Install and Configure FirewallD on Centos 7

Description: FirewallD is a firewall management tool available on CentOS 7 servers. Basically, it is a wrapper around iptables and it comes with graphical configuration tool firewall-config and command line tool firewall-cmd. With the iptables service, every change requires flushing of the old rules and reading the new rules from the '/etc/sysconfig/iptables' file, while with firewalld only differences are applied.

Procedure: 

• Install FirewallD using yum 

# yum install firewalld 

FirewallD Zones: FirewallD uses services and zones instead of iptables rules and chains. By default the following zones are available

1. Drop: Drop all incoming network packets with no reply, only outgoing network connections are available.
2. Block: Reject all incoming network packets with an icmp-host-prohibited message, only outgoing network connections are available.
3. Public: Only selected incoming connections are accepted, for use in public areas
4. External: For external networks with masquerading enabled, only selected incoming connections are accepted.
5. DMZ: DMZ demilitarized zone, publicly-accessible with limited access to the internal network, only selected incoming connections are accepted.
6. work: For computers in your home area, only selected incoming connections are accepted.
7. home: For computers in your home area, only selected incoming connections are accepted.
8. internal: For computers in your internal network, only selected incoming connections are accepted.
9. trusted: All network connections are accepted.

• To list all available zones 

# firewall-cmd --get-zones

work drop internal external trusted home dmz public block

• To list default zone

#firewall-cmd --get-default-zone
public

• To change the default zone:

# firewall-cmd --set-default-zone
# firewall-cmd --get-default-zone
dmz

• Add and allow service in DMZ zone 

# firewall-cmd --zone=dmz --add-service=http --permanent
# firewall-cmd --zone=dmz --add-service=https --permanent
# firewall-cmd --zone=dmz --add-service=imap --permanent
# firewall-cmd --zone=dmz --add-service=imaps --permanent
# firewall-cmd --zone=dmz --add-service=pop3 --permanent
# firewall-cmd --zone=dmz --add-service=pop3s --permanent

• Remove service and add custom port 

# firewall-cmd --remove-service=ssh --permanent
# firewall-cmd --add-port=7022/tcp --permanent

• Reload Firewall configuration 

# firewall-cmd --reload

• List Firewall Rules 

# firewall-cmd --list-all
dmz
target: default
icmp-block-inversion: 
interfaces
sources
services: http https imap imaps pop3 pop3s smtp smtps
ports: 7022/tcp
protocols
masquerade: no
forward-ports
sourceports
icmp-blocks
rich rules