https://www.certdepot.net/rhel7-get-started-firewalld/ RHEL7: How to get started with Firewalld.Last updated on October 3, 2018 (768,677 views) - CertDepot — 79 Comments ↓Share this link0<span class="fsb-count" style="margin: 0px 0px 0px 70px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; width: 30px; text-align: center; display: inline-block;">0</span></a></div></div><div class="fsb-clear" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; clear: both;"></div><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Note: This is an <a href="https://www.certdepot.net/rhel7-rhcsa-exam-objectives/" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">RHCSA 7 exam objective</a> and an <a href="https://www.certdepot.net/rhel7-rhce-exam-objectives/" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">RHCE 7 exam objective</a>.</p><h2 style="margin: 0.75em 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: 1em; font-family: inherit; font-size: 2.25em; vertical-align: baseline; overflow-wrap: break-word;">Presentation</h2><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;"><span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Firewalld</span> is the new userland interface in <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">RHEL 7</span>. It replaces the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">iptables</span> interface and connects to the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">netfilter</span> kernel code. It mainly improves the security rules management by allowing configuration changes without stopping the current connections.</p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">To know if <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Firewalld</span> is running, type:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># systemctl status firewalldfirewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled) Active: active (running) since Tue 2014-06-17 11:14:49 CEST; 5 days ago ...</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">or alternatively:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --staterunning</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Note: If <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Firewalld</span> is not running, the command displays <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">not running</span>.</p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">If you’ve got several network interfaces in <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">IPv4</span>, you will have to activate <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">ip forwarding</span>.<br/>To do that, paste the following line into the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">/etc/sysctl.conf</span> file:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;">net.ipv4.ip_forward=1</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Then, activate the configuration:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># sysctl -p</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Note: If you interested in kernel parameter configuration, there is a <a href="https://www.certdepot.net/rhel7-use-sysctl/" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">tutorial about the sysctl command</a>.</p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Although <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Firewalld</span> is the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">RHEL 7</span> way to deal with firewalls and provides many improvements, <a title="RHEL7: How to disable Firewalld and use Iptables instead." href="https://www.certdepot.net/rhel7-disable-firewalld-use-iptables/" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">iptables can still be used</a> (but both shouldn’t run at the same time).</p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">You can also look at the iptables rules created by <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Firewalld</span> with the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">iptables-save</span> command.</p><h2 style="margin: 0.75em 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: 1em; font-family: inherit; font-size: 2.25em; vertical-align: baseline; overflow-wrap: break-word;">Zone Management</h2><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Also, a new concept of zone appears: all network interfaces can be located in the same default zone or divided into different ones according to the levels of trust defined. In the latter case, this allows to restrict traffic based on origin zone (read this <a href="https://lwn.net/Articles/484506/" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">article</a> from <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">lwn.net</span> for more details).<br/>Note: Without any configuration, everything is done by default in the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">public</span> zone. If you’ve got more than one network interface or use <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">sources</span> (see <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Source management</span> section below), you will be able to restrict traffic between zones.</p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">To get the default zone, type:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --get-default-zonepublic</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">To get the list of zones where you’ve got network interfaces or sources assigned to, type:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --get-active-zonespublic interfaces: eth0</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Note: You can have more than one active zone at a time.</p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">To get the list of all the available zones, type:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --get-zonesblock dmz drop external home internal public trusted work</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">To change the default zone to <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">home</span> permanently, type:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --set-default-zone=homesuccess</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Note: This information is stored in the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">/etc/firewalld/firewalld.conf</span> file.</p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Network interfaces can be assigned to a zone in a <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">permanent</span> way.<br/>To <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">permanently</span> assign the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">eth0</span> network interface to the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">internal</span> zone (a file called <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">internal.xml</span> is created in the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">/etc/firewalld/zones</span> directory), type:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --permanent --zone=internal --change-interface=eth0success # nmcli con show | grep eth0System eth0 4de55c95-2368-429b-be65-8f7b1a357e3f 802-3-ethernet eth0 # nmcli con mod "System eth0" connection.zone internal# nmcli con up "System eth0"Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/1)</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Note1: This operation can also be done by editing the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">/etc/sysconfig/network-scripts/ifcfg-eth0</span> file and add <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">ZONE=internal</span> followed by # <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">nmcli con reload </span>. It seems that with <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">RHEL 7.5</span>, the use of <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">ZONE</span> in <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">ifcfg-*</span> files no longer works (<a href="http://www.advancedclustering.com/act_kb/fixing-firewall-zones-centos-7-5/" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">source</a>).<br/>Note2: More information about the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">nmcli</span> command is available at the <a href="https://www.certdepot.net/rhel7-get-started-nmcli/" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">page dedicated to nmcli</a>or at the <a href="https://www.certdepot.net/rhel7-configure-ipv4-addresses/" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">IPV4 configuration page</a>.<br/>Note3: The <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">RHEL 7.3</span> release improves the way <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Firewalld</span> handles zones (v0.3.9 -> v0.4.3.2: BZ#<a href="https://bugzilla.redhat.com/show_bug.cgi?id=1302802" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">1302802</a>).</p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">To know which zone is associated with the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">eth0</span> interface, type:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --get-zone-of-interface=eth0internal</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">To get the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">permanent </span>configuration of the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">public</span> zone, type:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --permanent --zone=public --list-allpublic (default, active) interfaces: eth0 sources: services: dhcpv6-client ssh ports: masquerade: no forward-ports: icmp-blocks: rich rules:</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">It is also possible to create new zones. To create a new zone (here <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">test</span>), type:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --permanent --new-zone=testsuccess # firewall-cmd --reloadsuccess</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Note: Only <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">permanent</span> zones can be created.