{"id":100821,"date":"2021-07-23T10:22:39","date_gmt":"2021-07-23T08:22:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-firewalld-1-0"},"modified":"2021-07-23T10:22:39","modified_gmt":"2021-07-23T08:22:39","slug":"vypusk-firewalld-1-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-firewalld-1-0","title":{"rendered":"Lansarea firewalld 1.0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>A fost lansat\u0103 versiunea dinamic gestionat\u0103 a firewall-ului firewalld 1.0, realizat\u0103 sub forma unui wrapper peste filtrele de pachete nftables \u0219i iptables. Firewalld ruleaz\u0103 ca un proces de fundal, permi\u021b\u00e2nd modificarea dinamic\u0103 a regulilor filtrului de pachete prin D-Bus, f\u0103r\u0103 a fi nevoie de resetarea regulilor filtrului de pachete \u0219i f\u0103r\u0103 a \u00eentrerupe conexiunile stabilite. Proiectul este deja folosit \u00een multe distribu\u021bii Linux, inclusiv RHEL 7+, Fedora 18+ \u0219i SUSE\/openSUSE 15+. Codul firewalld este scris \u00een Python \u0219i este distribuit sub licen\u021ba GPLv2.      <\/p>\n<p>Pentru a gestiona firewall-ul se folose\u0219te utilitarul firewall-cmd, care la crearea regulilor se bazeaz\u0103 nu pe <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/ro\/lir\/ipv4\/\"   title=\"adreselor IP\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"837\">adreselor IP<\/a>, interfe\u021bele de re\u021bea \u0219i numerele de porturi, dar nu \u0219i denumirile serviciilor (de exemplu, pentru a deschide accesul la SSH trebuie s\u0103 executa\u021bi &#171;firewall-cmd &#8212;add &#8212;service=ssh&#187;, pentru a \u00eenchide SSH &#8212; &#171;firewall-cmd &#8212;remove &#8212;service=ssh&#187;). Pentru a modifica configura\u021bia firewall-ului poate fi utilizat \u0219i interfa\u021ba grafic\u0103 firewall-config (GTK) \u0219iApplet-ul firewall-applet (Qt). Suportul pentru gestionarea firewall-ului prin D-BUS API firewalld este disponibil \u00een proiecte precum NetworkManager, libvirt, podman, docker \u0219i fail2ban.    <\/p>\n<p>Modificarea semnificativ\u0103 a num\u0103rului versiunii se datoreaz\u0103 modific\u0103rilor aduse care afecteaz\u0103 compatibilitatea \u00eenapoi \u0219i schimb\u0103 comportamentul gestion\u0103rii zonelor. Toate parametrii de filtrare defini\u021bi \u00een zon\u0103 se aplic\u0103 acum doar pentru traficul destinat gazdei pe care ruleaz\u0103 firewalld, iar pentru filtrarea traficului de tranzit este nevoie de configurarea politicilor. Cele mai notabile schimb\u0103ri:  <\/p>\n<ul>\n<li class=\"l\"> Backend-ul care permitea func\u021bionarea deasupra iptables a fost declarat \u00eenvechit. Suportul pentru iptables va fi p\u0103strat \u00een viitorul apropiat, dar acest backend nu va fi dezvoltat.\n<li class=\"l\"> Modul intra-zone-forwarding este activat \u0219i inclus \u00een mod implicit pentru toate zonele noi, permi\u021b\u00e2nd mi\u0219carea liber\u0103 a pachetelor \u00eentre interfe\u021bele de re\u021bea sau sursele de trafic din interiorul unei zone (public, block, trusted, internal etc.). Pentru a reveni la comportamentul anterior \u0219i a interzice redirec\u021bionarea pachetelor \u00een interiorul unei zone, se poate utiliza comanda &#171;firewall-cmd &#8212;permanent &#8212;zone public &#8212;remove-forward&#187;.\n<li class=\"l\"> Regulile legate de traducerea adreselor (NAT) au fost mutate \u00een familia de protocoale &#171;inet&#187; (anterior erau ad\u0103ugate \u00een familiile &#171;ip&#187; \u0219i &#171;ip6&#187;, ceea ce ducea la necesitatea duplic\u0103rii regulilor pentru IPv4 \u0219i IPv6). Modificarea a permis eliminarea duplicatelor la utilizarea ipset &#8212; \u00een loc de trei copii ale \u00eenregistr\u0103rilor ipset acum este utilizat\u0103 una singur\u0103.\n<li class=\"l\"> Ac\u021biunea &#171;default&#187;, specificat\u0103 \u00een parametrul &#171;&#8212;set-target&#187;, este acum echivalent\u0103 cu &#171;reject&#187;, adic\u0103 toate pachetele care nu se \u00eencadreaz\u0103 \u00een regulile definite \u00een zon\u0103 vor fi blocate \u00een mod implicit. O excep\u021bie a fost f\u0103cut\u0103 doar pentru pachetele ICMP, care sunt \u00een continuare acceptate. Pentru a reveni la comportamentul anterior pentru zona public\u0103 &#171;trusted&#187; se pot folosi regulile: firewall-cmd &#8212;permanent &#8212;new-policy allowForward firewall-cmd &#8212;permanent &#8212;policy allowForward &#8212;set-target ACCEPT firewall-cmd &#8212;permanent &#8212;policy allowForward &#8212;add-ingress-zone public firewall-cmd &#8212;permanent &#8212;policy allowForward &#8212;add-egress-zone trusted firewall-cmd &#8212;reload\n<li class=\"l\"> Politicile cu prioritate pozitiv\u0103 sunt acum executate imediat \u00eenainte de aplicarea regulii &#171;&#8212;set-target catch-all&#187;, adic\u0103 \u00een momentul anterior ad\u0103ug\u0103rii regulilor finale drop, reject sau accept, inclusiv pentru zonele \u00een care sunt utilizate &#171;&#8212;set-target drop|reject|accept&#187;.