Firewalld
| Company type | Software |
|---|---|
| Industry | Computer software, Firewall |
| Founder | Eric Garver, Thomas Woerner, Red Hat, Inc. |
Area served | Linux operating systems |
| Products | Firewall management utility |
| Owner | Red Hat, Inc. |
| Parent | Red Hat, Inc. |
firewalld functions as a firewall management utility tailored for Linux operating systems, acting as a graphical interface to the Linux kernel's netfilter system. Its standard backend is nftables, which has replaced iptables since version 0.6.0. firewalld presents a command-line alternative to nft and iptables tools, adhering to Unix daemon naming practices.
Created by Eric Garver, Thomas Woerner, and Red Hat, Inc., firewalld is developed using the Python language. An intended transition to C++ was discontinued in 2015.
Features
Supporting both IPv4 and IPv6 protocols, firewalld manages distinct firewall zones that represent different trust levels through zone profiles. Although it does not independently switch zones based on network type, it works in conjunction with Network Manager to automatically select profiles depending on recognized Wi-Fi or Ethernet connections.
Its D-Bus interface allows applications and services to query and adjust firewall configurations. firewalld incorporates timed rules that limit total global connections but does not provide per-source IP rate limiting to defend against brute-force or distributed denial-of-service (DDoS) attacks.
The command-line interface offers granular control over rulesets, enabling specification by protocol, port numbers, source or destination addresses, or predefined service names. Its syntax is more elaborate compared to other iptables front-ends such as Ubuntu's Uncomplicated Firewall (ufw).
Services are described using XML files that define port and protocol associations, optionally including subnet restrictions and kernel module dependencies. This format resembles the structure of systemd service files; for instance, a web server operating on TCP port 443 would be represented as:
<syntaxhighlight lang="xml"> <?xml version="1.0" encoding="utf-8"?> <service>
<short>Web Server</short> <description>Public web host over HTTPS.</description> <port port="443" protocol="tcp" />
</service> </syntaxhighlight>
Forward and output filtering
With the release of firewalld version 0.9.0, native capabilities for forward and output filtering through policy objects were introduced. This feature facilitates traffic filtering between zones, supporting most firewalld elements such as services, ports, forward-ports, masquerading, and rich rules.
Limitations
By default, firewalld does not restrict outbound traffic in compliance with standards like NIST 800-171 and 800-53; nevertheless, outbound traffic control can be established via custom policy configurations.
Graphical front-ends (GUIs)
firewall-config serves as an optional GUI that encompasses the majority of firewalld’s functionality.
firewall-applet is a lightweight status tool optionally included to display firewall events and provide quick access to firewall-config. Originally built with GTK+, it was migrated to the Qt framework in 2015 after GNOME deprecated system tray icons.
Adoption
firewalld is included as the default firewall management tool in several leading Linux distributions, such as:
- CentOS version 7 and later
- Fedora starting from version 18
- OpenSUSE Leap 15 and onwards
- Red Hat Enterprise Linux from version 7 upwards
- SUSE Linux Enterprise 15 and newer
- EndeavourOS Apollo release and beyond
On these operating systems, firewalld is pre-activated, while it can also be found in the software repositories of other widely used distributions like Debian and Ubuntu.