How to Set Up a Firewall with FirewallD on CentOS 7

HTTP is the protocol used to serve Web pages. If you plan to make your Web server publicly available, enable this option. This option is not required for viewing pages locally or developing Web pages.protocol="tcp"port="80"/>CopyTo allow incoming HTTP traffic (port 80) for interfaces in the public zone, only for the current session (runtime configuration) type:
To verify that the service was added successfully use the --list-services flag:
If you want to keep the port 80 open after a reboot you’ll need to type the same command once again but this time with the --permanent flag:
Use the --list-services along with the --permanent flag to verify your changes:
The syntax for removing a service is same as when adding a service. Just use --remove-service instead of the --add-service flag:
The command above will remove the http service from the public zone permanent configuration.
What if you are running an application such as Plex Media Server for which there is no appropriate service available?
In cases like these you have two options. You can either open up the appropriate ports or define a new FirewallD service.
For example, the Plex Server listens on port 32400 and uses TCP, to open the port in the public zone for the current session use the --add-port= flag:
To verify that the port was added successfully use the --list-ports flag:
To keep the port 32400 open after a reboot add the rule to the permanent settings by running the same command using the --permanent flag.
The syntax for removing a port is same as when adding a port. Just use --remove-port instead of the --add-port flag.

Creating a new FirewallD Service

As we have already mentioned, the default services are stored in the /usr/lib/firewalld/services directory. The easiest way to create a new service is to copy an existing service file to the /etc/firewalld/services directory which is the location for user created services and modify the file settings.
For example, to create a service definition for the Plex Media Server we can use the HTTP service file:
Open the newly created plexmediaserver.xml file and change the short name and description for the service within the and tags. The most important tag you need to change is the port tag which define the port number and protocol you want to open. In the following example we are opening 1900 UDP and 32400 TCP ports.
Plex is a streaming media server that brings all your video, music and photo collections together and stream them to your devices at anytime and from anywhere.protocol="udp"port="1900"/>protocol="tcp"port="32400"/>CopySave the file and reload the FirewallD service:
You can now use the plexmediaserver service in your zones same as any other service..

Forwarding Port with Firewalld

To forward traffic from one port to another port or address, first enable masquerading for the desired zone using the --add-masquerade switch. For example to enable masquerading for external zone type:

• Forward traffic from one port to another on the same server

In the following example we are forwarding the traffic from port 80 to port 8080 on the same server:

• Forward traffic to another server

In the following example we are forwarding the traffic from port 80 to port 80 on a server with IP 10.10.10.2:

• Forward traffic to another server on a different port

In the following example we are forwarding the traffic from port 80 to port 8080 on a server with IP 10.10.10.2:
If you want to make the forward permanent just append the --permanent flag.

Creating a Ruleset with FirewallD

In the following example we will show you how to configure your firewall if you were running a web server. We are assuming that your server has only one interface eth0, and you want to allow incoming traffic only on SSH, HTTP and HTTPS ports.

1. Change the default zone to dmz
   We will use the dmz (demilitarized) zone because by default it only allows SSH traffic. To change the default zone to dmz and to assign it to the eth0 interface run the following commands:
   

   sudo firewall-cmd --set-default-zone=dmz
   sudo firewall-cmd --zone=dmz --add-interface=eth0

   Copy
2. Open HTTP and HTTPS ports:
   To open HTTP and HTTPS ports add permanent service rules to the dmz zone:
   

   sudo firewall-cmd --permanent --zone=dmz --add-service=http
   sudo firewall-cmd --permanent --zone=dmz --add-service=https

   Copy
   Make the changes effective immediately by reloading the firewall:
   

   sudo firewall-cmd --reload

   Copy
3. Verify the changes
   To check the dmz zone configuration settings type:
   

   sudo firewall-cmd --zone=dmz --list-all
   

   dmz (active)
     target: default
     icmp-block-inversion: no
     interfaces: eth0
     sources:
     services: ssh http https
     ports:
     protocols:
     masquerade: no
     forward-ports:
     source-ports:
     icmp-blocks:
     rich rules:

   Copy
   The output above tells us that the dmz is the default zone, is applied to the eth0 interface and ssh (22) http (80) and https (443) ports are open.

Conclusion

You have learned how to configure and manage the FirewallD service on your CentOS system.
Be sure to allow all incoming connections that are necessary for proper functioning of you system, while limiting all unnecessary connections.
If you have questions feel free to leave a comment below.