lollipopcloud/armbian/firewalld.md

FirewallD

AKA : firewall and routing. Let's make this a firewall/router!

Inspiration / Further Reading

• http://www.firewalld.org/
• http://www.firewalld.org/documentation/howto/add-a-service.html
• http://www.firewalld.org/documentation/howto/reload-firewalld.html
• https://www.certdepot.net/rhel7-get-started-firewalld/
• https://fedoramagazine.org/build-network-router-firewall-fedora-22-systemd-networkd/
• https://www.centos.org/forums/viewtopic.php?f=50&t=53819#p227743

Configure sysctl for routing purposes

Note: This was borrowed from the standard OpenWRT sysctl.conf

# Setup NAT/Forwarding/Routing sysctl config
cat > /etc/sysctl.d/20-routing.conf <<EOF
net.ipv4.conf.default.arp_ignore=1
net.ipv4.conf.all.arp_ignore=1
net.ipv4.ip_forward=1
net.ipv4.icmp_echo_ignore_broadcasts=1
net.ipv4.icmp_ignore_bogus_error_responses=1
net.ipv4.igmp_max_memberships=100
net.ipv4.tcp_fin_timeout=30
net.ipv4.tcp_keepalive_time=120
net.ipv4.tcp_syncookies=1
net.ipv4.tcp_timestamps=1
net.ipv4.tcp_sack=1
net.ipv4.tcp_dsack=1

net.ipv6.conf.default.forwarding=1
net.ipv6.conf.all.forwarding=1
EOF

# Apply configuration
sysctl -p

Setup FirewallD

apt update
apt install firewalld
systemctl enable firewalld
systemctl start firewalld

Verify Fundamentals

Run firewall-cmd --get-default-zone and make sure it returns public.

If not run:

firewall-cmd --set-default-zone=public
firewall-cmd --runtime-to-permanent
firewall-cmd --reload

Useful Commands

• firewall-cmd --state
• firewall-cmd --runtime-to-permanent
• firewall-cmd --reload
• firewall-cmd --get-default-zone
• firewall-cmd --get-active-zones
• firewall-cmd --get-zones
• firewall-cmd --info-zone=[aZone]
• firewall-cmd --permanent --zone=[aZone] --list-all
• firewall-cmd --get-zone-of-interface=[iface]
• firewall-cmd --get-log-denied
• firewall-cmd --set-log-denied all

Tweak NetworkManager Connection Zones

# Adjust interfaces from NetworkManager setup
firewall-cmd --permanent --zone=internal --change-interface=[wifi adapter for hot spots]
firewall-cmd --reload
nmcli connection modify wifi-ap-24 connection.zone internal
nmcli connection modify wifi-ap-50 connection.zone internal
nmcli connection modify mgmt connection.zone internal

# Verify zone configs
firewall-cmd --get-active-zones

Turn on Routing

firewall-cmd --permanent --zone=public --add-masquerade # Add NAT stuff for ipv4
firewall-cmd --permanent --query-masquerade # Make sure it's actually on
firewall-cmd --permanent --zone=internal --add-source=172.16.16.0/24
firewall-cmd --permanent --zone=internal --add-source=172.17.17.0/24
firewall-cmd --permanent --zone=internal --add-source=172.18.18.0/24
firewall-cmd --permanent --zone=internal --add-service dns --add-service dhcp
firewall-cmd --reload

Other Useful Commands

Odds and ends for setting up services and the like. You can probably ignore this section. Breadcrumbs for the author really.

firewall-cmd --permanent --zone=trusted --add-source=192.168.2.0/24
firewall-cmd --zone=internal --add-service=ssh --permanent
firewall-cmd --zone=internal --add-service={ssh,http,https,dns}
firewall-cmd --permanent --zone=public --add-port=80/tcp
firewall-cmd --permanent --zone=public --add-forward-port=port=22:proto=tcp:toport=3753:toaddr=10.0.0.1