li class=\"l\"> \u00c8 stato dichiarato obsoleto il backend che consentiva di operare sopra iptables. Il supporto per iptables sar\u00e0 mantenuto nel prossimo futuro, ma questo backend non verr\u00e0 ulteriormente sviluppato.\n<li class=\"l\"> Il forwarding intra-zone \u00e8 attivato e impostato come predefinito per tutte le nuove zone, consentendo il libero movimento dei pacchetti tra le interfacce di rete o le fonti di traffico all'interno di una zona (pubblica, blocco, fidata, interna, ecc.). Per ripristinare il comportamento precedente e vietare il forwarding dei pacchetti all'interno di una stessa zona, \u00e8 possibile utilizzare il comando \u00abfirewall-cmd \u2014permanent \u2014zone public \u2014remove-forward\u00bb.\n<li class=\"l\"> Le regole relative alla traduzione degli indirizzi (NAT) sono state spostate nella famiglia di protocolli \u00abinet\u00bb (in precedenza venivano aggiunte nelle famiglie \u00abip\u00bb e \u00abip6\u00bb, il che comportava la necessit\u00e0 di duplicare le regole per IPv4 e IPv6). Questa modifica ha eliminato i duplicati nell'uso di ipset: invece di tre copie delle registrazioni, ora viene utilizzata una sola copia.\n<li class=\"l\"> L'azione \u00abdefault\u00bb indicata nel parametro \u00ab\u2014set-target\u00bb \u00e8 ora equivalente a \u00abreject\u00bb, cio\u00e8 tutti i pacchetti che non soddisfano le regole specifiche della zona verranno bloccati per impostazione predefinita. L'unica eccezione \u00e8 per i pacchetti ICMP, che continuano a passare. Per ripristinare il comportamento precedente per la zona pubblicamente accessibile \u00abtrusted\u00bb, \u00e8 possibile utilizzare le seguenti regole: firewall-cmd \u2014permanent \u2014new-policy allowForward firewall-cmd \u2014permanent \u2014policy allowForward \u2014set-target ACCEPT firewall-cmd \u2014permanent \u2014policy allowForward \u2014add-ingress-zone public firewall-cmd \u2014permanent \u2014policy allowForward \u2014add-egress-zone trusted firewall-cmd \u2014reload\n<li class=\"l\"> Le politiche con priorit\u00e0 positiva vengono ora eseguite immediatamente prima dell'esecuzione della regola \u00ab\u2014set-target catch-all\u00bb, cio\u00e8 nel momento precedente all'aggiunta delle regole finali drop, reject o accept, comprese le zone in cui vengono utilizzate \u00ab\u2014set-target drop|reject|accept\u00bb.\n<li class=\"l\"> Il blocco ICMP ora si applica solo ai pacchetti in ingresso indirizzati all'host corrente (input) e non influisce sui pacchetti reindirizzati tra le aree (forward).\n<li class=\"l\"> Il servizio tftp-client, destinato a monitorare le connessioni per il protocollo TFTP, \u00e8 stato rimosso poich\u00e9 era ineseguibile.\n<li class=\"l\"> L'interfaccia \u00abdirect\u00bb \u00e8 stata dichiarata obsoleta, permettendo l'inserimento diretto delle regole di filtraggio dei pacchetti. La necessit\u00e0 di questa interfaccia \u00e8 venuta meno dopo l'aggiunta della possibilit\u00e0 di filtrare i pacchetti inoltrati e in uscita.\n<li class=\"l\"> \u00c8 stato aggiunto il parametro CleanupModulesOnExit, che per impostazione predefinita \u00e8 stato modificato su \u00abno\u00bb. Con questo parametro \u00e8 possibile gestire il caricamento dei moduli del kernel dopo la chiusura di firewalld.\n<li class=\"l\"> \u00c8 consentito l'uso di ipset nella definizione del sistema di destinazione (destination).\n<li class=\"l\"> Aggiunti i servizi WireGuard, Kubernetes e netbios-ns.\n<li class=\"l\"> Sono state implementate le regole di completamento automatico per zsh.\n<li class=\"l\"> Il supporto per Python 2 \u00e8 stato interrotto.\n<li class=\"l\"> L'elenco delle dipendenze \u00e8 stato semplificato. Per l'uso di firewalld, oltre al kernel Linux, sono ora necessari solo le librerie Python dbus, gobject e nftables, mentre i pacchetti ebtables, ipset e iptables sono stati resi opzionali. Le librerie Python decorator e slip sono state rimosse dalle dipendenze.    <\/ul>\n<p>Fonte: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=55537\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables. Firewalld \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0432 \u0432\u0438\u0434\u0435 \u0444\u043e\u043d\u043e\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 D-Bus, \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043f\u0440\u0430\u0432\u0438\u043b \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 \u0438 \u0431\u0435\u0437 \u0440\u0430\u0437\u0440\u044b\u0432\u0430 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439. \u041f\u0440\u043e\u0435\u043a\u0442 \u0443\u0436\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux, \u0432\u043a\u043b\u044e\u0447\u0430\u044f RHEL 7+, Fedora 18+ [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100821","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/it\/blog\/news\/vypusk-firewalld-1-0\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"it_IT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a firewalld 1.0 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/it\/blog\/news\/vypusk-firewalld-1-0\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-07-23T08:22:39+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-07-23T08:22:39+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Rilascio di firewalld 1.0 | ProHoster","description":"\u00c8 stato presentato il rilascio del firewall firewalld 1.0, gestito dinamicamente, realizzato come un livello di astrazione sopra i filtri pacchetti nftables e iptables.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/vypusk-firewalld-1-0","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a firewalld 1.0 | ProHoster","og:description":"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables.","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/vypusk-firewalld-1-0","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-07-23T08:22:39+00:00","article:modified_time":"2021-07-23T08:22:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100821","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-07-24 00:03:32","updated":"2026-02-08 20:40:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/100821","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=100821"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/100821\/revisions"}],"predecessor-version":[{"id":158028,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/100821\/revisions\/158028"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=100821"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=100821"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=100821"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}