firewalld / firewalld.github.io

source code for https://firewalld.org

FirewallD - A firewall daemon with D-Bus interface providing a dynamic firewall

firewalld provides a dynamically managed firewall with support for network or firewall zones to define the trust level of network connections or interfaces. It has support for IPv4, IPv6 firewall settings and for ethernet bridges and a separation of runtime and permanent configuration options. It also provides an interface for services or applications to add ip*tables and ebtables rules directly.

Development

To check out the source repository, you can use:

git clone https://github.com/firewalld/firewalld.git

This will create a local copy of the repository.

The contributor code of conduct can be found in CODE_OF_CONDUCT.md

Language Translations

Firewalld uses GNU gettext for localization support. Translations can be done using Fedora's Weblate instance. Translations are periodically merged into the main firewalld repository.

Dependencies

These are the runtime dependencies:

  linux >= 5.3
  python >= 3.7
  python3-dbus
  python3-gobject
  python3-nftables >= 0.9.4

Note: python2 is not supported.

Optional Dependencies

These dependencies may enhance firewalld's functionality, but they are not required.

  ebtables
  ipset
  iptables
  polkit
  python3-capng (libcap-ng-python3)

Working With The Source Repository

In addition to the runtime dependencies some others are needed to build from source:

  desktop-file-utils: /usr/bin/desktop-file-install
  gettext
  intltool
  glib2: /usr/bin/glib-compile-schemas
  glib2-devel: /usr/share/aclocal/gsettings.m4
  systemd-units
  pytest

To be able to create man pages and documentation from docbook files:

  docbook-style-xsl
  libxslt

Use the usual autoconf/automake incantation to generate makefiles

./autogen.sh
./configure

You can use a specific python interpreter by passing the PYTHON variable. This is also used by the testsuite.

./configure PYTHON=/path/to/python3

Use

make

to create the documentation and to update the po files.

Use

make check

to run the testsuite. Tests are run inside network namespaces and do not interfere with the host's running firewalld. They can also be run in parallel by passing flags to autotest.

make check TESTSUITEFLAGS="-j4"

The testsuite also uses keywords to allow running a subset of tests that exercise a specific area. For example:

make check TESTSUITEFLAGS="-k rich -j4"

Output:

  24: rich rules audit                                ok
  25: rich rules priority                             ok
  26: rich rules bad                                  ok
  53: rich rules audit                                ok
  23: rich rules good                                 ok
  55: rich rules bad                                  ok
  74: remove forward-port after reload                ok

You can get a list of tests and keywords

make -C src/tests check TESTSUITEFLAGS="-l"

Or just the keywords

make -C src/tests check TESTSUITEFLAGS="-l" \
  |awk '/^[[:space:]]*[[:digit:]]+/{getline; print $0}' \
  |tr ' ' '\n' |sort |uniq

There are integration tests. Currently this includes NetworkManager. These may be destructive to the host. Run them in a disposable VM or container.

make check-integration

There is also a check-container target that will run the testsuite inside various podman/docker containers. This is useful for coverage of multiple distributions. It also runs tests that may be destructive to the host such as integration tests.

make check-container TESTSUITEFLAGS="-j4"

OCI Container Image

As part of the dist build target an OCI container image is generated. This is distributed alongside the normal release tarball. It can be used to run firewalld from a container. The containerized firewalld will not integrate with the host (e.g. podman, libvirt, NetworkManager).

To manually load the container image into your environment:

podman load -i .../path/to/firewalld-oci-<ver>.tar

To fetch the image from quay.io:

podman pull quay.io/firewalld/firewalld:<ver>

where <ver> is optional, the latest version will be used if omitted.

To start the daemon/container:

podman run -d --network host --privileged \
              --name my-firewalld firewalld

Firewalld's configuration will live inside the container. Therefore users may want to occasionally podman commit the image.

Using firewalld's CLI should be done via podman exec after the daemon/container has been started:

podman exec my-firewalld firewall-cmd ...

Container Integration with Host

The same container image can be used to integrate with the host's running NetworkManager, podman, libvirt, etc. This requires the host to have a dbus policy for firewalld.

