documentation_complete: true

title: 'Inspect and Activate Default firewalld Rules'

description: |-
    Firewalls can be used to separate networks into different zones
    based on the level of trust the user has decided to place on the devices and
    traffic within that network. <tt>NetworkManager</tt> informs firewalld to which
    zone an interface belongs. An interface's assigned zone can be changed by
    <tt>NetworkManager</tt> or via the <tt>firewall-config</tt> tool.
    <br />
    The zone settings in <tt>/etc/firewalld/</tt> are a range of preset settings
    which can be quickly applied to a network interface. These are the zones
    provided by firewalld sorted according to the default trust level of the
    zones from untrusted to trusted:
    <ul>
    <li><tt>drop</tt><br /><p>Any incoming network packets are dropped, there is no
    reply. Only outgoing network connections are possible.</p></li>
    <li><tt>block</tt><br /><p>Any incoming network connections are rejected with an
    <tt>icmp-host-prohibited</tt> message for IPv4 and <tt>icmp6-adm-prohibited</tt>
    for IPv6. Only network connections initiated from within the system are
    possible.</p></li>
    <li><tt>public</tt><br /><p>For use in public areas. You do not trust the other
    computers on the network to not harm your computer. Only selected incoming
    connections are accepted.</p></li>
    <li><tt>external</tt><br /><p>For use on external networks with masquerading enabled
    especially for routers. You do not trust the other computers on the network to
    not harm your computer. Only selected incoming connections are accepted.</p></li>
    <li><tt>dmz</tt><br /><p>For computers in your demilitarized zone that are
    publicly-accessible with limited access to your internal network. Only selected
    incoming connections are accepted.</p></li>
    <li><tt>work</tt><br /><p>For use in work areas. You mostly trust the other computers
    on networks to not harm your computer. Only selected incoming connections are
    accepted.</p></li>
    <li><tt>home</tt><br /><p>For use in home areas. You mostly trust the other computers
    on networks to not harm your computer. Only selected incoming connections are
    accepted.</p></li>
    <li><tt>internal</tt><br /><p>For use on internal networks. You mostly trust the
    other computers on the networks to not harm your computer. Only selected
    incoming connections are accepted.</p></li>
    <li><tt>trusted</tt><br /><p>All network connections are accepted.</p></li>
    </ul>
    <br />
    It is possible to designate one of these zones to be the default zone. When
    interface connections are added to <tt>NetworkManager</tt>, they are assigned
    to the default zone. On installation, the default zone in firewalld is set to
    be the public zone.
    <br />
    To find out all the settings of a zone, for example the <tt>public zone,</tt>
    enter the following command as root:
    <pre># firewall-cmd --zone=public --list-all</pre>
    Example output of this command might look like the following:
    <pre>
    # firewall-cmd --zone=public --list-all
    public
      interfaces:
      services: mdns dhcpv6-client ssh
      ports:
      forward-ports:
      icmp-blocks: source-quench
    </pre>
    To view the network zones currently active, enter the following command as root:
    <pre># firewall-cmd --get-service</pre>
    The following listing displays the result of this command on common Red Hat
    Enterprise Linux 7 Server system:
    <pre>
    # firewall-cmd --get-service
    amanda-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns ftp
    high-availability http https imaps ipp ipp-client ipsec kerberos kpasswd
    ldap ldaps libvirt libvirt-tls mdns mountd ms-wbt mysql nfs ntp openvpn
    pmcd pmproxy pmwebapi pmwebapis pop3s postgresql proxy-dhcp radius rpc-bind
    samba samba-client smtp ssh telnet tftp tftp-client transmission-client
    vnc-server wbem-https
    </pre>
    Finally to view the network zones that will be active after the next firewalld
    service reload, enter the following command as root:
    <pre># firewall-cmd --get-service --permanent</pre>