\n<li class=\"l\"> Blocheaz\u0103 ICMP acum se aplic\u0103 doar pachetelor incoming adresate gazdei curente (input) \u0219i nu afecteaz\u0103 pachetele redirec\u021bionate \u00eentre zone (forward).\n<li class=\"l\"> Serviciul tftp-client, destinat monitoriz\u0103rii conexiunilor pentru protocolul TFTP, dar care era \u00eentr-o stare inutilizabil\u0103, a fost eliminat.\n<li class=\"l\"> Interfa\u021ba &#171;direct&#187; a fost declarat \u00eenvechit\u0103, permi\u021b\u00e2nd introducerea direct\u0103 a regulilor de filtrare a pachetelor. Necesitatea acestei interfe\u021be a disp\u0103rut dup\u0103 ad\u0103ugarea posibilit\u0103\u021bii de filtrare a pachetelor redirec\u021bionate \u0219i ie\u0219ite.\n<li class=\"l\"> A fost ad\u0103ugat parametrul CleanupModulesOnExit, care este setat implicit la valoarea &#171;no&#187;. Acest parametru poate fi utilizat pentru a gestiona desc\u0103rcarea modulelor nucleului dup\u0103 \u00eencheierea activit\u0103\u021bii firewalld.\n<li class=\"l\"> Utilizarea ipset la definirea sistemului \u021bint\u0103 (destination) a fost permis\u0103.\n<li class=\"l\"> Au fost ad\u0103ugate defini\u021bii pentru serviciile WireGuard, Kubernetes \u0219i netbios-ns.\n<li class=\"l\"> Regulile de auto-completare pentru zsh au fost realizate.\n<li class=\"l\"> Suportul pentru Python 2 a fost oprit.\n<li class=\"l\"> Lista de dependen\u021be a fost redus\u0103. Pentru func\u021bionarea firewalld, pe l\u00e2ng\u0103 kernelul Linux, acum sunt necesare doar bibliotecile Python dbus, gobject \u0219i nftables, iar pachetele ebtables, ipset \u0219i iptables au fost clasificate ca fiind op\u021bionale. Bibliotecile Python decorator \u0219i slip au fost eliminate din dependen\u021be.    <\/ul>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=55537\">opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables. Firewalld \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0432 \u0432\u0438\u0434\u0435 \u0444\u043e\u043d\u043e\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 D-Bus, \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043f\u0440\u0430\u0432\u0438\u043b \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 \u0438 \u0431\u0435\u0437 \u0440\u0430\u0437\u0440\u044b\u0432\u0430 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439. \u041f\u0440\u043e\u0435\u043a\u0442 \u0443\u0436\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux, \u0432\u043a\u043b\u044e\u0447\u0430\u044f RHEL 7+, Fedora 18+ [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100821","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-firewalld-1-0\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a firewalld 1.0 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-firewalld-1-0\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-07-23T08:22:39+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-07-23T08:22:39+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Lansarea firewalld 1.0 | ProHoster","description":"A fost lansat\u0103 versiunea de firewall dinamic gestionat\u0103 firewalld 1.0, implementat\u0103 sub forma unui wrapper peste filtrele de pachete nftables \u0219i iptables.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-firewalld-1-0","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a firewalld 1.0 | ProHoster","og:description":"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-firewalld-1-0","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-07-23T08:22:39+00:00","article:modified_time":"2021-07-23T08:22:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100821","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-07-24 00:03:32","updated":"2026-02-08 20:40:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/100821","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=100821"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/100821\/revisions"}],"predecessor-version":[{"id":158028,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/100821\/revisions\/158028"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=100821"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=100821"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=100821"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}