I am new to Centos 7/Server management. I am trying to figure out how to work with firewalld. my kernel release is: 2.6.32-042stab084.20(OpenVZ)
#firewall-cmd --version #0.3.9
The problem is I can't get any functionality out of firewall-cmd. Here is some of commands I have tried:
# systemctl status firewalld -l firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled) Active: active (running) since ...; Main PID: 120 CGroup: /system.slice/firewalld.service └─120 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid systemd: Starting firewalld - dynamic firewall daemon... systemd: Started firewalld - dynamic firewall daemon. firewalld: ERROR: ebtables not usable, disabling ethernet bridge firewall. firewalld: ERROR: INVALID_ZONE
It seems that firewalld is running, and actually it is doing its job as a firewall. but when I try to use firewall-cmd:
# firewall-cmd --state not running #firewall-cmd --get-zones #[nothing happens] #firewall-cmd --reload [X]Server crashed and I had to request a reboot!
I have installed fail2ban and it works by adding IPs to banned list which I can view by: iptables -L -n.
# iptables -V #iptables v1.4.21 # iptables -nvL Chain INPUT (policy ACCEPT 798 packets, 89141 bytes) pkts bytes target prot opt in out source destination 76260 14M f2b-SSH tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 69823 14M f2b-sshd tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 22 Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 725 packets, 113K bytes) pkts bytes target prot opt in out source destination Chain INPUT_ZONES (0 references) pkts bytes target prot opt in out source destination Chain INPUT_ZONES_SOURCE (0 references) pkts bytes target prot opt in out source destination Chain INPUT_direct (0 references) pkts bytes target prot opt in out source destination Chain f2b-SSH (1 references) pkts bytes target prot opt in out source destination 17 1060 REJECT all -- * * 111.222.333.444 0.0.0.0/0 reject-with icmp-port-unreachable ... ...
But now I want to open a specific port for an application and I can't use firewall-cmd. So what can I do?
- P.S: The reason I changed my firewall client to firewalld and disabled iptables service was that fail2ban didn't work with iptables. It just sat there and did nothing.But that's another problem!