How to Install Firewalld on a VPS

By Robert Mills

Simplifying the process on firewall and its security is become hectic process due to the wide level configuration and setup involved on each port, network filter and Iptables. To simply the process, many linux based operating systems use Firewalld as front-end manager. When install Firewalld in the server, it allows administrators to easily manage the firewall rules, control network traffic and iptables without interrupting existing connections.

In this article, we will guide you with the Installation for various Linux distributions, Basic Configurations and useful commands after the Installation on VPS server.

What is Firewalld?

Firewalld is a dynamic firewall manager for linux based on zone based rules to set trust level in network connections. Through zone-based rules, control network traffic, it let you handle rules easily while acting as a smart security and user friendly for administrators.

Prerequisites:

• Access your VPS via SSH using a non-root user with sudo privileges. Update package lists to avoid conflicts:

sudo apt update

• If UFW is installed, disable it to make Firewalld your primary firewall:

sudo ufw disable

Install Firewalld for Various Linux distributions:

1. Debian / Ubuntu:

sudo apt -y install firewalld

2. CentOS / Fedora

sudo yum install firewalld

3. Arch / Manjaro

sudo pacman -S firewalld

4. Gentoo

emerge net-firewall/firewalld

Basic Configuration When Install Firewalld:

Step 1: Enable the firewall

sudo systemctl enable firewalld

Step 2: Ensure the firewall is running

sudo sudo firewall-cmd –state

Step 3: Set the default zone to “public” for VPS

sudo firewall-cmd --set-default-zone=public

Step 4: Allow essential services with the specified port numbers to be permanently allowed through the firewall.

• SSH

sudo firewall-cmd --permanent --add-service=ssh

• Http

sudo firewall-cmd --permanent --add-service=http

• Https

sudo firewall-cmd --permanent --add-service=https

You can also allow it through the port number:

• SSH

sudo firewall-cmd --permanent --add-port=22/tcp

• Http

sudo firewall-cmd --permanent --add-port=80/tcp

• Https

sudo firewall-cmd --permanent --add-port=443/tcp

Note – Run the command one by one

Step 5: Reload Firewalld to apply your changes:

sudo firewall-cmd –reload

Step 6: Ensure the changes were applied

sudo firewall-cmd --list-services

Verification and Useful Commands After Installation:

1. Enhanced Monitoring Commands:

• Follow live logs

sudo journalctl -u firewalld -f

• List zones with interfaces

sudo firewall-cmd --get-active-zones

• Show all zone configurations

sudo firewall-cmd --list-all-zones

• Details on specific zone

sudo firewall-cmd --info-zone=public

2. Allowing & Blocking and Security Rules:

• Allow single IP [ Allowing the IP and adding it to the trusted zone]

sudo firewall-cmd --permanent --zone=trusted --add-source=203.0.113.5

• Add single IP [ Allowing the IP with Range]

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="66.249.64.0/19" accept'

• Block single IP [ Blocking the IP and adding it to the block zone]

sudo firewall-cmd --permanent --zone=block --add-rich-rule='rule family="ipv4" source address="192.168.1.1" reject'

• Add single IP [ Blocking the IP with Range]

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="66.249.64.0/19" reject'

View All the Details:

firewall-cmd --list-all

To check blocked and allowed Ips [ Run the command based on the zone]

• Allowed Ips

sudo firewall-cmd --zone=trusted --list-sources

• Blocked IPs [ Run the command based on the zone]

sudo firewall-cmd --zone=drop --list-sources

sudo firewall-cmd --zone=block --list-sources

Note – If the zone name changes, change it accordingly as per the zone name

• Block subnet (silent drop)

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/24" drop'

• Log + reject

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.5" log prefix="BLOCKED: " reject'

3. Quick Status Checks:

• Running/Not Running

sudo firewall-cmd --state

• Current default

sudo firewall-cmd --get-default-zone

4. Allow a Specific Port for a Specific IP Only (Rich Rule)

sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="203.0.113.5" port protocol="tcp" port="8080" accept'

NOTE: Every time you run the command with –permanent flag, the rule is saved to the configuration files on disk but not applied to the running firewall. We need to run sudo firewall-cmd –reload to apply all saved –permanent changes to the active configuration.

Hope this knowledge allows you to configure and install firewalld successfully in your linux server ensuring high level of security and easy customization complex ruleset.