{"id":100821,"date":"2021-07-23T10:22:39","date_gmt":"2021-07-23T08:22:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-firewalld-1-0"},"modified":"2021-07-23T10:22:39","modified_gmt":"2021-07-23T08:22:39","slug":"vypusk-firewalld-1-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/vypusk-firewalld-1-0","title":{"rendered":"Lan\u00e7amento do firewalld 1.0.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Foi lan\u00e7ado o release do firewall din\u00e2mico firewalld 1.0, implementado como uma camada sobre os filtros de pacotes nftables e iptables. O firewalld \u00e9 executado como um processo em segundo plano, permitindo a altera\u00e7\u00e3o din\u00e2mica das regras do filtro de pacotes atrav\u00e9s do D-Bus, sem a necessidade de reiniciar as regras do filtro de pacotes e sem interromper as conex\u00f5es estabelecidas. O projeto j\u00e1 \u00e9 utilizado em v\u00e1rias distribui\u00e7\u00f5es Linux, incluindo RHEL 7+, Fedora 18+ e SUSE\/openSUSE 15+. O c\u00f3digo do firewalld est\u00e1 escrito em Python e \u00e9 distribu\u00eddo sob a licen\u00e7a GPLv2.      <\/p>\n<p>Para gerenciar o firewall, utiliza-se a ferramenta firewall-cmd, que, ao criar regras, se baseia n\u00e3o em <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/pt\/lir\/ipv4\/\"   title=\"endere\u00e7os IP\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"837\">endere\u00e7os IP<\/a>, interfaces de rede e n\u00fameros de portas, e n\u00e3o os nomes dos servi\u00e7os (por exemplo, para abrir o acesso ao SSH, deve-se executar &#171;firewall-cmd &#8212;add &#8212;service=ssh&#187;, para fechar o SSH &#8212; &#171;firewall-cmd &#8212;remove &#8212;service=ssh&#187;). A configura\u00e7\u00e3o do firewall tamb\u00e9m pode ser alterada por meio da interface gr\u00e1fica firewall-config (GTK) e do applet firewall-applet (Qt). O suporte para gerenciamento do firewall atrav\u00e9s da API D-BUS firewalld est\u00e1 presente em projetos como NetworkManager, libvirt, podman, docker e fail2ban.    <\/p>\n<p>A mudan\u00e7a significativa no n\u00famero da vers\u00e3o est\u00e1 relacionada \u00e0 introdu\u00e7\u00e3o de altera\u00e7\u00f5es que quebram a compatibilidade retroativa e mudam o comportamento do gerenciamento de zonas. Todos os par\u00e2metros de filtragem definidos em uma zona agora s\u00e3o aplicados apenas ao tr\u00e1fego destinado ao host onde o firewalld est\u00e1 em execu\u00e7\u00e3o, sendo necess\u00e1rio configurar pol\u00edticas para a filtragem de tr\u00e1fego em tr\u00e2nsito. As mudan\u00e7as mais not\u00e1veis incluem:  <\/p>\n<ul>\n<li class=\"l\"> Foi declarado obsoleto o backend que permitia operar sobre iptables. O suporte ao iptables ser\u00e1 mantido no futuro pr\u00f3ximo, mas esse backend n\u00e3o ser\u00e1 mais desenvolvido.\n<li class=\"l\"> O modo intra-zone-forwarding, que permite a livre movimenta\u00e7\u00e3o de pacotes entre interfaces de rede ou fontes de tr\u00e1fego dentro de uma \u00fanica zona (p\u00fablica, bloqueada, confi\u00e1vel, interna etc.), est\u00e1 ativado por padr\u00e3o para todas as novas zonas. Para restaurar o comportamento antigo e proibir o redirecionamento de pacotes dentro de uma \u00fanica zona, pode-se usar o comando \u201cfirewall-cmd \u2014permanent \u2014zone public \u2014remove-forward\u201d.\n<li class=\"l\"> As regras relacionadas \u00e0 tradu\u00e7\u00e3o de endere\u00e7os (NAT) foram movidas para a fam\u00edlia de protocolos \u201cinet\u201d (anteriormente eram adicionadas nas fam\u00edlias \u201cip\u201d e \u201cip6\u201d, o que exigia a duplica\u00e7\u00e3o de regras para IPv4 e IPv6). Essa altera\u00e7\u00e3o eliminou duplicatas ao usar ipset \u2014 em vez de tr\u00eas c\u00f3pias de registros ipset, agora \u00e9 usada uma s\u00f3.\n<li class=\"l\"> A a\u00e7\u00e3o \u201cdefault\u201d, especificada no par\u00e2metro \u201c\u2014set-target\u201d, agora \u00e9 equivalente a \u201creject\u201d, ou seja, todos os pacotes que n\u00e3o se enquadram nas regras espec\u00edficas na zona ser\u00e3o bloqueados por padr\u00e3o. A exce\u00e7\u00e3o \u00e9 para pacotes ICMP, que ainda s\u00e3o permitidos. Para restaurar o comportamento antigo para a zona publicamente acess\u00edvel \u201ctrusted\u201d, pode-se usar as regras: firewall-cmd \u2014permanent \u2014new-policy allowForward firewall-cmd \u2014permanent \u2014policy allowForward \u2014set-target ACCEPT firewall-cmd \u2014permanent \u2014policy allowForward \u2014add-ingress-zone public firewall-cmd \u2014permanent \u2014policy allowForward \u2014add-egress-zone trusted firewall-cmd \u2014reload.