A dbus policy can be obtained from the firewalld source code tree at location config/FirewallD.conf.

cp config/FirewallD.conf /usr/share/dbus-1/system.d/FirewallD.conf

Once the dbus policy is in place the container could be started as such:

podman run -d -v /run/dbus/system_bus_socket:/run/dbus/system_bus_socket \
              --network host --privileged \
              --name my-firewalld firewalld \
              firewalld --nofork --nopid

The only addition are: volume mount, explicit CMD.

The some approach can be use to store firewalld's configuration files on the host.

podman run -d -v /run/dbus/system_bus_socket:/run/dbus/system_bus_socket \
              -v /etc/firewalld:/etc/firewalld \
              --network host --privileged \
              --name my-firewalld firewalld \
              firewalld --nofork --nopid

RPM package

For Fedora and RHEL based distributions, there is a spec file in the source repo named firewalld.spec. This should be usable for Fedora versions >= 16 and RHEL >= 7.

Links

Homepage: http://firewalld.org

Report a bug: https://github.com/firewalld/firewalld/issues

Git repo browser: https://github.com/firewalld/firewalld

Git repo: https://github.com/firewalld/firewalld.git

Documentation: http://firewalld.org/documentation/

Mailing lists

For usage: https://lists.fedorahosted.org/archives/list/[email protected]/

For development: https://lists.fedorahosted.org/archives/list/[email protected]/

Directory Structure

Directory	Content
config/	Configuration files
config/icmptypes/	Predefined ICMP types
config/services/	Predefined services
config/xmlschema/	XML Schema checks for config files
config/zones/	Predefined zones
config/ipsets/	Predefined ipsets
doc/	Documentation
doc/man/	Base directory for man pages
doc/man/man1/	Man(1) pages
doc/man/man5/	Man(5) pages
po/	Translations
shell-completion/	Base directory for auto completion scripts
src/	Source tree
src/firewall/	Import tree for the service and all applications
src/icons/	Icons in the sizes: 16, 22, 24, 32, 48 and scalable
src/tests/	Testsuite

firewalld.github.io's Issues

Why is there a proprietary "All rights reserved" footer?

firewalld.github.io/_includes/footer.html

Line 4 in b083879

Copyright © 2016 firewalld. All Rights Reserved.

Please, add some link to the LICENSE file to emphasize that documentation is Unlicensed. Otherwise, people could get (and do get) confused.

Documentation still mentioning "ifcfg" which was deprecated in Fedora 33.

Upcoming Fedora 41 will drop support for ifcfg configuration files:

• in Fedora 33, the default connection format was changed from ifcfg to keyfile;
• in Fedora 36, the plugin that handles ifcfg files was shipped in a separate package and was not included in new installations;
• since Fedora 39, the NetworkManager daemon automatically migrates ifcfg files to the keyfile format.
• Fedora 41 - support for connection profiles stored in ifcfg format in NetworkManager will be removed.

One of the locations where ifcfg is mentioned is documentation/zone/connections-interfaces-and-sources.md

Smail typo error on main Home page

In file index.md, you can find the misspelled word 'evaulation' iso evaluation.

Undocumented feature - Source

HUMP! I go to the documentation page at - https://firewalld.org/documentation/zone/connections-interfaces-and-sources.html titled Connections, Interfaces and Sources to understand what sources are, how to managed and configure them, etc., and find that there is NOT ONE WORD about them except to mention them as a feature. How in the world did this page get put up on your website without any oversight or editorializing?

Typo on https://firewalld.org/documentation/configuration/directories.html

On https://firewalld.org/documentation/configuration/directories.html , near the bottom of the page:

"If there is no /etc/firewalld directory of if it there is no configuration in there, firewalld will start using the default configuration and default settings for firewalld.conf."

Probably should read:

"If there is no /etc/firewalld directory or if there is no configuration in there, firewalld will start using the default configuration and default settings for firewalld.conf."

Incorrect <link rel="canonical" ...> in documentation

HTML markup on documentation pages contains incorrect <link rel="canonical" ...> elements:

curl -s  'https://firewalld.org/documentation/' | grep 'link rel="canonical"'
  <link rel="canonical" href="/documentation/">
<link rel="canonical" href="firewalld.github.io/documentation/" />

1. There should be just one canonical link.
2. Second link is treated as relative to https://firewalld.org/documentation/, so https://firewalld.org/documentation/firewalld.github.io/documentation/ is certainly an error. Likely, having a dedicated domain, you do not want to consider github.io is the primary location.