</p><h2 style="margin: 0.75em 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: 1em; font-family: inherit; font-size: 2.25em; vertical-align: baseline; overflow-wrap: break-word;">Source Management</h2><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">A zone can be bound to a network interface (see above) and/or to a network addressing (called here a <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">source</span>).<br/>Any network packet entering in the network stack is associated with a zone.<br/>The association is done according to the following pattern:<br/>– is the packet coming from a source already bound to a zone? (if yes, it is associated with this zone),<br/>– if not, is the packet coming from a network interface already bound to a zone? (if yes, it is associated with this zone),<br/>– if not, the packet is associated with the default zone.</p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">This way, multiple zones can be defined even on a server with only one network interface!</p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;"><span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Caution</span>: To get this feature, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Firewalld</span> relies on <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">NetworkManager</span> (see <a href="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Using_Firewalls.html" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">reference</a>). This means that if you plan to stop <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">NetworkManager</span> for any reason (for example when <a title="RHEL7: Configure lab network settings." href="https://www.certdepot.net/rhel7-configure-lab-network-settings/" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">building a <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">KVM</span> host</a>), you will have to <a title="RHEL7: How to disable Firewalld and use Iptables instead." href="https://www.certdepot.net/rhel7-disable-firewalld-use-iptables/" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">stop Firewalld and use Iptables instead</a>!<br/>Note: With the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">RHEL 7.3</span> release, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Firewalld</span> robustness has been improved in regard to <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">NetworkManager</span> (see details <a href="http://www.firewalld.org/2016/05/firewalld-0-4-2-release" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">here</a>).</p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">To add a source (here <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">192.168.2.0/24</span>) to a zone (here <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">trusted</span>) <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">permanently</span>, type:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --permanent --zone=trusted --add-source=192.168.2.0/24success # firewall-cmd --reloadsuccess</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Note1: Use the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">–remove-source</span> option to delete a previous assigned source.<br/>Note2: Use the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">–change-source</span> option to move the source to the new specified zone.<br/>Note3: If you want to <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">temporarily</span> add a source to a zone, don’t use the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">–permanent</span> option and don’t <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">reload</span> the firewall configuration. If you <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">reload</span> the firewall configuration, this will <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">cancel</span> all the operation.<br/>Note4: You can also make some changes and when you like your new configuration, have it become your permanent configuration with the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">firewall-cmd –runtime-to-permanent</span>command.</p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">With the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">RHEL 7.3</span> release, you can add a source based on a <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">MAC</span> address (here <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">00:11:22:33:44:55</span>) to a zone (here <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">trusted</span>) <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">permanently</span>:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --permanent --zone=trusted --add-source=00:11:22:33:44:55success # firewall-cmd --reloadsuccess</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">With the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">RHEL 7.3</span> release, you can create an <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">ipset</span> (a set of IP addresses or networks, see below) and add a source based on it:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --permanent --new-ipset=iplist --type=hash:ipsuccess # firewall-cmd --reloadsuccess # firewall-cmd --ipset=iplist --add-entry=192.168.1.11success # firewall-cmd --ipset=iplist --add-entry=192.168.1.12success # firewall-cmd --permanent--zone=trusted --add-source=ipset:iplistsuccess # firewall-cmd --reloadsuccess</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">To get the list of the sources <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">currently</span> bound to a zone (here <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">trusted</span>), type:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --permanent --zone=trusted --list-sources192.168.2.0/24 00:11:22:33:44:55 ipset:iplist</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Note: Remove the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">–permanent</span> option if you only want to display <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">temporary</span> settings.</p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">To keep track of your configuration (<span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">active</span> zones are zones that have a binding to an interface or source), type:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --get-active-zonespublic interfaces: eth0 trusted sources: 192.168.2.0/24</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">As an exemple of source management, let’s assume you want to only allow connections to your server from a specific IP address (here <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">1.2.3.4/32</span>).</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --zone=internal --add-service=ssh --permanentsuccess # firewall-cmd --zone=internal --add-source=1.2.3.4/32 --permanentsuccess # firewall-cmd --zone=public --remove-service=ssh --permanentsuccess # firewall-cmd --reloadsuccess</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Source: <a title="http://serverfault.com/questions/680780/block-all-but-a-few-ips-with-firewalld" href="http://serverfault.com/questions/680780/block-all-but-a-few-ips-with-firewalld" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">Serverfault website</a>.</p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">With <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">RHEL 7.3</span>, a new option called <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">–info-zone</span> is available.<br/>To get the detail of a zone called <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">public</span>, type:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --info-zone=publicpublic (active) target: default icmp-block-inversion: no interfaces: eth0 sources: services: dhcpv6-client ssh ports: protocols: masquerade: no forward-ports: sourceports: icmp-blocks: rich rules:</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Note: You can also add the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">–permanent</span> option.</p><h2 style="margin: 0.75em 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: 1em; font-family: inherit; font-size: 2.25em; vertical-align: baseline; overflow-wrap: break-word;">Service Management</h2><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">After assigning each network interface to a zone, it is now possible to add services to each zone.<br/>To allow the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">http</span> service <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">permanently</span> in the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">internal</span> zone, type:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --permanent --zone=internal --add-service=httpsuccess # firewall-cmd --reloadsuccess</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Note1: Type <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">–remove-service=http</span> to deny the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">http</span> service.<br/>Note2: The <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">firewall-cmd –reload</span> command is necessary to activate the change. Contrary to the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">–complete-reload</span> option, current connections are not stopped.<br/>Note3: If you only want to <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">temporarily</span> add a service, don’t use the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">–permanent</span> option and don’t <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">reload</span> the firewall configuration. If you <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">reload</span> the firewall configuration, you <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">cancel</span> all the operation.