141 lines
3.7 KiB
Text
141 lines
3.7 KiB
Text
= Linux and PF firewalls commands cheat sheet
|
|
:homepage: https://yurisk.info
|
|
:toc:
|
|
Author: Yuri Slobodyanyuk, https://www.linkedin.com/in/yurislobodyanyuk/
|
|
|
|
== Firewalld daemon management (Red Hat based distributions)
|
|
|
|
=== Enable, disable, reload the daemon
|
|
[cols=2, options="header"]
|
|
|===
|
|
|Command
|
|
|Description
|
|
|
|
|*systemctl disable/enable firewalld*
|
|
|Disable/enable firewalld, survives reboot.
|
|
|
|
|*systemctl stop firewalld*
|
|
|Stop firewalld until started manually or reboot.
|
|
|
|
|
|
|*firewall-cmd --reload*
|
|
|Reload firewall rules to make your changes active, keeping the state table. Active sessions do not disconnect. On finishing reload will output `success`.
|
|
|
|
|*systemctl restart firewalld*
|
|
|Restart the daemon, without resetting the active connections. Use in case of
|
|
problems with the daemon.
|
|
|
|
|*firewall-cmd --complete-reload*
|
|
|Reload firewall completely, disconnecting the active connections. When nothing
|
|
else helps.
|
|
|
|
|
|
|
|
|
|
|===
|
|
=== List rules, status, additional info
|
|
|
|
[cols=2, options="header"]
|
|
|===
|
|
|Command
|
|
|Description
|
|
|
|
|*firewall-cmd --state*
|
|
|Show firewall daemon status
|
|
|
|
|*firewall-cmd --list-all*
|
|
|List currently active rules
|
|
|
|
|
|
|*firewall-cmd --get-default-zone*
|
|
| Show the default zone for interfaces.
|
|
|
|
|*firewall-cmd --get-zones*
|
|
|List all available zones
|
|
|
|
|*firewall-cmd --get-active-zones*
|
|
| Show active zones, including to which zone each interface belongs.
|
|
|
|
|*firewall-cmd --list-all-zones*
|
|
|List all zones with their rules and associated interfaces.
|
|
|
|
|*firewall-cmd --add-service <service name>*
|
|
|Add predefined service by name to the default zone, with action ACCEPT, e.g. `firewall-cmd -add-service ftp` .
|
|
|
|
|
|
|===
|
|
|
|
=== Open, close ports
|
|
|
|
[cols=2, options="header"]
|
|
|===
|
|
|Command
|
|
|Description
|
|
|
|
|*firewall-cmd --add-port=_port-number_/_protocol_*
|
|
|Open in incoming _port-number_ of the _protocol_. E.g. open incoming to TCP port
|
|
5900 from any: `firewall-cmd --add-port=5900/tcp`
|
|
|
|
|
|
|*firewall-cmd --remove-port=_port-number_/_protocol_*
|
|
|Close the open _port-number_. E.g. close the open port 5900/tcp: `firewall-cmd --remove-port=5900/tcp`
|
|
|
|
|*firewall-cmd --runtime-to-permanent*
|
|
|Make the changed rules permanent to survive reboot.
|
|
|
|
|===
|
|
|
|
== Ubuntu Uncomplicated Firewall (ufw)
|
|
.ufw management commands
|
|
[cols=2, options="header"]
|
|
|===
|
|
|Command
|
|
|Description
|
|
|
|
|*ufw status*
|
|
|Show whether the firewall is on and if on, list the active rules.
|
|
|
|
|*ufw enable*
|
|
|Enable firewall.
|
|
|
|
|*ufw disable*
|
|
|Disable firewall
|
|
|
|
|*ufw reload*
|
|
|Reload firewall and rules.
|
|
|
|
|*ufw allow <predefined service name>*
|
|
| Allow some service in any direction from/to any IP address using so called `simple` rule syntax. The service names are as per `/etc/services`. E.g. to allow ssh from any: `ufw allow ssh`.
|
|
|
|
|*/etc/ufw/before.rules*
|
|
|Some rules are pre-allowed by default, to change them edit this file and reload the firewall.
|
|
|
|
|===
|
|
|
|
|
|
== PF (Packet Filter) management for FreeBSD & OpenBSD
|
|
|
|
[cols=2, options="header"]
|
|
|===
|
|
|Command
|
|
|Description
|
|
|
|
|*pfct -d*
|
|
|Disable PF in place, does not survive reboot.
|
|
|
|
|*pfctl -ef /etc/pf.conf*
|
|
|Enable PF and load the rule set from file `/etc/pf.conf` in one go.
|
|
|
|
|*pfctl -nf /etc/pf.conf*
|
|
|Parse security rules stored in a file without installing them (dry run).
|
|
|
|
|*pass in quick on egress from 62.13.77.141 to any*
|
|
| 'Quick' rule (means allows this traffic on all interfaces, otherwise we would need 2nd rule allowing this traffic in _outgoing_ direction on egress interface) to allow incoming ANY port/protocol with the source being `62.13.77.141` and destination being ANY IP address behind the PF firewall. NOTE: here, `egress` is not a direction, but a group name to which the interface in question (`em0`) belongs to. In OpenBSD you set it in a file `/etc/hostname.em0: group egress` or in real-time with the command: `ifconfig em0 group egress`.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|===
|
|
|