Perhaps the theme used to generate documentation should be fixed to avoid github.io links.

Typo in documentation

As reported in firewalld/firewalld#222 by @bltnkl.

--->8---

http://www.firewalld.org/documentation/configuration/runtime-versus-permanent.html
Has typo in the last sentence:
"If the firewall setup is not working, a simple firewalld reload/restart will reapply the workgin permanent configuration." - workING, not workGIN.

http://www.firewalld.org/documentation/utilities/firewall-applet.html
Has typo in the last sentence in "firewall-applet" titled paragraph:
"The applet has ben ported over to Qt4 as the StatusIcon support in Gtk3 has been deprecated." - "has BEEN", not "has BEN".

http://www.firewalld.org/documentation/zone/options.html
Has typo in paragraph describing "service" tag:
"The name of the service to be enabled. To get a list of valid service names firewall-cmd --list=services can be used." - "--list-services", not '--list=services".

http://www.firewalld.org/documentation/zone/options.html
Has typo in paragraph describing "icmp-block" tag:
"The name of the Internet Control Message Protocol (ICMP) type to be blocked. To get a list of valid ICMP types firewall-cmd --list=icmptypes can be used." - "--list-icmptypes", not "--list=icmptypes".

http://www.firewalld.org/documentation/zone/options.html
Has redundancy in parahraph describing "forward-port" tag:
"The destination IPv4 IP address." - "IPv4 address", not "IPv4 IP address".

http://www.firewalld.org/documentation/zone/options.html
Has typo in the very last sentence on the page:
"For a full description on rich language rules, please have a look at firewalld.richlanguage(5)." - "description OF", not "description ON".

http://www.firewalld.org/documentation/service/options.html and in several other pages describing options:
Has too much lax register in the paragraph titled "Options":
"The config can contain these tags and attributes. " - "service configuration file", not "config".

http://www.firewalld.org/documentation/service/options.html
Has typo in the paragraph describing "short" tag:
"Is an optional start and end tag and is used to give a ervice a more readable name." - "service", not "ervice".

http://www.firewalld.org/documentation/howto/open-a-port-or-service.html
Has typo in the last sentence of the paragraph titled "How to open port 80/tcp with firewall-cmd:":
"This means the port will be open also after a system reboot or firewalld serice reload." - "service", not "serice".

http://www.firewalld.org/documentation/howto/add-a-service.html
"There are different ways to a add a new service. A new service will only be visible in the runtime environment after it has been added. To be able to use it also in the run time environment, you need to reload firewalld." - seems that it should be:
"There are different ways to a add a new service. A new service will only be visible in the PERMANENT environment after it has been added. To be able to use it also in the RUNTIME environment, you need to reload firewalld."

http://www.firewalld.org/documentation/howto/add-a-service.html
"This adds a new service using all settings from the file including the servie name.", should be:
"This adds a new service using all settings from the file including the serviCe name."

http://www.firewalld.org/documentation/howto/add-a-service.html
"The original service will be effective in the run time environment only after a reload.", should
be: "The original service will be effective in the ruNTime environment only after reload."
"A package that is placing the service in the /usr/lib/firewalld/services diretory should require the firewalld package or sub package that is providing the path.", should be:
"A package that PLACES the service in the /usr/lib/firewalld/services direCtory should require the firewalld package or suBPackage that is providing the path."

http://www.firewalld.org/documentation/howto/debug-firewalld.html
"This file does not exist in all distributions. In Fedora or RHEL based distributions it usable:", should be:
"This file does not exist in all distributions. In Fedora or RHEL based distributions it IS usable:"

Thanks.

Features: "Applet using Qt4" - you may want to update that.

I know the code has been updated to use Qt5 and you really should update the web site/page to reflect that.

website: chore: automate updates of man pages

Usually it's done manually after the latest release.

Updating the man pages

Hello. Could the man pages be updated? When reading the docs on the website and clicking through to the man pages I didn't realize they weren't automatically kept up to date. I found some errors that I was going to fix, but on looking at the man pages in the firewalld repo it seems they were fixed already.

Maybe incorrect title on service example

In the examples section of service there is an example currently labeled 'ipset', but description, ports, and protocols of the example are for 'ipsec'. I am guessing there was a typo at some point?

https://github.com/firewalld/firewalld.github.io/blob/master/documentation/service/examples.md