How to Check Firewall Status in Linux: A Step-by-Step Guide

In today’s Linux ecosystem, having a robust and active firewall is fundamental to our system’s security. To check the firewall status in Linux, use the firewall-cmd --state command or, for a quick overview, systemctl status firewalld. Knowing how to verify the firewall’s status ensures that our defenses are up and running without a hitch.

Given the variety of Linux distributions out there, from Ubuntu to Fedora, each has its own methods, yet they all revolve around ensuring that the host-based firewall is actively protecting our systems. Whether we’re using the graphical firewall-config tool or terminal commands, the goal is the same: check and manage our firewall settings efficiently.

Using open-source tools like firewalld, we’ll discover multiple ways to ensure the firewall daemon is running smoothly. Adding our firsthand experiences, we find that keeping this aspect of our Linux systems in check isn’t just a routine task but a crucial part of maintaining optimal security.

Setting Up Firewalld on Linux

Setting up firewalld involves installing and enabling the service, understanding zones and services, configuring rules and ports, and managing commands with firewall-cmd.

Installation and Enabling Firewalld

First, we need to install firewalld. On most distributions like CentOS, Fedora, or Red Hat, it’s straightforward. Debian-based systems like Ubuntu require an additional step:

sudo yum install firewalld   # CentOS, Fedora, Red Hat
sudo apt install firewalld   # Ubuntu, Debian

After installing, we enable and start the service using systemctl:

sudo systemctl enable firewalld       # Enables firewalld to start on boot
sudo systemctl start firewalld        # Starts the firewalld service
sudo systemctl status firewalld       # Checks the firewalld status

An active status confirms that firewalld is running correctly.

Understanding Firewalld Zones and Services

Firewalld uses zones to define trust levels for network connections. Each zone comes with pre-configured rules.

• Public: Typical for standard desktop internet use.
• Block: Restricts all incoming network connections.
• Internal: Suitable for more trusted internal networks.

To view active zones and associated interfaces:

firewall-cmd --get-active-zones

Services are predefined rules for common applications like HTTP or SSH. To list available services:

sudo firewall-cmd --get-services

Using these, we can tailor our firewall to suit different needs and security requirements.

Configuring Firewalld Rules and Ports

Rules and policies are at the core of firewalld’s configuration. Adding services and opening ports ensures we can allow specific traffic through our firewall.

To allow HTTP traffic, we add the service to the zone:

sudo firewall-cmd --zone=public --add-service=http --permanent
sudo firewall-cmd --reload       # Applies the changes

For custom port configurations:

sudo firewall-cmd --zone=public --add-port=8080/tcp --permanent
sudo firewall-cmd --reload

Reloading the firewalld applies changes without restarting the service, avoiding disruptions.

Managing Firewall-Cmd Commands

The firewall-cmd command-line tool is essential for managing firewalld. It offers flexibility and precision.

• To check firewalld state:

sudo firewall-cmd --state

• List all rules:

sudo firewall-cmd --list-all

• View specific settings in a zone:

sudo firewall-cmd --zone=public --list-all

Firewalld logs provide valuable insights for troubleshooting. We can access them with:

sudo journalctl -u firewalld

Remember, comprehensive firewall rules enhance the security of our systems while allowing necessary traffic. Proper management of firewalld commands ensures smooth operations.

Advanced Firewalld Features

Exploring advanced firewalld features enables us to configure more granular control and implement complex network functionalities such as masquerading and forwarding. This enhances our network security and management.

Using Rich Rules for Granular Control

Rich rules provide advanced options and fine-grained controls over traffic handling. We can use them to allow or deny traffic based on specific criteria such as IP address, port, or even time of day.

To create a rich rule, use the firewall-cmd command:

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.100" port port="22" protocol="tcp" accept'

This rule allows SSH traffic from a specific IP. Rich rules can also incorporate conditions like logging or limits, adding robust flexibility to our firewall setup. Here’s how we can log traffic:

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" log prefix="SSH Access: " level="info" accept'

Rich rules make it possible to address very particular networking needs, granting us the power to closely manage our network’s behavior.

Implementing Masquerading and Forwarding

Masquerading and forwarding help devices in our network to communicate with external networks. This is essential for setting up NAT (Network Address Translation) or routing traffic between different subnets.

To enable masquerading on a zone, run:

sudo firewall-cmd --zone=public --add-masquerade --permanent

This hides internal IP addresses when making requests to the external network. It’s a common methodology for sharing a single public IP address among multiple devices.

For forwarding, we may set up port forwarding to direct incoming traffic on specific ports to designated servers. For example, to forward HTTP traffic to an internal web server:

sudo firewall-cmd --permanent --add-forward-port=port=80:proto=tcp:toport=8080:toaddr=192.168.1.2

These features significantly enhance our firewall’s capabilities, catering to complex network topologies and requirements. By implementing these options, we can efficiently manage traffic and ensure secure, reliable network operations.

Troubleshooting and Maintaining Firewalld

Monitoring and maintaining Firewalld involves regularly checking its status and logs, as well as restoring default settings when necessary. These practices ensure that your firewall remains effective and secure.

Monitoring Firewalld Status and Logs

Monitoring the status of Firewalld is essential. We can check its status using the systemctl status firewalld command. This shows if the service is active or inactive.

To see live logs and get more details, use firewall-cmd --state for a quick check, or firewall-cmd --list-all to list all current settings. For deeper log analysis, journalctl -u firewalld provides a history of logs, which is useful for troubleshooting.

Pro Tip: Use grep with journalctl to search for specific events. For instance, journalctl -u firewalld | grep "error" helps locate errors swiftly.

Restoring Default Settings and Configurations

If configurations get scrambled, restoring defaults may save the day. To reset the entire Firewalld configuration, run firewall-cmd --complete-reload. This command reloads all settings from scratch.

In case we need to roll things back more conservatively, the default configurations stored in XML files under /etc/firewalld/ come in handy. Manually copying these XML files can restore specific zones or services without affecting the whole setup.

For those who prefer a GUI, the firewall-config tool offers a graphical interface to adjust settings easily and switch zones, reducing the risk of manual errors.

Restoring to default settings using firewall-config:

1. Open firewall-config.
2. Select the zone to reset.
3. Click Options –> Reset to Defaults.

Tip: Always back up your current settings before making changes. Use firewall-cmd --runtime-to-permanent to save the current runtime configuration.