{"id":100821,"date":"2021-07-23T10:22:39","date_gmt":"2021-07-23T08:22:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-firewalld-1-0"},"modified":"2021-07-23T10:22:39","modified_gmt":"2021-07-23T08:22:39","slug":"vypusk-firewalld-1-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/news\/vypusk-firewalld-1-0","title":{"rendered":"firewalld 1.0 izlaidums","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Ir izlaists dinamiski p\u0101rvald\u0101ma ugunsm\u016bra firewalld 1.0 atjaunin\u0101jums, kas realiz\u0113ts k\u0101 iesai\u0146ojums virs pakot\u0146u filtriem nftables un iptables. Firewalld darbojas k\u0101 fons, \u013caujot dinamiski main\u012bt pakot\u0146u filtra noteikumus caur D-Bus, bez nepiecie\u0161am\u012bbas p\u0101rstart\u0113t pakot\u0146u filtra noteikumus un bez savienojumu p\u0101rtraukumiem. Projekts jau tiek izmantots daudzos Linux izplat\u012bjumos, tostarp RHEL 7+, Fedora 18+ un SUSE\/openSUSE 15+. Firewalld kods ir uzrakst\u012bts Python valod\u0101 un tiek izplat\u012bts saska\u0146\u0101 ar GPLv2 licenci.      <\/p>\n<p>Ugunsm\u016bra p\u0101rvald\u012b\u0161anai tiek izmantots r\u012bks firewall-cmd, kas noteikumu izveid\u0113 balst\u0101s nevis uz <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/lv\/lir\/ipv4\/\"   title=\"IP adreses\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"837\">IP adreses<\/a>, t\u012bklu interfeisiem un portu numuriem, un no pakalpojumu nosaukumiem (piem\u0113ram, lai atv\u0113rtu piek\u013cuvi SSH, j\u0101izpilda &#171;firewall-cmd &#8212;add &#8212;service=ssh&#187;, lai aizv\u0113rtu SSH &#8212; &#171;firewall-cmd &#8212;remove &#8212;service=ssh&#187;). Lai main\u012btu ugunsm\u016bra konfigur\u0101ciju, var izmantot ar\u012b grafisko interfeisu firewall-config (GTK) un applet firewall-applet (Qt). Atbalsts ugunsm\u016bra p\u0101rvald\u012bbai, izmantojot D-BUS API firewalld, ir pieejams t\u0101dos projektos k\u0101 NetworkManager, libvirt, podman, docker un fail2ban.    <\/p>\n<p>Iev\u0113rojam\u0101 versijas numura mai\u0146a ir saist\u012bta ar izmai\u0146\u0101m, kas p\u0101rtrauc atpaka\u013c\u0113jo sader\u012bbu un maina darbu ar zon\u0101m. Visi parametri, kas noteikti zon\u0101, tagad tiek piem\u0113roti tikai tam trafikam, kas adres\u0113ts hostam, kur\u0101 darbojas firewalld, un, lai filtr\u0113tu tranz\u012bta trafiku, nepiecie\u0161ama politiku iestat\u012b\u0161ana. Visredzam\u0101k\u0101s izmai\u0146as ir \u0161\u0101das:  <\/p>\n<ul>\n<li class=\"l\"> Ir pazi\u0146ots par iptables b\u0101zes aizmugures noveco\u0161anu. Atbalsts iptables tiks saglab\u0101ts tuv\u0101kaj\u0101 n\u0101kotn\u0113, ta\u010du \u0161is aizmugure neatt\u012bst\u012bsies.\n<li class=\"l\"> Iesl\u0113gts un aktiviz\u0113ts p\u0113c noklus\u0113juma vis\u0101m jaunaj\u0101m zon\u0101m re\u017e\u012bms intra-zone-forwarding, kas at\u013cauj br\u012bvu paketu p\u0101rvieto\u0161anos starp t\u012bklu interfeisiem vai satiksmes avotiem vien\u0101 zon\u0101 (public, block, trusted, internal utt.). Lai atjaunotu iepriek\u0161\u0113jo uzved\u012bbu un aizliegtu paketu p\u0101radres\u0113\u0161anu vienas zonas iek\u0161ien\u0113, var izmantot komandu &#171;firewall-cmd &#8212;permanent &#8212;zone public &#8212;remove-forward&#187;.\n<li class=\"l\"> Noteikumi, kas saist\u012bti ar adresu p\u0101rv\u0113r\u0161anu (NAT), ir p\u0101rvietoti uz protokolu \u0123imeni &#171;inet&#187; (agr\u0101k tie tika pievienoti \u0123imen\u0113m &#171;ip&#187; un &#171;ip6&#187;, kas rad\u012bja nepiecie\u0161am\u012bbu dubl\u0113t noteikumus gan IPv4, gan IPv6). Izmai\u0146as \u013c\u0101va atbr\u012bvoties no dublik\u0101tiem, izmantojot ipset &#8212; tagad tiek izmantota viena ierakstu kopija, nevis tr\u012bs.\n<li class=\"l\"> Darb\u012bba &#171;default&#187;, kas nor\u0101d\u012bta parametru &#171;&#8212;set-target&#187; tagad ir ekvivalenta &#171;reject&#187;, t.i., visi paketi, kuri neietilpst konkr\u0113tos noteikumos zon\u0101, p\u0113c noklus\u0113juma tiks blo\u0137\u0113ti. Iz\u0146\u0113mums ir ICMP paketi, kuras joproj\u0101m tiek at\u013cautas. Lai atgrieztu iepriek\u0161\u0113jo uzved\u012bbu publisk\u0101 pieejam\u0101 zon\u0101 &#171;trusted&#187;, var izmantot noteikumus:       firewall-cmd &#8212;permanent &#8212;new-policy allowForward      firewall-cmd &#8212;permanent &#8212;policy allowForward &#8212;set-target ACCEPT     firewall-cmd &#8212;permanent &#8212;policy allowForward &#8212;add-ingress-zone public     firewall-cmd &#8212;permanent &#8212;policy allowForward &#8212;add-egress-zone trusted     firewall-cmd &#8212;reload\n<li class=\"l\"> Politikas ar pozit\u012bvu priorit\u0101ti tagad tiek izpild\u012btas tie\u0161i pirms noteikuma &#171;&#8212;set-target catch-all&#187; izpildes, t.i., br\u012bd\u012b, kas iepriek\u0161\u0113js p\u0113d\u0113jo noteikumu drop, reject vai accept pievieno\u0161anai, tostarp zon\u0101s, kur\u0101s tiek izmantoti &#171;&#8212;set-target drop|reject|accept&#187;.