</p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">If you want to temporary add several services (here <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">http</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">https</span>, and <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">dns</span>) at the same time in the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">internal</span> zone, type:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --zone=internal --add-service={http,https,dns}success</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">To get the list of services in the default zone, type:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --list-servicesdhcpv6-client ssh</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Note: To get the list of the services in a particular zone, add the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">–zone=</span> option.</p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">With <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">RHEL 7.3</span>, a new option called <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">–info-service</span> is available.<br/>To get some information about the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">ftp</span> service, type:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --info-service=ftpftp ports: 21/tcp protocols: source-ports: modules: nf_conntrack_ftp destination:</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Note: You can also add the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">–permanent</span> option.</p><h2 style="margin: 0.75em 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: 1em; font-family: inherit; font-size: 2.25em; vertical-align: baseline; overflow-wrap: break-word;">Firewall Services Configuration</h2><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">With the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Firewalld</span> package, the firewall configuration of the main services (ftp, httpd, etc) comes in the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">/usr/lib/firewalld/services</span> directory. But it is still possible to add new ones in the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">/etc/firewalld/services</span> directory. Also, if files exist at both locations for the same service, the file in the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">/etc/firewalld/services</span> directory takes precedence.</p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">For example, it is the case of the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">HAProxy</span> service. There is no firewall configuration associated.<br/>Create the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">/etc/firewalld/services/haproxy.xml</span> and paste the following lines:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"><?xml version="1.0" encoding="utf-8"?> <service> <short>HAProxy</short> <description>HAProxy load-balancer</description> <port protocol="tcp" port="80"/> </service></pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Note: You can use the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">firewall-cmd –permanent –new-service=haproxy</span> command to quickly create a configuration file skeleton.</p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Assign the correct <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">SELinux</span> context and file permissions to the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">haproxy.xml</span> file:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># cd /etc/firewalld/services# restorecon haproxy.xml# chmod 640 haproxy.xml</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Add the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">HAProxy</span> service to the default zone <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">permanently</span> and <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">reload</span> the firewall configuration:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --permanent --add-service=haproxysuccess # firewall-cmd --reloadsuccess</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Note: According to <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Bert Van Vreckem</span>, it is possible to go quicker by using the command history (see details <a href="https://bertvv.github.io/presentation-el7-basics/" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">here</a>):</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --add-service=haproxysuccess # firewall-cmd --add-service=haproxy --permanentsuccess</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">In <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">RHEL 7.0 </span>(<span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Firewalld</span> <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">v0.3.9.7)</span>, there were <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">47</span> firewall services configured: <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">amanda-client</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">bacula</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">bacula-client</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">dhcp</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">dhcpv6</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">dhcpv6-client</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">dns</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">ftp</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">high-availability</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">http</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">https</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">imaps</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">ipp</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">ipp-client</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">ipsec</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">kerberos</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">kpasswd</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">ldap</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">ldaps</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">libvirt</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">libvirt-tls</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">mdns</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">mountd</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">ms-wbt</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">mysql</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">nfs</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">ntp</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">openvpn</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">pmcd</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">pmproxy</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">pmwebapi</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">pmwebapis</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">pop3s</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">postgresql</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">proxy-dhcp</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">radius</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">rpc-bind</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">samba</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">samba-client</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">smtp, </span><span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">ssh</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">telnet</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">tftp</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">tftp-client</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">transmission-client</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">vnc-server</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">wbem-https</span>.<br/>In <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">RHEL 7.1</span> (<span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Firewalld v0.3.9.11)</span>, the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">RH-Satellite-6</span> service was added.<br/>In <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">RHEL 7.2</span> (<span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Firewalld</span> <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">v0.3.9.14</span>), the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">freeipa-ldaps</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">freeipa-ldap</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">freeipa-replication</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">iscsi-target</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">rsyncd</span> and <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">vdsm</span> services were added.<br/>In <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">RHEL 7.3</span> (<span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Firewalld</span> <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">v0.4.3.2</span>), the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">amanda-k5-client</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">ceph</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">ceph-mon</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">docker-registry</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">dropbox-lansync</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">imap</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">kadmin</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">mosh</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">pop3</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">privoxy</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">ptp</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">pulseaudio</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">puppetmaster</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">sane</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">smtps</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">snmp</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">snmptrap</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">squid</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">synergy</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">syslog</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">syslog-tls</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">tinc</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">tor-socks</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">xmpp-bosh</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">xmpp-client</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">xmpp-local</span> and <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">xmpp-server</span> services have been added for a total of <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">81</span>services.