Firewalld List Zones

In the realm of network security, firewalls play a pivotal role in controlling incoming and outgoing network traffic based on predetermined security rules. One of the most powerful and flexible firewall management tools in Linux is firewalld, which uses zones to define the trust level of network interfaces. Understanding how to list these zones is a fundamental step in configuring and managing your firewall effectively.

Firewalld's zones allow you to create different security profiles for various network interfaces or subnets. By listing these zones, you gain a clear overview of your network's security architecture, enabling you to make informed decisions about your firewall configuration.

Understanding Firewalld Zones

Before diving into listing zones, it's crucial to grasp the concept of firewalld zones. Zones represent a predefined set of rules that determine how your firewall behaves. They are categorized based on the level of trust assigned to the network traffic, ranging from highly trusted to highly distrusted.

Firewalld comes with several predefined zones, including home, internal, external, dmz, public, and work. You can also create custom zones tailored to your specific network requirements.

Predefined Zones

Firewalld includes several predefined zones to cater to common network scenarios. Here's a brief overview of each:

• home: Intended for private networks where all devices are trusted, such as your home network.
• internal: Suitable for trusted networks within an organization, like a local area network (LAN).
• external: Designed for untrusted networks, such as the internet. This zone is typically used for the public interface of your network.
• dmz: Short for Demilitarized Zone, this zone is used for exposing services to the internet while still providing some level of protection.
• public: Similar to external, but intended for public networks where you might have guest users, like a hotel or café Wi-Fi.
• work: A zone for trusted networks outside your organization, such as a partner's or client's network.

Custom Zones

In addition to the predefined zones, firewalld allows you to create custom zones to cater to specific network scenarios. Custom zones provide the flexibility to define your own set of rules, enabling you to fine-tune your firewall's behavior according to your organization's security policies.

To create a custom zone, you can use the `firewall-cmd --permanent --new-zone=` command, replacing `` with the desired name for your custom zone. After creating the zone, you can configure its rules using the `firewall-cmd --permanent --zone= --add-service=` command, where `` is the service you want to allow or block.

Listing Firewalld Zones

Now that you have a solid understanding of firewalld zones, let's explore how to list them using the command line. Listing zones is an essential task that helps you keep track of your firewall's configuration and ensures that your network interfaces are assigned to the correct zones.

Firewalld provides two primary commands to list zones: `firewall-cmd --get-zones` and `firewall-cmd --list-all-zones`. Both commands display a list of available zones, but they differ in the level of detail provided.

Listing Available Zones

The `firewall-cmd --get-zones` command displays a simple list of all available zones, including both predefined and custom zones. This command is useful for quickly checking the names of your zones without additional information.

Here's an example of the output you might see when running this command:

home
internal
external
dmz
public
work
my_custom_zone

Listing Zone Details

For a more comprehensive view of your zones, you can use the `firewall-cmd --list-all-zones` command. This command provides detailed information about each zone, including its target, services, ports, and masquerade settings.

Here's an example of the output you might see when running this command:

home (active)
  target: ACCEPT
  icmp-block-inversion: no
  services: dhcpv6-client https ssh
  ports: 22/tcp 53/udp 53/tcp 67/udp
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

internal (active)
  target: ACCEPT
  icmp-block-inversion: no
  services: dhcpv6-client https ssh
  ports: 22/tcp 53/udp 53/tcp 67/udp
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

external (active)
  target: default
  icmp-block-inversion: no
  services: dhcpv6-client ssh
  ports: 22/tcp 53/udp 53/tcp 67/udp
  masquerade: yes
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

dmz (active)
  target: ACCEPT
  icmp-block-inversion: no
  services: dhcpv6-client http https ssh
  ports: 22/tcp 53/udp 53/tcp 67/udp 80/tcp 443/tcp
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

public (active)
  target: default
  icmp-block-inversion: no
  services: dhcpv6-client ssh
  ports: 22/tcp 53/udp 53/tcp 67/udp
  masquerade: yes
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

work (active)
  target: default
  icmp-block-inversion: no
  services: dhcpv6-client ssh
  ports: 22/tcp 53/udp 53/tcp 67/udp
  masquerade: yes
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

my_custom_zone (active)
  target: default
  icmp-block-inversion: no
  services: ssh
  ports: 22/tcp
  masquerade: yes
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

By examining the output of `firewall-cmd --list-all-zones`, you can gain valuable insights into your firewall's configuration, helping you make informed decisions about your network's security.

In the dynamic landscape of network security, it's essential to stay proactive and vigilant. Regularly listing and reviewing your firewalld zones is a critical step in maintaining a robust and secure network infrastructure. By understanding and managing your zones effectively, you can protect your organization from potential threats and ensure compliance with industry best practices.