Firewalls

systemctl show --property=Conflicts firewalld
Conflicts=ipset.service iptables.service shutdown.target ebtables.service ip6tables.service nftables.service

# start the service
systemctl enable --now firewalld

# check status
systemctl status firewalld

# restart
systemctl restart firewalld

# make runtime commands permanent
firewall-cmd --runtime-to-permanent

# make individual rules permanent
firewall-cmd <command> --permanent

ls -A1 /usr/lib/firewalld/zones/
block.xml       # accepts only traffic that originated on the system
dmz.xml         # similar to public but used in location's demilitarized zone, with limited access to internal network
drop.xml        # drops all incoming network packets and only allows outbound network connections
external.xml    # similar to public but used on external networks
home.xml        # similar to work but used in home setting where other network systems are trusted
internal.xml    # similar to work but used on internal networks where other network systems are trusted
nm-shared.xml   # ???
public.xml      # accepts only selected network connections
trusted.xml     # accepts all network connections
work.xml        # accepts only selected network connections

ls -1 /usr/lib/firewalld/services/
amanda-client.xml
amanda-k5-client.xml
amqps.xml
amqp.xml
apcupsd.xml
...

# get zones
firewall-cmd --get-zones
block dmz drop external home internal nm-shared public trusted work

# get default zone
firewall-cmd --get-default-zone
public

# set default zone
firewall-cmd --set-default-zone=home
success
firewall-cmd --get-default-zone
home


# get active zones and traffic grouping
firewall-cmd --get-active-zones
public
  interfaces: enp0s3

# get services
firewall-cmd --get-services
RH-Satellite-6 RH-Satellite-6-capsule amanda-client amanda-k5-client amqp amqps apcupsd audit bacula bacula-client bb bgp
...

# get services by zone
firewall-cmd --list-services --zone=dmz
ssh

# assign service to zone
firewall-cmd --add-service=<service> --zone=<zone>

# disable all network traffic
firewall-cmd --panic-on

# re-enable all network traffic
firewall-cmd --panic-off

iptables [OPTION]
-L [chain] # list rules for the chain, all rules if no chain
-S [chain] # list rules details for the chain, all rules details if no chain
[-t table] # apply command to table. If no table, applied to filter table
-A chain rule #  add this new rule to this chain
-I chain index rule # insert this new rule to this chain at this index location
-D chain rule # delete this rule from this chain
-R chain index rule # remove this rule from this chain at this index location
-F [chain] # remove (flush) all rules from this chain
-P chain policy # sets as default this policy for this chain

# common options
-d address # apply rule to packets w dest address  
-s address # apply rule to packets w source address
-i name # apply rule to packets coming through name network interface
-o name # apply rule to packets going out through name network interface
-p protocol # apply rule to packets using this protocol
-j target   # apply the target action to the selected packets
            # target values:
            # ACCEPT
            # DROP
            # REJECT
# list all rules
iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination 

# list nft tables
nft list tables
table ip filter
table ip6 filter
table bridge filter
table ip security
table ip raw
table ip mangle
table ip nat
table ip6 security
table ip6 raw
table ip6 mangle
table ip6 nat
table bridge nat
table inet firewalld
table ip firewalld
table ip6 firewalld

# add new table
nft add table ip rocky

# view table
nft list table ip rocky
table ip rocky {
}

# create a chain that contains the rules for firewall definition
nft 'add chain ip rocky test { type filter hook input priority 0; policy drop; }'

# allow incoming traffic on port 443
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# start and set to start at boot
ufw enable

# stop and disable at boot
ufw disable

# disable and reset to system default
ufw reset

# reload service (not necessary, changes automatically take effect)
ufw reload

# get current state
ufw status [verbose]

# verbose status to figure out configuration
ufw status verbose
Status: active      # active or disabled, both on boot
Logging: on (low)   # off, low, medium, high, full. low is default
Default: deny (incoming), allow (outgoing), disabled (routed)   # default policies for packets
New profiles: skip  # accept, drop, reject, or skip. default policy for automatically loading new profiles.

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    Anywhere                  
22/tcp (OpenSSH)           ALLOW IN    Anywhere                  
22/tcp (v6)                ALLOW IN    Anywhere (v6)             
22/tcp (OpenSSH (v6))      ALLOW IN    Anywhere (v6)

# default policy location
cat /etc/default/ufw 
# /etc/default/ufw
#

# Set to yes to apply rules to support IPv6 (no means only IPv6 on loopback
# accepted). You will need to 'disable' and then 'enable' the firewall for
# the changes to take affect.
IPV6=yes

# Set the default input policy to ACCEPT, DROP, or REJECT. Please note that if
# you change this you will most likely want to adjust your rules.
DEFAULT_INPUT_POLICY="DROP"
...

# add ACL rule
ufw allow 22/tcp

# check status
ufw status

ufw deny from 192.168.0.0/24 to any port 80


ufw show added

# deny packets access to port 80 from this class C subnet
sudo ufw deny from 192.168.0.0/24 to any port 80
Rule added

# confirm  
sudo ufw show added
Added user rules (see 'ufw status' for running firewall):
ufw allow 22/tcp
ufw allow OpenSSH
ufw deny from 192.168.0.0/24 to any port 80

# view rules
ls /etc/ufw/
after6.rules  after.rules     before6.rules  before.rules  ufw.conf     user.rules
after.init    applications.d  before.init    sysctl.conf   user6.rules

# get rule number (to delete rule)
ufw status numbered
Status: active

     To                         Action      From
     --                         ------      ----
[ 1] 22/tcp                     ALLOW IN    Anywhere                  
[ 2] OpenSSH                    ALLOW IN    Anywhere                  
[ 3] 80                         DENY IN     192.168.0.0/24            
[ 4] 22/tcp (v6)                ALLOW IN    Anywhere (v6)             
[ 5] OpenSSH (v6)               ALLOW IN    Anywhere (v6)             

# delete the rule by number
ufw delete 3
Deleting:
 deny from 192.168.0.0/24 to any port 80
Proceed with operation (y|n)? y
Rule deleted

# view profile for apps or daemons
ls -1 /etc/ufw/applications.d/
cups
openssh-server

# view profile for apps or daemons with ufw
ufw app list
Available applications:
  CUPS
  OpenSSH

# get application details
ufw app info OpenSSH
Profile: OpenSSH
Title: Secure shell server, an rshd replacement
Description: OpenSSH is a free implementation of the Secure Shell protocol.

Port:
  22/tcp

# add new or update existing profile
ufw app update all
Rules updated for profile 'OpenSSH'
Skipped reloading firewall

# set kernel properties
sysctl -w net.ipv4.ip_forward=1
sysctl -w net.ipv6.conf.all.forwarding=1

# verify changes
cat /proc/sys/net/ipv4/ip_forward
0
cat /proc/sys/net/ipv6/conf/all/forwarding 
0

# check routing table
ip route list
default via 10.0.2.2 dev enp0s3 proto dhcp metric 100 
10.0.2.0/24 dev enp0s3 proto kernel scope link src 10.0.2.15 metric 100 
169.254.0.0/16 dev enp0s3 scope link metric 1000