</p><h2 style="margin: 0.75em 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: 1em; font-family: inherit; font-size: 2.25em; vertical-align: baseline; overflow-wrap: break-word;">Port Management</h2><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Port management follows the same model as service management.</p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">To allow the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">443/tcp</span> port <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">temporarily</span> in the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">internal</span> zone, type:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --zone=internal --add-port=443/tcpsuccess</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Note1: To make the configuration <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">permanent</span>, add the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">–permanent</span> option and <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">reload</span> the firewall configuration.<br/>Note2: Type <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">–remove-port=443/tcp</span> to deny the port.</p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">To get the list of ports <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">currently</span> open in the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">internal</span> zone, type:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --zone=internal --list-ports443/tcp</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Note: To only get the list of ports <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">permanently</span> open, add the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">–permanent</span> option. Here, you will not get anything.</p><h2 style="margin: 0.75em 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: 1em; font-family: inherit; font-size: 2.25em; vertical-align: baseline; overflow-wrap: break-word;">Rich Rules</h2><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">As the syntax used by the rich rules are somehow difficult to remember, keep in mind the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">man firewalld.richlanguage</span> command and the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Example</span> section at the end.</p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Here is the format of a rich rule:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --add-rich-rule 'rule ...'</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">To allow all connections from <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">192.168.2.2</span>, type:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --add-rich-rule 'rule family="ipv4" source address="192.168.2.2" log accept'</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Note1: The <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">log</span> option writes coming packets into the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">/var/log/messages</span> file.<br/>Note2: Use the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">–remove-rich-rule</span> option instead of the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">–add-rich-rule</span> option if you want to delete an already existing rule.</p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">To list the rich rules set in the default zone, type:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --list-allpublic (active) target: default icmp-block-inversion: no interfaces: eth0 sources: services: dhcpv6-client ssh ports: protocols: masquerade: no forward-ports: sourceports: icmp-blocks: rich rules: rule family="ipv4" source address="192.168.2.2" log accept</pre><h2 style="margin: 0.75em 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: 1em; font-family: inherit; font-size: 2.25em; vertical-align: baseline; overflow-wrap: break-word;">Direct Rules</h2><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">It is still possible to set specific rules by using the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">direct</span> mode (here to open the tcp port <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">9000</span>) that by-passes the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Firewalld</span> interface:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -p tcp --dport 9000 -j ACCEPTsuccess</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Note1: This example has been borrowed from <a title="http://ktaraghi.blogspot.fr/2013/10/what-is-firewalld-and-how-it-works.html" href="http://ktaraghi.blogspot.fr/2013/10/what-is-firewalld-and-how-it-works.html" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">Khosro Taraghi’s blog</a>.<br/>Note2: Use the same command with the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">–remove-rule</span> instead of <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">–add-rule</span> to delete the rule.<br/>Note3: The configuration is <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">temporary</span> except if you add the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">–permanent</span> option just after the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">–direct</span> option.<br/>Note4: It is not necessary to <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">reload</span> the firewall configuration, all commands are <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">directly</span>activated.</p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">To display all the direct rules added, type:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --direct --get-all-rules</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Note1: For information, the configuration is written into the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">/etc/firewalld/direct.xml</span> file.<br/>Note2: <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Direct rules</span> are not part of the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">RHCSA</span>/<span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">RHCE</span> exam objectives.</p><h2 style="margin: 0.75em 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: 1em; font-family: inherit; font-size: 2.25em; vertical-align: baseline; overflow-wrap: break-word;">IP Set Management</h2><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">With the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">RHEL 7.3</span> comes the ability to create <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">ipsets</span>. An <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">ipset</span> is a set of IP addresses or networks. The different categories belong to <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">hash:ip </span>or <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">hash:net</span>.</p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">To create a permanent IPv4 <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">ipset</span> containing two IP addresses and drop packets coming from these addresses, type:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --permanent --new-ipset=blacklist --type=hash:ipsuccess # firewall-cmd --reloadsuccess # firewall-cmd --ipset=blacklist --add-entry=192.168.1.11success # firewall-cmd --ipset=blacklist --add-entry=192.168.1.12success # firewall-cmd --add-rich-rule='rule source ipset=blacklist drop'success</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Note: Add <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">–option=family=inet6</span> to create an <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">IPv6</span> ipset.</p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">To get the content of the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">blacklist</span> ipset, type:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --info-ipset=blacklistblacklist type: hash:ip options: entries: 192.168.1.11 192.168.1.12</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">To remove the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">192.168.1.12</span> entry from the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">blacklist</span> ipset, type:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --ipset=blacklist --remove-entry=192.168.1.12success # firewall-cmd --ipset=blacklist --get-entries192.168.1.11</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">To create a permanent IPv4 ipset containing two networks, type:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --permanent --new-ipset=netlistsuccess # firewall-cmd --reloadsuccess # firewall-cmd --ipset=netlist --add-entry=192.168.1.0/24success # firewall-cmd --ipset=netlist --add-entry=192.168.2.0/24success # firewall-cmd --info-ipset=netlistnetlist type: hash:net options: entries: 192.168.1.0/24 192.168.2.0/24 To remove the netlist ipset, type: # firewall-cmd --permanent --delete-ipset=netlistsuccess # firewall-cmd --reloadsuccess # firewall-cmd --get-ipsetsblacklist It is also possible to download the content of an ipset from a file (--add-entries-from-file=file option) or store it with the name ipset in the /etc/firewalld/ipsets/ipset.xmlor /usr/lib/firewalld/ipsets/ipset.xml files according to the following format:</pre><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"><?xml version="1.0" encoding="utf-8"?