2

I have multiple CentOS 7 machines in the same LAN. Each one is communicating with a few others and having one or more applications installed that each listen on various ports (database, webserver, load-balancing service etc.). Typical web-architecture stuff.

Now firewalld is disabled on all of them. And I want to enable it everywhere.

Normally it would go something like:

  1. systemctl enable firewalld
  2. systemctl start firewalld
  3. firewall-cmd <...> (add ports, sources, services etc.)

The problem is that, once I start firewalld service, by default it blocks most of my stuff1, until I get the chance to do the 3rd step. And, given the big number of configurations (ports, sources) I have to add, my services will basically become unusable/unreachable until I figure it out.

I'm most concerned of some of these features:

  • I use GlusterFS on some machines to create a network-file-system which I then mount on other machines
  • I use Corosync+Pacemaker to create a couple of clusters between some of the machines; these tools use various ports for heartbeat-like functionality

If I turn on firewalld on these machines, it would immediately block all these services, until I get the chance to execute my many firewall-cmd <...> statements. And I don't know the consequences of that.


My question is: Is there some way to execute the 3rd step BEFORE the 2nd step? So that everything is in place when I turn on the service.

My one single idea is to somehow manually edit the XML files in the /etc/firewalld/zones folder. But it seems extremely error-prone, especially since I'm not that familiar with firewalld to be confortable making such edits.


1 = From what I know, only ports 80/443 (HTTP/HTTPS) and 22 (SSH) will be opened, all others are blocked until you explicitly open them.

2

Before you start firewalld service you should specify parameters via config files. I recommend to you to create file of rules for every service (GlusterFS, Pacemaker ...) and put in the file all ports that you need. For example (for pacemaker got from Configuring the iptables Firewall to Allow Cluster Components) /etc/firewalld/services/pacemaker.xml:

<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>Pacemaker</short>
  <description>Pacemaker service</description>
  <port protocol="tcp" port="2224"/>
  <port protocol="tcp" port="3121"/>
  <port protocol="tcp" port="5403"/>
  <port protocol="udp" port="5404"/>
  <port protocol="udp" port="5405"/>
  <port protocol="tcp" port="21064"/>
</service>

More info with examples you can got from How To Set Up a Firewall Using FirewallD on CentOS 7.

Then you can start firewalld safely.

If you are afraid of break firewalld by editing zone files by hand you can test in virtual environment before apply in working system.

  • So you're saying you can manually add such files in /etc/firewalld/services and they will be read/loaded when you turn on firewalld? Interesting, that might work. I'll take a closer look, thanks. – Radu Murzea Jun 24 '19 at 12:57
  • @RaduMurzea Yes it will be read/reloaded when you turn on firewall via systemctl start firewalld or reload config via firewall-cmd --reload. I took this info from "How To Set Up a Firewall Using FirewallD on CentOS 7". – Yurij Goncharuk Jun 24 '19 at 13:01
  • Wouldn't firewall-offline-cmd <...> be a better fit here? I didn't know it existed, just found it in the man-pages a few minutes ago... – Radu Murzea Jul 2 '19 at 13:32
0

Easy. Just add the option --permanent to all your rules, e.g.

firewall-cmd --zone=trusted --add-port=1234/tcp --permanent

This will register rules in the permanent configuration but won't apply them, until you run the command

firewall-cmd --reload

By the way, this is the recommended way to operate firewalld; if you don't use the --permanent option, changes will be applied temporarily and will be erased at the next firewall reload or restart.

  • 1
    Maybe I'm getting it wrong, but I think the question was how to do this without actually having to start firewalld first. – Edward Jun 24 '19 at 12:56
  • Ah, you're right. My mistake. – dr01 Jun 24 '19 at 12:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.