Introduction to firewalld in RHEL 7

Overview

Figure The Firewall Stack https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Using_Firewalls.html

firewall-cmd

Everything in firewalld are organized in zones.

--list-all-zones	List everything for every zones.
--get-active-zones	Print currently active zones altogether with interfaces and sources used in these zones.
--get-default-zone	Print default zone for connections and interfaces.
--set-default-zone=<ZONE>	Set default zone for connections and interfaces.
--add-source= [--zone=<ZONE>]	Bind source to zone.
--remove-source= [--zone=<ZONE>]	Unbind source to zone.
--add-interface= [--zone=<ZONE>]	Bind interface to zone.
--change-interface= [--zone=<ZONE>]	Bind interface to different zone.

Comments for zones from RHEL 7 Security Guide Using Firewalls.

public	For use in public areas. You do not trust the other computers on the network to not harm your computer. Only selected incoming connections are accepted.
external	For use on external networks with masquerading enabled especially for routers. You do not trust the other computers on the network to not harm your computer. Only selected incoming connections are accepted.
dmz	For computers in your demilitarized zone that are publicly-accessible with limited access to your internal network. Only selected incoming connections are accepted.
work	For use in work areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.
home	For use in home areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.
internal	For use on internal networks. You mostly trust the other computers on the networks to not harm your computer. Only selected incoming connections are accepted.
trusted	All network connections are accepted.

Below are commands to alter firewall. All command are only added in runtime and first adding options --permanent while it be written to disk and made permanent.

--get-services	List all predefined services.
--add-service= [--zone=<ZONE>]	Open/allow traffic to service.
--remove-service= [--zone=<ZONE>]	Remove/deny traffic to serice
--add-port= [--zone=<ZONE>]	Open/allow traffic on port and protocol.
--remove-port= [--zone=<ZONE>]	Remove/deny on port and protocol.
--reload	Reload persistent rules from /usr/lib/firewalld/ and /etc/firewalld/.

Examples

firewall-cmd --set-default-zone=dmz
firewall-cmd --permanent --zone=internal --add-source=192.168.0.0/24
firewall-cmd --permanent --zone=internal --add-service=mysql
firewall-cmd --reload