> <ipset type="hash:ip"> <short>My Ipset</short> <description>description</description> <entry>192.168.1.11</entry> <entry>192.168.1.12</entry> </ipset></pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">To load this ipset, type:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --reload</pre><h2 style="margin: 0.75em 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: 1em; font-family: inherit; font-size: 2.25em; vertical-align: baseline; overflow-wrap: break-word;">Masquerading</h2><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">If your firewall is your network gateway and you don’t want everybody to know your internal addresses, you can set up two zones, one called <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">internal</span>, the other <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">external</span>, and configure <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">masquerading</span> on the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">external</span> zone. This way, all packets will get your firewall ip address as source address.</p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">To set up <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">masquerading</span> on the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">external</span> zone in a temporary way, type:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --zone=external --add-masqueradesuccess</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Note1: To remove <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">masquerading</span>, use the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">–remove-masquerade</span> option.<br/>Note2: To know if <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">masquerading</span> is active in a zone, use the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">–query-masquerade</span> option.<br/>Note3: To get the configuration <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">permanent</span>, add the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">–permanent</span> option and <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">reload</span> the firewall configuration.</p><h2 style="margin: 0.75em 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: 1em; font-family: inherit; font-size: 2.25em; vertical-align: baseline; overflow-wrap: break-word;">Port Forwarding</h2><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;"><span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Port forwarding</span> is a way to forward inbound network traffic for a specific port to another internal address or an alternative port.</p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;"><span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Caution: Port forwarding requires masquerading</span> (<a href="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Using_Firewalls.html#sec-Configuring_firewalld" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">source</a>). This point is a classical mistake made during the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">RHCE</span> exam.</p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">So, you need to enable <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">masquerading</span> before anything else:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --zone=external --add-masqueradesuccess</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">If you want all packets intended for port <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">22</span> to be now forwarded to port <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">tcp</span> <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">3753 temporarily</span>, type:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --zone=external --add-forward-port=port=22:proto=tcp:toport=3753success</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Note1: To remove <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">port forwarding</span>, use the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">–remove-forward-port</span> option.<br/>Note2: To know if <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">port forwarding</span> is active in a zone, use the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">–query-forward-port</span> option.<br/>Note3: If you want to make the configuration <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">permanent</span>, add the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">–permanent</span> option and reload the firewall configuration.</p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Also, if you want to define the destination ip address, this time in a <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">permanent</span> way, type:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --permanent --zone=external --add-forward-port=port=22:proto=tcp:toport=3753:toaddr=10.0.0.1success # firewall-cmd --reloadsuccess</pre><h2 style="margin: 0.75em 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: 1em; font-family: inherit; font-size: 2.25em; vertical-align: baseline; overflow-wrap: break-word;">Special Modules</h2><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Sometimes it is required to download specific modules. Instead of <a href="https://www.certdepot.net/rhel7-rc-local-service/" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">using a rc.local file</a>, it is better to notify <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Firewalld</span> through the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">/etc/modules-load.d</span> directory.<br/>In this example we want to add the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">ip_nat_ftp</span> and <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">ip_conntrack_ftp</span> modules to follow <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">ftp</span>connections.<br/>We only need to choose a filename (here <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">firewall_ftp.conf</span>) and type these instructions:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># echo ip_nat_ftp > /etc/modules-load.d/firewall_ftp.conf# echo ip_conntrack_ftp >> /etc/modules-load.d/firewall_ftp.conf</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Source: <a title="http://unix.stackexchange.com/questions/240044/on-centos7-firewalld-overwrite-iptables-modules" href="http://unix.stackexchange.com/questions/240044/on-centos7-firewalld-overwrite-iptables-modules" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">StackExchange website</a>.</p><h2 style="margin: 0.75em 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: 1em; font-family: inherit; font-size: 2.25em; vertical-align: baseline; overflow-wrap: break-word;">Offline Configuration</h2><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">In some cases (installations through <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Anaconda</span> or <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Kickstart </span>for example), you need to set up firewall rules when <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Firewalld</span> is not running. The <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">firewall-offline-cmd</span> command has just been created for this purpose.<br/>For instance, to open the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">tcp port 22</span>, you would type in the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">/etc/sysconfig/iptables</span> file:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;">-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Instead, you can now execute the following command:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-offline-cmd --direct --add-rule ipv4 filter INPUT 0 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT</pre><h2 style="margin: 0.75em 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: 1em; font-family: inherit; font-size: 2.25em; vertical-align: baseline; overflow-wrap: break-word;">Configuration Backup</h2><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">To store the current configuration into files, type:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># iptables -S > firewalld_rules_ipv4# ip6tables -S > firewalld_rules_ipv6</pre><h2 style="margin: 0.75em 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: 1em; font-family: inherit; font-size: 2.25em; vertical-align: baseline; overflow-wrap: break-word;">Debugging Tips</h2><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">To better understand how <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Firewalld</span> works, assign the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">‘–debug’</span> value to the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">FIREWALLD_ARGS</span> variable in the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">/etc/sysconfig/firewalld</span> file:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewalld command line args # possile values: --debug FIREWALLD_ARGS='--debug'</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Restart the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Firewalld </span>daemon:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># systemctl restart firewalld</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Note: Messages will be written into the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">/var/log/firewalld</span> file.</p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Also, with the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">RHEL 7.3</span> release comes the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">LogDenied</span> directive in the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">/etc/firewalld/firewalld.conf</span> file.<br/>This directive adds logging rules right before reject and drop rules in the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">INPUT</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">FORWARD</span>and <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">OUTPUT</span> chains for the default rules and also final reject and drop rules in zones.<br/>Possible values are: <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">all</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">unicast</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">broadcast</span>, <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">multicast</span> and <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">off</span> (value by default).