https://en.wikipedia.org/wiki/Firewalld
“firewalld is a firewall management tool for Linux operating systems. It provides firewall features by acting as a front-end for the Linux kernel's netfilter framework. firewalld's current default backend is nftables. Prior to v0.6.0, iptables was the default backend. Through its abstractions, firewalld acts as an alternative to nft and iptables command line programs.”
Administrators can use firewalld to restrict traffic that is attempting to route through network ports.
CentOS 7 and CentOS 8 provide VM, disk, and container images where firewalld is enabled, where it is limiting network traffic.
If an administrator has configured firewalld to block traffic through the ports that are used by Syndeia, then installation and operation of Syndeia may fail when Syndeia’s several services attempt to bind to sockets or to establish connections that use the blocked ports.
All changes made to an operating system’s security policies must comply with the organization’s corporate or governmental security mandates. Intercax does not advise any user to make proscribed changes to security policies.
To determine if firewalld is installed, enabled, and enforcing traffic controls:
sudo systemctl status firewalld
When firewalld is installed, enabled, and enforcing traffic controls, the output will resemble:
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
Active: active (running) since Thu 2022-04-28 19:56:22 EDT; 18h ago
Docs: man:firewalld(1)
Main PID: 734 (firewalld)
Tasks: 2
CGroup: /system.slice/firewalld.service
└─734 /usr/bin/python2 -Es /usr/sbin/firewalld --nofork --nopid
If the firewalld service is not running, there is no need to consider the following tactics.
To determine if firewalld is allowing traffic through a specific port:
$ sudo firewall-cmd --list-all
When firewalld is allowing traffic through a specific port, the output will resemble:
public (active) target: default icmp-block-inversion: no interfaces: enp0s3 sources: services: dhcpv6-client ssh ports: 2212/tcp protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules:
To open a hole in the firewall to allow traffic in or out of a port permitted by firewalld:
sudo firewall-cmd --add-port=2212/tcp
Consult the firewalld documentation for details on how firewalld (and iptables) operates and for additional commands to reverse changes made, to make additional changes, or to disable firewalld enforcement.