\n<li class=\"l\"> As pol\u00edticas com prioridade positiva agora s\u00e3o executadas imediatamente antes da aplica\u00e7\u00e3o da regra \u201c\u2014set-target catch-all\u201d, ou seja, no momento que precede a adi\u00e7\u00e3o das regras finais de drop, reject ou accept, incluindo aquelas para zonas que utilizam \u201c\u2014set-target drop|reject|accept\u201d.\n<li class=\"l\"> O bloqueio de ICMP agora se aplica somente aos pacotes de entrada endere\u00e7ados ao host atual (input) e n\u00e3o afeta pacotes que s\u00e3o redirecionados entre zonas (forward).\n<li class=\"l\"> O servi\u00e7o tftp-client foi removido, que era destinado ao rastreamento de conex\u00f5es do protocolo TFTP, mas estava em uma condi\u00e7\u00e3o inutiliz\u00e1vel.\n<li class=\"l\"> A interface \u201cdirect\u201d foi declarada obsoleta, permitindo a inser\u00e7\u00e3o direta de regras prontas de filtragem de pacotes. A necessidade dessa interface deixou de existir ap\u00f3s a adi\u00e7\u00e3o da possibilidade de filtragem de pacotes redirecionados e de sa\u00edda.\n<li class=\"l\"> Um par\u00e2metro CleanupModulesOnExit foi adicionado, que por padr\u00e3o \u00e9 definido como \u201cno\u201d. Com esse par\u00e2metro, \u00e9 poss\u00edvel controlar a descarregamento de m\u00f3dulos do kernel ap\u00f3s a finaliza\u00e7\u00e3o do firewalld.\n<li class=\"l\"> Permiss\u00e3o para uso de ipset ao definir o sistema de destino (destination).\n<li class=\"l\"> Adicionadas defini\u00e7\u00f5es para os servi\u00e7os WireGuard, Kubernetes e netbios-ns.\n<li class=\"l\"> Implementadas regras de autocompletar para zsh.\n<li class=\"l\"> O suporte ao Python 2 foi encerrado.\n<li class=\"l\"> Reduzida a lista de depend\u00eancias. Para o funcionamento do firewalld, al\u00e9m do n\u00facleo Linux, agora s\u00e3o obrigat\u00f3rias apenas as bibliotecas Python dbus, gobject e nftables, enquanto os pacotes ebtables, ipset e iptables foram classificados como opcionais. Eliminadas as bibliotecas Python decorator e slip das depend\u00eancias.    <\/ul>\n<p>Fonte: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=55537\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables. Firewalld \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0432 \u0432\u0438\u0434\u0435 \u0444\u043e\u043d\u043e\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 D-Bus, \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043f\u0440\u0430\u0432\u0438\u043b \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 \u0438 \u0431\u0435\u0437 \u0440\u0430\u0437\u0440\u044b\u0432\u0430 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439. \u041f\u0440\u043e\u0435\u043a\u0442 \u0443\u0436\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux, \u0432\u043a\u043b\u044e\u0447\u0430\u044f RHEL 7+, Fedora 18+ [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100821","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/pt\/blog\/news\/vypusk-firewalld-1-0\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"pt_PT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a firewalld 1.0 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/pt\/blog\/news\/vypusk-firewalld-1-0\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-07-23T08:22:39+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-07-23T08:22:39+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Lan\u00e7amento do firewalld 1.0 | ProHoster","description":"Apresentada a vers\u00e3o do firewall din\u00e2mico firewalld 1.0, implementada na forma de uma camada sobre os filtros de pacotes nftables e iptables.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/vypusk-firewalld-1-0","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a firewalld 1.0 | ProHoster","og:description":"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/vypusk-firewalld-1-0","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-07-23T08:22:39+00:00","article:modified_time":"2021-07-23T08:22:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100821","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-07-24 00:03:32","updated":"2026-02-08 20:40:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/100821","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=100821"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/100821\/revisions"}],"predecessor-version":[{"id":158028,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/100821\/revisions\/158028"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=100821"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=100821"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=100821"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}