</p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Reload the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Firewalld </span>configuration:</p><pre style="margin-top: 0px; margin-bottom: 0px; padding: 6px 10px; border-width: 1px; border-style: solid; border-color: rgb(170, 170, 170) rgb(170, 170, 170) rgb(204, 204, 204); border-image: initial; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: monospace, serif; vertical-align: middle; box-sizing: border-box; width: 605.484px; height: auto; border-radius: 2px; outline: none; background-color: rgb(244, 244, 244); box-shadow: rgb(255, 255, 255) 0px 1px 0px, rgba(0, 0, 0, 0.2) 0px 1px 1px inset; overflow-wrap: normal; overflow-x: auto;"># firewall-cmd --reload</pre><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Note: Messages will be written into the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">/var/log/messages</span> file. If you also want messages to be written in a file called <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">/var/log/custom.log</span>, edit the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">/etc/rsyslog.conf</span> file, add the line <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">kern.warning /var/log/custom.log</span> and restart the <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">rsyslog</span> configuration with <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;"># systemctl restart rsyslog</span></p><h2 style="margin: 0.75em 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: 1em; font-family: inherit; font-size: 2.25em; vertical-align: baseline; overflow-wrap: break-word;">Additional Resources</h2><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">In addition, you can:</p><ul style="margin-right: 1.5em; margin-bottom: 1.5em; padding: 0px 0px 0px 2em; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; list-style-position: initial; list-style-image: initial;" class=" list-paddingleft-2"><li><p>read this <a title="http://searchdatacenter.techtarget.com/tip/A-few-ways-to-configure-Linux-firewalld" href="http://searchdatacenter.techtarget.com/tip/A-few-ways-to-configure-Linux-firewalld" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">article about Firewalld by Sander van Vugt,</a></p></li><li><p>watch <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Thomas Woerner</span>‘s video about <a title="https://www.youtube.com/watch?v=L8rwSqONmCY#t=4m45s" href="https://www.youtube.com/watch?v=L8rwSqONmCY#t=4m45s" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">Firewalld, present and future (48min/2015)</a>,</p></li><li><p>read this <a href="https://fedoraproject.org/wiki/Fail2ban_with_FirewallD" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">FedoraProject page about Fail2ban with Firewalld</a>,</p></li><li><p>read this article about <a href="https://www.hogarthuk.com/?q=node/9" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">Firewalld and zone deployment by James Hogarth</a>,</p></li><li><p>read the <a href="https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_7_Benchmark_v1.1.0.pdf" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">CIS RHEL 7 Server Hardening Guide</a>,</p></li><li><p>watch <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Venkat Nagappan</span>‘s video about <a href="https://www.youtube.com/watch?v=TyMallqnWiw" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">Firewalld Concepts and Examples (34min/2015)</a>,</p></li><li><p>watch <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Sander van Vugt</span>‘s video about <a href="https://www.youtube.com/watch?v=MKTDFkwgMRQ" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">port forwarding using firewall-cmd (8min/2015)</a>,</p></li><li><p>watch <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Ralph Nyberg</span>‘s video about <a href="https://www.youtube.com/watch?v=XF9sjjLM8_0" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">Firewalld and Iptables (26min/2016)</a>,</p></li><li><p>read <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Thomas Woerner</span>‘s blog, the <a href="http://www.firewalld.org/" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">blog of the author of Firewalld</a>,</p></li><li><p>read this presentation from the <a href="http://www.firewalld.org/uploads/2015/06/nfws2015-firewalld.pdf" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">11th Netfilter Workshop (2015)</a>,</p></li><li><p>read the <a href="https://github.com/t-woerner/firewalld/releases" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">changelog of the Firewalld versions</a>,</p></li><li><p>have a look at <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;"><span class="byline author vcard" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;"><span class="byline-name fn" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Daniel Aleksandersen</span></span></span>‘s blog about <a href="https://www.ctrl.blog/entry/how-to-firewalld-zone-by-ip" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">Configuring zones bound by source IPs in Firewalld</a> or <a href="https://www.ctrl.blog/entry/ufw-vs-firewalld" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">Comparing and contrasting Uncomplicated Firewall and Firewalld</a>,</p></li><li><p>read <span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: 700; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;">Alexander Molochko</span>‘s blog about <a href="https://crosp.net/blog/administration/drop-all-accept-few-zone-firewalld-centos-7/" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">Creating a new zone in Firewalld</a>.</p></li></ul><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Sources: <a title="https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Using_Firewalls.html" href="https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Using_Firewalls.html" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">RHEL7 Security Guide</a>, <a title="https://fedoraproject.org/wiki/FirewallD" href="https://fedoraproject.org/wiki/FirewallD" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 102, 204); text-decoration-line: none;">wiki Fedora project</a>.</p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;"><span style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;"></span></p><div class="wpProQuiz_content" id="wpProQuiz_11" style="margin-right: 0px; margin-left: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; margin-top: 10px !important; margin-bottom: 10px !important;"><div class="wpProQuiz_text" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline;"><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;"><br/></p><p style="margin-top: 1.6em; margin-bottom: 1.6em; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; overflow-wrap: break-word;">Test yourself!</p></div></div></div><p><br/></p><!-- 统计访客停留时间 --> <div id="tingliu" style="background-color:#FFFFFF;border:1px dashed #FF0000;text-align:center;display:block;"><span class="tingliu2 hint--top hint--bounce"><a href="##read_time"><img src="https://kinber.cn/zb_users/plugin/zharry_Reading_time/images/tishi.gif" class="tingliu5" ></a></span> <span class="tingliu2">您阅读本篇文章共花了：</span> <span class="tingliu3" id="stime"></span> </div></br><!-- 统计访客停留时间结束 --><script language="JavaScript">var ss=0,mm=0,hh=0;function TimeGo(){ss++;if(ss>=60){mm+=1;ss=0}if(mm>=60){hh+=1;mm=0}ss_str=(ss<10?"0"+ss:ss);mm_str=(mm<10?"0"+mm:mm);tMsg=""+hh+"小时"+mm_str+"分"+ss_str+"秒";document.getElementById("stime").innerHTML=tMsg;setTimeout("TimeGo()",1000)}TimeGo();</script><div class="gave"><a href="javascript:;" id="gave">打赏</a><div class="code" id="wechatCode" style="display: none"><img src="https://www.hqyman.cn/zb_users/plugin/wxreward/src/alipaywechat.png" alt="微信扫一扫支付"><div id="ico-wechat"><img src="https://kinber.cn/zb_users/plugin/wxreward/src/ico-wechat.jpg" alt="微信logo" class="ico-wechat">支付宝微信扫一扫，打赏作者吧～</div></div></div><p>本文链接：<a href="https://kinber.cn/post/757.html" title="RHEL7: How to get started with Firewalld.">https://kinber.cn/post/757.html</a> 转载需授权！</p> <div class="" id="ishare-1" style="margin-top:0px!important; margin-bottom:0px!important;"> <input type="text" id="ishare_copy" value="https://kinber.cn/post/757.html"/>分享到：<a class="ishare-icon icon-link" href="javascript:void(0)" onclick="isharecopy()" title="点击复制文章链接"></a></div> <script> function isharecopy(){ var copyobject=document.getElementById("ishare_copy"); copyobject.select(); document.execCommand("Copy"); alert("成功复制本文链接"); }; $(document).ready(function() { $("#ishare-1").share({sites: ["qzone","qq","weibo","wechat","douban","linkedin","google","facebook","twitter", ]});}); </script> <br></br> <p style="font-size: 24px;">推荐本站淘宝优惠价购买喜欢的宝贝:</p> <p> <a href="https://www.hqyman.cn/taobao/" target="_blank" title="本站自助优惠购物"><img src="https://www.hqyman.cn/zb_users/upload/2023/03/202303281679965612475864.png" alt="image.png"/></a> </p> </article> <div id="rel"> <h3 class="zit kico-sub">少长咸集</h3> <ul> <li class="log"> <a href="https://kinber.cn/post/756.html" title="查看《采用windows下route命令设置静态路由实现跨网段访问》详情"> <img src="https://kinber.cn/zb_users/cache/thumbs/87f0b459996ccc91b5d835fba9ebcded-400-300-1.png" alt="采用windows下route命令设置静态路由实现跨网段访问" class="cover"> <span class="pane"> <em class="zit kico-prev">上一篇</em> <b>采用windows下route命令设置静态路由实现跨网段访问</b> <span><small class="kico-time"><dfn>发表于</dfn>2019-05-20</small> <small class="kico-eye"><dfn>浏览</dfn>2817</small> <small class="kico-ping"><dfn>评论</dfn>0</small></span> </span> </a> </li> <li class="log"> <a href="https://kinber.cn/post/758.html" title="查看《Firewalld CentOS 7 Masquerading》详情"> <img src="https://kinber.cn/zb_users/theme/Zit/style/bg.jpg" alt="Firewalld CentOS 7 Masquerading" class="cover hue"> <span class="pane"> <em class="zit kico-next">下一篇</em> <b>Firewalld CentOS 7 Masquerading</b> <span><small class="kico-time"><dfn>发表于</dfn>2019-05-20</small> <small class="kico-eye"><dfn>浏览</dfn>2008</small> <small class="kico-ping"><dfn>评论</dfn>0</small></span> </span> </a> </li> </ul> </div> <div