Firewalld Basic Internal & Public Zone Configuration

1. Installation

Enterprise Linux (RHEL/CentOS/Fedora/Rocky/Alma) has firewalld installed by default.

To install on Debian, run:

apt install firewall
systemctl enable firewalld
systemctl start firewalld

2. Configure Private and Link-Local IP Sets

2.1. Create IPv4 Private Addressing IP Set

firewall-cmd --permanent --new-ipset=private-v4 --type=hash:net --family=inet
firewall-cmd --permanent --ipset=private-v4 --set-short="RFC1918"
firewall-cmd --permanent --ipset=private-v4 --set-description="RFC1918 Addresses"
firewall-cmd --permanent --ipset=private-v4 --add-entry=10.0.0.0/8
firewall-cmd --permanent --ipset=private-v4 --add-entry=172.16.0.0/12
firewall-cmd --permanent --ipset=private-v4 --add-entry=192.168.0.0/16

2.2. Create IPv6 Private Addressing IP Set

firewall-cmd --permanent --new-ipset=private-v6 --type=hash:net --family=inet6
firewall-cmd --permanent --ipset=private-v6 --set-short="ULA"
firewall-cmd --permanent --ipset=private-v6 --set-description="Unique Local Addresses"
firewall-cmd --permanent --ipset=private-v6 --add-entry=fc00::/7

2.3. Create IPv4 Link-Local Addressing IP Set

firewall-cmd --permanent --new-ipset=link-local-v4 --type=hash:net --family=inet
firewall-cmd --permanent --ipset=link-local-v4 --set-short="Link Local"
firewall-cmd --permanent --ipset=link-local-v4 --set-description="Link Local Addresses"
firewall-cmd --permanent --ipset=link-local-v4 --add-entry=169.254.0.0/16

2.4. Create IPv6 Link-Local Addressing IP Set

firewall-cmd --permanent --new-ipset=link-local-v6 --type=hash:net --family=inet6
firewall-cmd --permanent --ipset=link-local-v6 --set-short="Link Local"
firewall-cmd --permanent --ipset=link-local-v6 --set-description="Link Local Addresses"
firewall-cmd --permanent --ipset=link-local-v6 --add-entry=fe80::/10

3. Configure the Internal Zone

3.1. Add Private and Link-Local Sources

firewall-cmd --permanent --zone=internal --add-source=ipset:private-v4
firewall-cmd --permanent --zone=internal --add-source=ipset:private-v6
firewall-cmd --permanent --zone=internal --add-source=ipset:link-local-v4
firewall-cmd --permanent --zone=internal --add-source=ipset:link-local-v6

3.2. Add Private Services

firewall-cmd --permanent --zone=internal --add-service=ssh
firewall-cmd --permanent --zone=internal --add-service=cockpit

4. Configure the Public Zone

4.1. Add the Interface

4.1.1. With Network Manager

nmcli connection modify <interface> connection.zone public
systemctl restart NetworkManager

4.1.2. Statically

firewall-cmd --permanent --zone=public --add-interface=<interface>

4.2. Set to Drop Instead of Reject

firewall-cmd --permanent --zone=public --set-target=DROP

4.3. Allow Ping (optional)

firewall-cmd --permanent --zone=public --add-icmp-block-inversion
firewall-cmd --permanent --zone=public --add-icmp-block=echo-request

4.4. Remove Private Services

firewall-cmd --permanent --zone=public --remove-service=ssh
firewall-cmd --permanent --zone=public --remove-service=cockpit

5. Verify Zone Configuration

firewall-cmd --permanent --info-zone=internal
firewall-cmd --permanent --info-zone=public

6. Apply Configuration and Verify Zone Assignments

firewall-cmd --reload
firewall-cmd --get-active-zones