From Fedora Project Wiki
No edit summary |
No edit summary |
||
| Line 4: | Line 4: | ||
This could be useful if a user doesn't want to use the concept of (pre-)defined services, but wants to directly use ''iptables/ip6tables/ebtables''. | This could be useful if a user doesn't want to use the concept of (pre-)defined services, but wants to directly use ''iptables/ip6tables/ebtables''. | ||
''Firewalld'' still tracks what's been added, so it's possible to query firewalld. | ''Firewalld'' still tracks what's been added, so it's possible to query firewalld. | ||
= How to test = | = How to test = | ||
| Line 30: | Line 28: | ||
firewall-cmd --direct --remove-rule ipv4 filter IN_ZONE_public_allow -m tcp -p tcp --dport 666 -j ACCEPT | firewall-cmd --direct --remove-rule ipv4 filter IN_ZONE_public_allow -m tcp -p tcp --dport 666 -j ACCEPT | ||
For more examples see also [http://fedoraproject.org/wiki/FirewallD#Direct_options http://fedoraproject.org/wiki/FirewallD] | |||
Revision as of 17:21, 11 December 2012
Description
Firewalld has a so called direct interface, which enables to more directly pass rules to iptables/ip6tables/ebtables. This could be useful if a user doesn't want to use the concept of (pre-)defined services, but wants to directly use iptables/ip6tables/ebtables. Firewalld still tracks what's been added, so it's possible to query firewalld.
How to test
example:
Adding a custom rule to IN_ZONE_public_allow chain
firewall-cmd --direct --add-rule ipv4 filter IN_ZONE_public_allow 0 -m tcp -p tcp --dport 666 -j ACCEPT
Query if that rule exists
firewall-cmd --direct --query-rule ipv4 filter IN_ZONE_public_allow -m tcp -p tcp --dport 666 -j ACCEPT; echo $?
expected result: 0
Get rules
firewall-cmd --direct --get-rules ipv4 filter IN_ZONE_public_allow
expected result: -m tcp -p tcp --dport 666 -j ACCEPT
Remove the rule
firewall-cmd --direct --remove-rule ipv4 filter IN_ZONE_public_allow -m tcp -p tcp --dport 666 -j ACCEPT
For more examples see also http://fedoraproject.org/wiki/FirewallD