{"id":100821,"date":"2021-07-23T10:22:39","date_gmt":"2021-07-23T08:22:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-firewalld-1-0"},"modified":"2021-07-23T10:22:39","modified_gmt":"2021-07-23T08:22:39","slug":"vypusk-firewalld-1-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/vypusk-firewalld-1-0","title":{"rendered":"Vydanie firewalld 1.0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Bol predstaven\u00fd release dynamicky spravovan\u00e9ho firewallu firewalld 1.0, ktor\u00fd je implementovan\u00fd ako obal nad paketov\u00fdmi filtrami nftables a iptables. Firewalld be\u017e\u00ed ako proces na pozad\u00ed, ktor\u00fd umo\u017e\u0148uje dynamicky meni\u0165 pravidl\u00e1 paketov\u00e9ho filtra cez D-Bus, bez potreby re\u0161tartovania pravidiel paketov\u00e9ho filtra a bez preru\u0161enia existuj\u00facich spojen\u00ed. Projekt sa u\u017e pou\u017e\u00edva v mnoh\u00fdch distrib\u00faci\u00e1ch Linuxu, vr\u00e1tane RHEL 7+, Fedora 18+ a SUSE\/openSUSE 15+. K\u00f3d firewalld je nap\u00edsan\u00fd v jazyku Python a je distribuovan\u00fd pod licenciou GPLv2.      <\/p>\n<p>Na spr\u00e1vu firewallu sa pou\u017e\u00edva utilita firewall-cmd, ktor\u00e1 pri vytv\u00e1ran\u00ed pravidiel vych\u00e1dza nie z <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sk\/lir\/ipv4\/\"   title=\"IP adresy\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"837\">IP adresy<\/a>, sie\u0165ov\u00fdch rozhran\u00ed a \u010d\u00edsiel portov, ale aj n\u00e1zvov slu\u017eieb (napr\u00edklad na otvorenie pr\u00edstupu k SSH treba vykona\u0165 &#171;firewall-cmd &#8212;add &#8212;service=ssh&#187;, na uzavretie SSH &#8212; &#171;firewall-cmd &#8212;remove &#8212;service=ssh&#187;). Pre zmenu konfigur\u00e1cie firewallu m\u00f4\u017ee by\u0165 pou\u017eit\u00fd aj grafick\u00fd rozhranie firewall-config (GTK) a applet firewall-applet (Qt). Podpora spr\u00e1vy firewallu prostredn\u00edctvom D-BUS API firewalld je dostupn\u00e1 v projektoch ako NetworkManager, libvirt, podman, docker a fail2ban.    <\/p>\n<p>V\u00fdznamn\u00e1 zmena \u010d\u00edsla verzie s\u00favis\u00ed s \u00fapravami, ktor\u00e9 naru\u0161uj\u00fa sp\u00e4tn\u00fa kompatibilitu a menia spr\u00e1vanie pr\u00e1ce so z\u00f3nami. V\u0161etky parametre filtr\u00e1cie definovan\u00e9 v z\u00f3ne sa teraz aplikuj\u00fa iba na prenos, ktor\u00fd je ur\u010den\u00fd hostite\u013eovi, na ktorom be\u017e\u00ed firewalld, a na filtr\u00e1ciu tranzitn\u00e9ho prenosu je potrebn\u00e9 nastavi\u0165 politiky. Najv\u00fdraznej\u0161ie zmeny:  <\/p>\n<ul>\n<li class=\"l\"> Bol vyhl\u00e1sen\u00fd za zastaran\u00fd backend, ktor\u00fd umo\u017e\u0148oval pracova\u0165 nad iptables. Podpora iptables zostane v doh\u013eadnej bud\u00facnosti, ale tento backend sa nebude \u010falej vyv\u00edja\u0165.\n<li class=\"l\"> Intra-zone-forwarding is enabled and activated by default for all new zones, allowing free movement of packets between network interfaces or traffic sources within a single zone (public, block, trusted, internal, etc.). To revert to the old behavior and prohibit packet forwarding within a single zone, the command &#171;firewall-cmd &#8212;permanent &#8212;zone public &#8212;remove-forward&#187; can be used.\n<li class=\"l\"> Address translation (NAT) rules have been moved to the &#171;inet&#187; protocol family (previously added in the &#171;ip&#187; and &#171;ip6&#187; families, which required duplicating rules for IPv4 and IPv6). This change eliminates duplicates when using ipset \u2014 instead of three copies of ipset records, now only one is used.\n<li class=\"l\"> The action &#171;default&#187; specified in the &#171;&#8212;set-target&#187; parameter is now equivalent to &#171;reject&#187;, meaning that all packets not matching specific rules in the zone will be blocked by default. The only exception is for ICMP packets, which are still allowed. To revert to the old behavior for the publicly accessible &#171;trusted&#187; zone, the following rules can be used:       firewall-cmd &#8212;permanent &#8212;new-policy allowForward      firewall-cmd &#8212;permanent &#8212;policy allowForward &#8212;set-target ACCEPT     firewall-cmd &#8212;permanent &#8212;policy allowForward &#8212;add-ingress-zone public     firewall-cmd &#8212;permanent &#8212;policy allowForward &#8212;add-egress-zone trusted     firewall-cmd &#8212;reload\n<li class=\"l\"> Policies with a positive priority are now executed just before the &#171;&#8212;set-target catch-all&#187; rule is applied, i.e., at the moment preceding the addition of the final rules drop, reject, or accept, including for zones where &#171;&#8212;set-target drop|reject|accept&#187; is used.