id="cmts"> <h3 class="zit kico-lao">群贤毕至</h3> <form id="postcmt" class="pane cmt clear" target="_self" method="post" action="https://kinber.cn/zb_system/cmd.php?act=cmt&postid=757&key=0bde166b12531f0303271eb4ea50b31f" > <input type="hidden" name="postid" id="inpId" value="757"> <input type="hidden" name="replyid" id="inpRevID" value="0"> <img src="https://kinber.cn/zb_users/avatar/0.png" alt="访客" class="avatar"> <cite> <b><label><input type="text" name="name" id="inpName" placeholder="尊姓大名" title="用户名" value="访客"></label></b> <small><label><input type="text" name="email" id="inpEmail" placeholder="your@email.addr" title="邮箱" value=""></label> <label><input type="text" name="homepage" id="inpHomePage" placeholder="https://your.home.page" title="网站地址" value=""></label></small> </cite> <textarea name="content" id="txaArticle" cols="50" rows="2"></textarea> <span class="captcha"><label><input type="text" name="verify" id="inpVerify" placeholder="输入验证码"></label><img style="width:90px;height:30px;cursor:pointer;" src="https://kinber.cn/zb_system/script/c_validcode.php?id=cmt" title="点击更换验证码" onclick="javascript:this.src='https://kinber.cn/zb_system/script/c_validcode.php?id=cmt&tm='+Math.random();"></span> <button type="submit">提交</button> </form> <label id="AjaxCommentBegin"></label> <label id="AjaxCommentEnd"></label> </div> </main> <aside id="side"> <div class="pane hidem" id="divCalendar"> <div><table id="tbCalendar"> <caption><a title="上个月" href="https://kinber.cn/date-2024-8.html">«</a> <a href="https://kinber.cn/date-2024-9.html"> 2024年9月 </a> <a title="下个月" href="https://kinber.cn/date-2024-10.html">»</a></caption> <thead><tr> <th title="星期一" scope="col"><small>一</small></th> <th title="星期二" scope="col"><small>二</small></th> <th title="星期三" scope="col"><small>三</small></th> <th title="星期四" scope="col"><small>四</small></th> <th title="星期五" scope="col"><small>五</small></th> <th title="星期六" scope="col"><small>六</small></th> <th title="星期日" scope="col"><small>日</small></th></tr></thead> <tbody> <tr><td></td><td></td><td></td><td></td><td></td><td></td><td><a href="https://kinber.cn/date-2024-9-1.html" title="2024-9-1 (3)" target="_blank">1</a></td></tr> <tr><td><a href="https://kinber.cn/date-2024-9-2.html" title="2024-9-2 (5)" target="_blank">2</a></td><td>3</td><td><a href="https://kinber.cn/date-2024-9-4.html" title="2024-9-4 (4)" target="_blank">4</a></td><td>5</td><td>6</td><td>7</td><td>8</td></tr> <tr><td>9</td><td><a href="https://kinber.cn/date-2024-9-10.html" title="2024-9-10 (2)" target="_blank">10</a></td><td><a href="https://kinber.cn/date-2024-9-11.html" title="2024-9-11 (3)" target="_blank">11</a></td><td><a href="https://kinber.cn/date-2024-9-12.html" title="2024-9-12 (5)" target="_blank">12</a></td><td><a href="https://kinber.cn/date-2024-9-13.html" title="2024-9-13 (4)" target="_blank">13</a></td><td>14</td><td>15</td></tr> <tr><td>16</td><td>17</td><td><a href="https://kinber.cn/date-2024-9-18.html" title="2024-9-18 (1)" target="_blank">18</a></td><td><a href="https://kinber.cn/date-2024-9-19.html" title="2024-9-19 (2)" target="_blank">19</a></td><td>20</td><td>21</td><td>22</td></tr> <tr><td>23</td><td>24</td><td>25</td><td>26</td><td>27</td><td>28</td><td>29</td></tr> <tr><td>30</td><td></td><td></td><td></td><td></td><td></td><td></td></tr> </tbody> </table></div> </div><div class="pane hidem" id="divContorPanel"> <h4 class="zit">控制面板</h4> <div><span class="cp-hello">您好，欢迎到访网站！</span><br/><span class="cp-login"><a href="https://kinber.cn/zb_system/cmd.php?act=login">登录后台</a></span> <span class="cp-vrs"><a href="https://kinber.cn/zb_system/cmd.php?act=misc&type=vrs">查看权限</a></span></div> </div><div class="pane hidem" id="divCatalog"> <h4 class="zit">网站分类</h4> <ul><li class="stock"><a href="https://kinber.cn/category-2.html" class="kico-fold kico-gap">技术文章 <mark>3392</mark></a></li> <li class="stock"><a href="https://kinber.cn/category-3.html" class="kico-fold kico-gap">心情随笔 <mark>31</mark></a></li> <li class="stock"><a href="https://kinber.cn/category-4.html" class="kico-fold kico-gap">福利 <mark>15</mark></a></li> <li class="stock"><a href="https://kinber.cn/category-5.html" class="kico-fold kico-gap">play more <mark>5</mark></a></li> <li class="stock"><a href="https://kinber.cn/category-6.html" class="kico-fold kico-gap">Windows&office激活 <mark>14</mark></a></li> <li class="stock"><a href="https://kinber.cn/category-7.html" class="kico-fold kico-gap">虚拟化 <mark>153</mark></a></li> <li class="stock"><a href="https://kinber.cn/category-8.html" class="kico-fold kico-gap">Windows <mark>43</mark></a></li> <li class="stock"><a href="https://kinber.cn/category-9.html" class="kico-fold kico-gap">Linux <mark>24</mark></a></li> <li class="stock"><a href="https://kinber.cn/category-10.html" class="kico-fold kico-gap">Network <mark>23</mark></a></li> <li class="stock"><a href="https://kinber.cn/category-11.html" class="kico-fold kico-gap">金蝶 <mark>7</mark></a></li> <li class="stock"><a href="https://kinber.cn/category-12.html" class="kico-fold kico-gap">VPS <mark>6</mark></a></li> <li class="stock"><a href="https://kinber.cn/category-13.html" class="kico-fold kico-gap">网络实验室 <mark>15</mark></a></li> <li class="stock"><a href="https://kinber.cn/category-14.html" class="kico-fold kico-gap">青龙 <mark>22</mark></a></li> <li class="stock"><a href="https://kinber.cn/category-15.html" class="kico-fold kico-gap">docker <mark>8</mark></a></li> <li class="stock"><a href="https://kinber.cn/category-16.html" class="kico-fold kico-gap">Openwrt <mark>6</mark></a></li> <li class="stock"><a href="https://kinber.cn/category-17.html" class="kico-fold kico-gap">vpn <mark>25</mark></a></li> <li class="stock"><a href="https://kinber.cn/category-18.html" class="kico-fold kico-gap">群晖Synology <mark>2</mark></a></li> <li class="stock"><a href="https://kinber.cn/category-19.html" class="kico-fold kico-gap">android <mark>0</mark></a></li> <li class="stock"><a href="https://kinber.cn/category-20.html" class="kico-fold kico-gap">编程 <mark>16</mark></a></li> <li class="stock"><a href="https://kinber.cn/category-1.html" class="kico-fold kico-gap">未分类 <mark>0</mark></a></li> </ul> </div><div class="pane hidem" id="divPrevious"> <h4 class="zit">最近发表</h4> <ul><li class="illus"><a href="https://kinber.cn/post/3840.html" title="买的外链好不好"><small>2024-09-19</small>买的外链好不好</a></li> <li class="illus"><a href="https://kinber.cn/post/3839.html" title="谷歌广告投放加拿大要收税了"><img src="https://kinber.cn/zb_users/cache/thumbs/dbe409785f18566803304b68e59cb7bd-400-300-1.png" alt="谷歌广告投放加拿大要收税了" class="cover"><small>2024-09-19</small>谷歌广告投放加拿大要收税了</a></li> <li class="illus"><a href="https://kinber.cn/post/3838.html" title="乌云深处：历史回声与我们的思考"><small>2024-09-18</small>乌云深处：历史回声与我们的思考</a></li> <li class="illus"><a href="https://kinber.cn/post/3837.html" title="倘若心中眼泪流成河"><img src="https://kinber.cn/zb_users/cache/thumbs/bd98cd492369182132a0a3a2bcbd8fdc-400-300-1.png" alt="倘若心中眼泪流成河" class="cover"><small>2024-09-13</small>倘若心中眼泪流成河</a></li> <li class="illus"><a href="https://kinber.cn/post/3836.html" title="那些不是Papi酱的自媒体如何在“众媒时代”生存"><img src="https://kinber.cn/zb_users/cache/thumbs/384a50879fbd00569179a655ed07c20a-400-300-1.jpg" alt="那些不是Papi酱的自媒体如何在“众媒时代”生存" class="cover"><small>2024-09-13</small>那些不是Papi酱的自媒体如何在“众媒时代”生存</a></li> <li class="illus"><a href="https://kinber.cn/post/3835.html" title="互联网时代 月入十万真的难吗？"><small>2024-09-13</small>互联网时代 月入十万真的难吗？</a></li> <li class="illus"><a href="https://kinber.cn/post/3834.html" title="阿里云机房着火超30个小时，云服务宕机，AWS趁火打劫？"><img src="https://kinber.cn/zb_users/cache/thumbs/69f46831045addc2b0682e8946c18c01-400-300-1.png" alt="阿里云机房着火超30个小时，云服务宕机，AWS趁火打劫？" class="cover"><small>2024-09-13</small>阿里云机房着火超30个小时，云服务宕机，AWS趁火打劫？</a></li> <li class="illus"><a href="https://kinber.cn/post/3833.html" title="使用netlify发布自己的静态网站项目"><img src="https://kinber.cn/zb_users/cache/thumbs/10e84a459d6c35e5fd300d14fd76e2bf-400-300-1.png" alt="使用netlify发布自己的静态网站项目" class="cover"><small>2024-09-12</small>使用netlify发布自己的静态网站项目</a></li> <li class="illus"><a href="https://kinber.cn/post/3832.html" title="如何使用 Hugo 搭建高颜值的个人博客"><img src="https://kinber.cn/zb_users/cache/thumbs/b9c9d7af4d543d33ab7bbe365af286c8-400-300-1.jpg" alt="如何使用 Hugo 搭建高颜值的个人博客" class="cover"><small>2024-09-12</small>如何使用 Hugo 搭建高颜值的个人博客</a></li> <li class="illus"><a href="https://kinber.cn/post/3831.html" title="利用Hugo+Stack主题快速构建个人网站"><small>2024-09-12</small>利用Hugo+Stack主题快速构建个人网站</a></li> </ul> </div><div class="pane hidem" id="divComments"> <h4 class="zit">最新留言</h4> <ul><li class="discuz"><a href="https://kinber.cn/post/2731.html#cmt201" title="访客评论了《API player》"><img src="https://kinber.cn/zb_users/avatar/0.png" alt="访客"> <b>访客</b>：代码复制不了了 <q>API player</q></a></li> <li class="discuz"><a href="https://kinber.cn/post/3632.html#cmt200" title="访客评论了《Aurora极光：一款为数不多支持免费的xPN工具》"><img src="https://kinber.cn/zb_users/avatar/0.png" alt="访客"> <b>访客</b>：大佬，下载不了了，请问还有什么办法吗 <q>Aurora极光：一款为数不多支持免费的</q></a></li> <li class="discuz"><a href="https://kinber.cn/post/3095.html#cmt195" title="访客评论了《https://github.com/laomms/PidKeyTool/releases 密钥检测 获取CID 识别CID》"><img src="//dn-qiniu-avatar.qbox.me/avatar/b93b674484398ca1e7003338d5af731b.png?s=60&d=mm&r=G" alt="访客"> <b>访客</b>：获取不到确认ID了，是出现了什么问题吗？ <q>https://github.com/l</q></a></li> <li class="discuz"><a href="https://kinber.cn/2.html#cmt194" title="访客评论了《留言本》"><img src="//dn-qiniu-avatar.qbox.me/avatar/b93b674484398ca1e7003338d5af731b.png?s=60&d=mm&r=G" alt="访客"> <b>访客</b>：为什么最近获取不到Windows的安装ID了？是微软关闭接口 <q>留言本</q></a></li> <li class="discuz"><a href="https://kinber.cn/4.html#cmt189" title="胡评论了《关于我》"><img src="//dn-qiniu-avatar.qbox.me/avatar/cc24d31fa84f22ec75e26dddd9cf6e83.png?s=60&d=mm&r=G" alt="胡"> <b>胡</b>：你好，我frp内网穿透，tcp都能搞好，就是http的搞不好 <q>关于我</q></a></li> <li class="discuz"><a href="https://kinber.cn/post/1025.html#cmt188" title="访客评论了《为公司省钱往往省不到自己身上》"><img src="https://kinber.cn/zb_users/avatar/0.png" alt="访客"> <b>访客</b>：除非你自己就是老板，省下来的钱才是自己的。打工人尽量甩锅是正 <q>为公司省钱往往省不到自己身上</q></a></li> <li class="discuz"><a href="https://kinber.cn/post/3071.html#cmt187" title="访客评论了《SLIC 2.6：Windows Server 2022 OEM SLP 准备就绪，更新完毕》"><img src="https://kinber.cn/zb_users/avatar/0.png" alt="访客"> <b>访客</b>：谢谢楼主的分享！