The `firewall-cmd` command is a powerful tool for managing firewalls in Linux, particularly in systems that use the firewalld service. One of its most useful features is the ability to list the current firewall zones, which can help system administrators understand and manage their network security. The command `firewall-cmd list zone` is specifically designed for this purpose.
Before diving into the details, it's important to understand that firewalld uses the concept of zones to group similar network interfaces together. Each zone has its own set of rules that determine how traffic is handled. By listing the zones, you can gain a clear overview of your system's network security configuration.
Understanding Firewall Zones
Firewalld comes with several predefined zones, each with a specific set of rules. These include:
- drop: Drops all incoming and outgoing traffic.
- block: Blocks all incoming traffic, but allows outgoing traffic.
- public: Allows incoming traffic from trusted networks, like your home network.
- external: Similar to public, but for networks that are not fully trusted, like public Wi-Fi hotspots.
- internal: Allows incoming traffic from trusted internal networks, like a local area network (LAN).
- dmz: Allows incoming traffic from any network, useful for servers that need to be accessible from the internet.
- work: A zone suitable for work networks, allowing incoming traffic from trusted networks, but with more restrictive rules than public.
In addition to these predefined zones, you can also create your own custom zones with specific rules.
Listing Current Zones
To list the current firewall zones, simply run the command `firewall-cmd list zone` in your terminal. The output will display the name of each zone and its interface(s). For example:
$ firewall-cmd list zone public interfaces: eth0 sources: services: dhcpv6-client ports: protocols: forward ports: masquerade: no forward ports: source ports: icmp-blocks: rich rules:
This output shows that the `public` zone is currently active and is associated with the `eth0` interface.
Filtering Zone Information
You can also filter the output of `firewall-cmd list zone` to display specific information. For instance, to list only the interfaces associated with each zone, you can use the `--zone` option:
`firewall-cmd --zone=public list interfaces`
This command will display only the interfaces associated with the `public` zone.
Managing Firewall Zones
In addition to listing zones, `firewall-cmd` also allows you to manage them. You can add, remove, or modify zones, as well as assign interfaces to them.
Adding a New Zone
To create a new zone, use the `firewall-cmd --permanent --new-zone` command, followed by the name of the new zone. For example, to create a new zone called `myzone`, you would run:
`firewall-cmd --permanent --new-zone myzone`
After creating the zone, you can add rules to it using the `firewall-cmd --zone=myzone` command.
Assigning an Interface to a Zone
To assign an interface to a zone, use the `firewall-cmd --zone=myzone --change-interface=eth0` command. This will assign the `eth0` interface to the `myzone` zone.
Remember to reload the firewalld service for the changes to take effect. You can do this with the `firewall-cmd --reload` command.
Understanding and managing firewall zones is a crucial aspect of network security. The `firewall-cmd list zone` command is a powerful tool that can help you maintain a clear overview of your system's network security configuration. Whether you're a seasoned system administrator or just starting out, taking the time to learn and use this command can greatly enhance your ability to protect your Linux system.