\n<li class=\"l\"> Blokovanie ICMP sa teraz aplikuje iba na paketoch smerovan\u00fdch k aktu\u00e1lnemu hostite\u013eovi (input) a net\u00fdka sa paketov presmerovan\u00fdch medzi z\u00f3nami (forward).\n<li class=\"l\"> Slu\u017eba tftp-client, ur\u010den\u00e1 na sledovanie spojen\u00ed pre protokol TFTP, bola odstr\u00e1nen\u00e1, preto\u017ee bola v nepou\u017eite\u013enom stave.\n<li class=\"l\"> The &#171;direct&#187; interface, which allowed directly inserting ready-made packet filtering rules, has been declared deprecated. The need for this interface has disappeared after the addition of the capability to filter redirected and outgoing packets.\n<li class=\"l\"> The CleanupModulesOnExit parameter has been added, which is set to &#171;no&#187; by default. This parameter allows for managing the unloading of kernel modules after the firewalld service is stopped.\n<li class=\"l\"> Povolen\u00e9 pou\u017e\u00edvanie ipset pri ur\u010dovan\u00ed cie\u013eov\u00e9ho syst\u00e9mu (destination).\n<li class=\"l\"> Boli pridan\u00e9 defin\u00edcie slu\u017eieb WireGuard, Kubernetes a netbios-ns.\n<li class=\"l\"> Boli implementovan\u00e9 pravidl\u00e1 auto-doplnenia pre zsh.\n<li class=\"l\"> Podpora Python 2 bola ukon\u010den\u00e1.\n<li class=\"l\"> Zoznam z\u00e1vislost\u00ed bol skr\u00e1ten\u00fd. Pre fungovanie firewalld s\u00fa teraz potrebn\u00e9 len kni\u017enice Python dbus, gobject a nftables, zatia\u013e \u010do bal\u00edky ebtables, ipset a iptables s\u00fa pova\u017eovan\u00e9 za volite\u013en\u00e9. Z zoznamu z\u00e1vislost\u00ed boli odstr\u00e1nen\u00e9 kni\u017enice Python decorator a slip.    <\/ul>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=55537\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables. Firewalld \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0432 \u0432\u0438\u0434\u0435 \u0444\u043e\u043d\u043e\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 D-Bus, \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043f\u0440\u0430\u0432\u0438\u043b \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 \u0438 \u0431\u0435\u0437 \u0440\u0430\u0437\u0440\u044b\u0432\u0430 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439. \u041f\u0440\u043e\u0435\u043a\u0442 \u0443\u0436\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux, \u0432\u043a\u043b\u044e\u0447\u0430\u044f RHEL 7+, Fedora 18+ [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100821","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/news\/vypusk-firewalld-1-0\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a firewalld 1.0 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/news\/vypusk-firewalld-1-0\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-07-23T08:22:39+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-07-23T08:22:39+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vydanie firewalld 1.0 | ProHoster","description":"Bol predstaven\u00fd vydanie dynamicky riaden\u00e9ho firewallu firewalld 1.0, ktor\u00fd bol implementovan\u00fd ako obal nad bal\u00edkov\u00fdmi filtrami nftables a iptables.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/vypusk-firewalld-1-0","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a firewalld 1.0 | ProHoster","og:description":"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 firewalld 1.0, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438 nftables \u0438 iptables.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/vypusk-firewalld-1-0","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-07-23T08:22:39+00:00","article:modified_time":"2021-07-23T08:22:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100821","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-07-24 00:03:32","updated":"2026-02-08 20:40:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/100821","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=100821"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/100821\/revisions"}],"predecessor-version":[{"id":158028,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/100821\/revisions\/158028"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=100821"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=100821"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=100821"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}