I have multiple CentOS 7 machines in the same LAN. Each one is communicating with a few others and having one or more applications installed that each listen on various ports (database, webserver, load-balancing service etc.). Typical web-architecture stuff.
firewalld is disabled on all of them. And I want to enable it everywhere.
Normally it would go something like:
systemctl enable firewalld
systemctl start firewalld
firewall-cmd <...>(add ports, sources, services etc.)
The problem is that, once I start firewalld service, by default it blocks most of my stuff1, until I get the chance to do the 3rd step. And, given the big number of configurations (ports, sources) I have to add, my services will basically become unusable/unreachable until I figure it out.
I'm most concerned of some of these features:
- I use GlusterFS on some machines to create a network-file-system which I then mount on other machines
- I use Corosync+Pacemaker to create a couple of clusters between some of the machines; these tools use various ports for heartbeat-like functionality
If I turn on firewalld on these machines, it would immediately block all these services, until I get the chance to execute my many
firewall-cmd <...> statements. And I don't know the consequences of that.
My question is: Is there some way to execute the 3rd step BEFORE the 2nd step? So that everything is in place when I turn on the service.
My one single idea is to somehow manually edit the XML files in the
/etc/firewalld/zones folder. But it seems extremely error-prone, especially since I'm not that familiar with firewalld to be confortable making such edits.
1 = From what I know, only ports 80/443 (HTTP/HTTPS) and 22 (SSH) will be opened, all others are blocked until you explicitly open them.