\n<li class=\"l\"> ICMP blo\u0137\u0113\u0161ana tagad tiek piem\u0113rota tikai ieejas paketi, kas adres\u0113ti pa\u0161reiz\u0113jam hostam (input), un neietekm\u0113 paketes, kas tiek p\u0101rs\u016bt\u012btas starp zon\u0101m (forward).\n<li class=\"l\"> Tika iz\u0146emts servis tftp-client, kas bija paredz\u0113ts savienojumu izseko\u0161anai TFTP protokolam, bet nebija izmantojams.\n<li class=\"l\"> Tika pazi\u0146ots, ka saskarne &#171;direct&#187; ir novecojusi, \u013caujot tie\u0161i ievietot gatavus pakot\u0146u filtr\u0113\u0161anas noteikumus. Nepiecie\u0161am\u012bba p\u0113c \u0161\u012bs saskarnes ir pazudusi, p\u0113c iesp\u0113jas filtr\u0113t p\u0101rs\u016bt\u012bt\u0101s un izejo\u0161\u0101s paketes.\n<li class=\"l\"> Pievienots parametrs CleanupModulesOnExit, kas p\u0113c noklus\u0113juma iestat\u012bts uz v\u0113rt\u012bbu &#171;no&#187;. Ar \u0161\u012b parametra pal\u012bdz\u012bbu varat p\u0101rvald\u012bt kodola modu\u013cu izl\u0101di p\u0113c firewalld darb\u012bbas beig\u0101m.\n<li class=\"l\"> Izmanto\u0161ana ipset ir at\u013cauta, nosakot m\u0113r\u0137a sist\u0113mu (destination).\n<li class=\"l\"> Tika pievienoti WireGuard, Kubernetes un netbios-ns servisi.\n<li class=\"l\"> Tika ieviesti autom\u0101tisk\u0101s pabeig\u0161anas noteikumi zsh.\n<li class=\"l\"> Atbalsts Python 2 tika p\u0101rtraukts.\n<li class=\"l\"> Atkar\u012bbu saraksts ir samazin\u0101ts. Lai firewalld darbotos, papildus Linux kodolam tagad ir b\u016btiski tikai python bibliot\u0113kas dbus, gobject un nftables, kam\u0113r paketes ebtables, ipset un iptables ir no opcij\u0101m. No atkar\u012bb\u0101m ir iz\u0146emtas python bibliot\u0113kas decorator un slip.    <\/ul>\n<p>Avots: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=55537\">opennet.lv<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables. Firewalld \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0432 \u0432\u0438\u0434\u0435 \u0444\u043e\u043d\u043e\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 D-Bus, \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043f\u0440\u0430\u0432\u0438\u043b \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 \u0438 \u0431\u0435\u0437 \u0440\u0430\u0437\u0440\u044b\u0432\u0430 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439. \u041f\u0440\u043e\u0435\u043a\u0442 \u0443\u0436\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux, \u0432\u043a\u043b\u044e\u0447\u0430\u044f RHEL 7+, Fedora 18+ [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100821","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/lv\/blog\/news\/vypusk-firewalld-1-0\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"lv_LV\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a firewalld 1.0 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/lv\/blog\/news\/vypusk-firewalld-1-0\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-07-23T08:22:39+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-07-23T08:22:39+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Firewalld 1.0 izlai\u0161ana | ProHoster","description":"Tika ieviests dinamiski p\u0101rvald\u012bta ugunsm\u016bra firewalld 1.0 izlaidums, kas realiz\u0113ts k\u0101 apvalks virs paketi filtriem nftables un iptables.","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/news\/vypusk-firewalld-1-0","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a firewalld 1.0 | ProHoster","og:description":"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables.","og:url":"https:\/\/prohoster.info\/lv\/blog\/news\/vypusk-firewalld-1-0","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-07-23T08:22:39+00:00","article:modified_time":"2021-07-23T08:22:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100821","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-07-24 00:03:32","updated":"2026-02-08 20:40:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/100821","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=100821"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/100821\/revisions"}],"predecessor-version":[{"id":158028,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/100821\/revisions\/158028"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=100821"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=100821"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=100821"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}