我就是1809的2019，感觉很笨拙，想上到 <q>SLIC 2.6：Windows Ser</q></a></li> <li class="discuz"><a href="https://kinber.cn/4.html#cmt185" title="访客评论了《关于我》"><img src="https://kinber.cn/zb_users/avatar/0.png" alt="访客"> <b>访客</b>：哎哟，不错的个人小站。 <q>关于我</q></a></li> <li class="discuz"><a href="https://kinber.cn/post/2497.html#cmt183" title="王伦评论了《AD 域部署分发安装软件》"><img src="//dn-qiniu-avatar.qbox.me/avatar/791b23d29ec9eabed2b99fb5a570d078.png?s=60&d=mm&r=G" alt="王伦"> <b>王伦</b>：针对计算的下发软件安装为什么会不自动执行，测试了很久都不行 <q>AD 域部署分发安装软件</q></a></li> <li class="discuz"><a href="https://kinber.cn/post/2244.html#cmt179" title="访客评论了《群晖 篇一：超详细猫盘单群晖固件刷机教程》"><img src="//dn-qiniu-avatar.qbox.me/avatar/c47838b41945da8ee1b843330221f33b.png?s=60&d=mm&r=G" alt="访客"> <b>访客</b>：链接挂了！ <q>群晖 篇一：超详细猫盘单群晖固件刷机教程</q></a></li> </ul> </div><div class="pane hidem" id="divArchives"> <h4 class="zit">文章归档</h4> <ul><li class="stock"><a href="https://kinber.cn/date-2024-9.html" class="kico-calendar kico-gap">2024年9月 <mark>29</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2024-8.html" class="kico-calendar kico-gap">2024年8月 <mark>19</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2023-4.html" class="kico-calendar kico-gap">2023年4月 <mark>3</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2023-3.html" class="kico-calendar kico-gap">2023年3月 <mark>84</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2023-2.html" class="kico-calendar kico-gap">2023年2月 <mark>90</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2023-1.html" class="kico-calendar kico-gap">2023年1月 <mark>207</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2022-12.html" class="kico-calendar kico-gap">2022年12月 <mark>216</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2022-11.html" class="kico-calendar kico-gap">2022年11月 <mark>343</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2022-10.html" class="kico-calendar kico-gap">2022年10月 <mark>62</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2022-9.html" class="kico-calendar kico-gap">2022年9月 <mark>73</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2022-8.html" class="kico-calendar kico-gap">2022年8月 <mark>158</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2022-7.html" class="kico-calendar kico-gap">2022年7月 <mark>119</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2022-6.html" class="kico-calendar kico-gap">2022年6月 <mark>168</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2022-5.html" class="kico-calendar kico-gap">2022年5月 <mark>33</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2022-4.html" class="kico-calendar kico-gap">2022年4月 <mark>53</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2022-3.html" class="kico-calendar kico-gap">2022年3月 <mark>60</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2022-2.html" class="kico-calendar kico-gap">2022年2月 <mark>7</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2022-1.html" class="kico-calendar kico-gap">2022年1月 <mark>31</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2021-12.html" class="kico-calendar kico-gap">2021年12月 <mark>35</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2021-11.html" class="kico-calendar kico-gap">2021年11月 <mark>27</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2021-10.html" class="kico-calendar kico-gap">2021年10月 <mark>74</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2021-9.html" class="kico-calendar kico-gap">2021年9月 <mark>61</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2021-8.html" class="kico-calendar kico-gap">2021年8月 <mark>29</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2021-7.html" class="kico-calendar kico-gap">2021年7月 <mark>17</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2021-6.html" class="kico-calendar kico-gap">2021年6月 <mark>55</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2021-5.html" class="kico-calendar kico-gap">2021年5月 <mark>57</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2021-4.html" class="kico-calendar kico-gap">2021年4月 <mark>51</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2021-3.html" class="kico-calendar kico-gap">2021年3月 <mark>16</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2021-2.html" class="kico-calendar kico-gap">2021年2月 <mark>1</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2021-1.html" class="kico-calendar kico-gap">2021年1月 <mark>27</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2020-12.html" class="kico-calendar kico-gap">2020年12月 <mark>60</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2020-11.html" class="kico-calendar kico-gap">2020年11月 <mark>28</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2020-10.html" class="kico-calendar kico-gap">2020年10月 <mark>8</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2020-9.html" class="kico-calendar kico-gap">2020年9月 <mark>1</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2020-8.html" class="kico-calendar kico-gap">2020年8月 <mark>32</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2020-7.html" class="kico-calendar kico-gap">2020年7月 <mark>50</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2020-6.html" class="kico-calendar kico-gap">2020年6月 <mark>86</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2020-5.html" class="kico-calendar kico-gap">2020年5月 <mark>87</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2020-4.html" class="kico-calendar kico-gap">2020年4月 <mark>27</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2020-3.html" class="kico-calendar kico-gap">2020年3月 <mark>26</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2020-2.html" class="kico-calendar kico-gap">2020年2月 <mark>9</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2020-1.html" class="kico-calendar kico-gap">2020年1月 <mark>35</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2019-12.html" class="kico-calendar kico-gap">2019年12月 <mark>37</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2019-11.html" class="kico-calendar kico-gap">2019年11月 <mark>99</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2019-10.html" class="kico-calendar kico-gap">2019年10月 <mark>30</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2019-9.html" class="kico-calendar kico-gap">2019年9月 <mark>24</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2019-8.html" class="kico-calendar kico-gap">2019年8月 <mark>17</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2019-7.html" class="kico-calendar kico-gap">2019年7月 <mark>92</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2019-6.html" class="kico-calendar kico-gap">2019年6月 <mark>21</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2019-5.html" class="kico-calendar kico-gap">2019年5月 <mark>121</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2019-4.html" class="kico-calendar kico-gap">2019年4月 <mark>156</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2019-3.html" class="kico-calendar kico-gap">2019年3月 <mark>163</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2019-2.html" class="kico-calendar kico-gap">2019年2月 <mark>2</mark></a></li> <li class="stock"><a href="https://kinber.cn/date-2019-1.html" class="kico-calendar kico-gap">2019年1月 <mark>272</mark></a></li> </ul> </div><div class="pane hidem" id="divTags"> <h4 class="zit">标签列表</h4> <ul></ul> </div><div class="pane hidem" id="divLinkage"> <h4 class="zit">友情链接</h4> <ul><li class="link-item"><a href="https://www.hqyman.cn/" target="_blank" title="HQY 一个和谐有爱的空间">HQY 一个和谐有爱的空间</a></li><li class="link-item"><a href="https://www.1953.me/" title="收录">收录</a></li> </ul> </div></aside> </div> </section> <footer id="base"> <div class="inner"> <h4>© 2024 <a href="https://kinber.cn/" class="zit">HQY</a> Copyright HQY Rights Reserved.</h4> <h5>Powered By <a href="//www.hqyman.cn" title="和谐有爱" target="_blank">和谐有爱</a> Theme By <a href="//www.hqyman.cn" target="_blank" title="HQY">HQY</a></h5> 当前在线 455 人 欢迎你第一次访问网站! <script src="https://kinber.cn/zb_users/plugin/dayuser/style/js/frontend.js"></script> <link href="https://kinber.cn/zb_users/plugin/wxreward/src/wx-reward.css" rel="stylesheet"> <script type="text/javascript" src="https://kinber.cn/zb_users/plugin/wxreward/src/wx-reward.js"></script><div id="minigame_minigame" onclick="enlargeGame()" style= "bottom:160px!important; right:20px!important"> <span>分数:<strong>0</strong></span> <img class="minigame_covers" src="https://kinber.cn/zb_users/plugin/Floating_games/images/cover.png"> </div><script type="text/javascript" src="https://kinber.cn/zb_users/plugin/Floating_games/script/playaircraft.js"></script><script type="text/javascript" src="https://kinber.cn/zb_users/plugin/minigames/script/tank/index.js"></script><script type="text/javascript" src="https://kinber.cn/zb_users/plugin/minigames/script/tank/config.js"></script><script type="text/javascript" src="https://kinber.cn/zb_users/plugin/minigames/script/tank/functions.js"></script><script type="text/javascript" src="https://kinber.cn/zb_users/plugin/minigames/script/tank/tank.js"></script><script type="text/javascript" src="https://kinber.cn/zb_users/plugin/minigames/script/tank/bullet.js"></script><script type="text/javascript" src="https://kinber.cn/zb_users/plugin/minigames/script/tank/game.js"></script><script type="text/javascript" src="https://kinber.cn/zb_users/plugin/minigames/script/tank/index2.js"></script><div id="nocmtip" style="position:absolute;left:-100%;height:0;overflow:hidden;">请先 <a href="#xylogin">登录</a> 再评论，若不是会员请先 <a href="#xyreg">注册</a>！</div> <script src="https://kinber.cn/zb_users/plugin/CommentSet/c.js?v=1.4"></script> <script>var randomNum=function(minNum,maxNum){switch(arguments.length){case 1:return parseInt(Math.random()*minNum+1,10);break;case 2:return parseInt(Math.random()*(maxNum-minNum+1)+minNum,10);break;default:return 0;break}};var duoMaomao=function(){var maomao=$("#maomao");maomao.css("bottom",randomNum(5,80)+"vh")};</script><div id="maomao" onMouseOut="duoMaomao()"></div><div class="Jz52_HB"><a href="#" target="_blank"><img src="https://kinber.cn/zb_users/plugin/Jz52_xfhb/img/hb.png" alt="抢红包"></a></div><script type="text/javascript" src="https://www.kinber.cn/zb_users/plugin/qqinfo/script/script.js"></script> </div> </footer> </body> </html><!--147.96 ms , 15 queries , 6268kb memory , 6 errors-->
