Additional Firewall-Cmd Commands

# Basic firewall-cmd setups

sudo firewall-cmd --zone=public --add-port=22/tcp --permanent
sudo firewall-cmd --zone=public --add-port=80/tcp --permanent
sudo firewall-cmd --zone=public --add-port=443/tcp --permanent
sudo firewall-cmd --zone=public --add-port=8080/tcp --permanent
sudo firewall-cmd --zone=public --add-port=10000/tcp --permanent
sudo firewall-cmd --reload

# Query Firewall Settings

firewall-cmd --list-all
firewall-cmd --list-all-zones
firewall-cmd --get-default-zone
firewall-cmd --get-active-zones
firewall-cmd --list-services
firewall-cmd --list-ports
firewall-cmd --zone=public --list-services
firewall-cmd --zone=internal --list-services

# Add Permanently to Public Zone

sudo firewall-cmd --permanent --zone=public --add-service=http --add-service=https sudo firewall-cmd --reload

1. Add Temporarily to Internal Zone

firewall-cmd --zone=internal --add-service=ssh firewall-cmd --zone=internal --add-source=154.160.26.149/16 firewall-cmd --zone=internal --add-source=102.176.65.133/16 firewall-cmd --zone=public --remove-service=ssh firewall-cmd --zone=public --remove-port=22/tcp

1. Commit Temporary Changes Permanently

firewall-cmd --runtime-to-permanent

1. Remove an IP from Allowed IPs

firewall-cmd --zone=internal --remove-source=102.176.65.133/16

1. DOCKER FIREWALLD
2. Masquerading allows for docker ingress and egress (this is the juicy bit)

firewall-cmd --zone=public --add-masquerade --permanent

1. Specifically allow incoming traffic on port 80/443 (nothing new here)

firewall-cmd --zone=public --add-port=80/tcp firewall-cmd --zone=public --add-port=443/tcp

1. Reload firewall to apply permanent rules

firewall-cmd --reload

1. docker firewalld 2
2. Check what interface docker is using, e.g. 'docker0'

ip link show

1. Check available firewalld zones, e.g. 'public'

sudo firewall-cmd --get-active-zones

1. Check what zone the docker interface it bound to, most likely 'no zone' yet

sudo firewall-cmd --get-zone-of-interface=docker0

1. So add the 'docker0' interface to the 'public' zone. Changes will be visible only after firewalld reload

sudo nmcli connection modify docker0 connection.zone public

1. Masquerading allows for docker ingress and egress (this is the juicy bit)

sudo firewall-cmd --zone=public --add-masquerade --permanent

1. Optional open required incomming ports (wasn't required in my tests)
2. sudo firewall-cmd --zone=public --add-port=443/tcp
3. Reload firewalld

sudo firewall-cmd --reload

1. Reload dockerd

sudo systemctl restart docker