Dynamic Firewall with firewalld
Summary
This feature adds support for a dynamically managed firewall that is able to handle firewall changes without the need to rebuild the whole firewall. The firewall daemon manages the firewall and has a D-BUS interface to interact with clients or services, that request firewall changes.
The old static firewall model with system-config-firewall is too inflexible to support today's requirements of modern applications and use cases, for example virtualization or VPN.
Owner
- Name: Thomas Woerner
- email: twoerner@redhat.com
Current status
- Targeted release: Fedora 15
- Last updated: 2010-12-23
- Percentage of completion: 100%
Detailed Description
The firewalld package contains the proof of concept implementation of firewalld as a preview.
Why A Firewall Daemon
The current firewall model is static and every change requires a complete firewall restart. This includes also to unload the firewall netfilter kernel modules and to load the modules that are needed for the new configuration. The unload of the modules is breaking stateful firewalling and established connections.
The firewall daemon on the other hand manages the firewall dynamically and applies changes without restarting the whole firewall. Therefore there is no need to reload all firewall kernel modules. But using a firewall daemon requires that all firewall modifications are done with that daemon to make sure that the state in the daemon and the firewall in kernel are in sync. The firewall daemon can not parse firewall rules added by the ip*tables and ebtables command line tools.
The daemon provides information about the current active firewall settings via D-BUS and also accepts changes via D-BUS using PolicyKit authentication methods. SELinux access restrictions are also planned.
The Daemon
Applications, daemons and the user can request to enable a firewall feature over D-BUS. A feature could either be one of the predefined firewall features like services, port and protocol combinations, trusted interfaces/hosts/network areas, port/packet forwarding, masquerading, icmp blocking or even a custom rule. The feature can be enabled for a certain amount of time or can be disabled by again.
New chains for virtualization, network settings, services, ports, masquerading, port forwarding, icmp filtering and virtualization are added to make the firewall setup more flexible, safe and robust. Adding a rule with the firewall daemon to one of these chains will most likely not interefere with rules of other chains. The order of the chains and how they are used is fixed.
The netfilter firewall helpers, that are for example used for amanda, ftp, samba and tftp services, are also handled by the daemon as long as they are part of a predefined service. Loading of additional helpers is not part of the current interface. For some of the helpers onloading is only possible after all connections that are handled by the module are closed. Therefore connection tracking information is important here and needs to get into account.
Benefit to Fedora
The dynamic firewall mode will make it possible to change firewall settings without the need to restart the firewall and will make persistent connections possible.
This is for example very useful for services, that need to add additional firewall rules. libvirtd is one of them and also openvpn in the future. With the static firewall model these rules are lost if the firewall gets modified or restarted. The firewall daemon holds the current configuration internally and is able to modify the firewall without the need to recreate the complete firewall configuration; it is also able to restore the configuration in a service restart and reload case.
Another use case for the dynamic firewall mode is printer discovery. For this the discovery program will be started locally that sends out a broadcast message. It will most likely get an answer from an unknown address (the new printer). This answer will be filtered by the firewall, because the answer is not related to the broadcast and the port of the program that was sending out the message is dynamic and therefore a fixed rule can not be created for this. With the dynamic firewall mode a time limited rule could be requested by the discovery program to allow the receival of the answer.
Scope
The required change in system-config-firewall is a simple check for an active firewalld. This has already been added to system-config-firewall-1.2.28 in rawhide.
How To Test
- Install firewalld and firewall-applet
- Start the firewalld service
- Start the tray applet firewall-applet
- Use firewall-cmd to enable for example ssh:
firewall-cmd --add-service=ssh
- Enable samba for 10 seconds:
firewall-cmd --add-service=samba --timeout=10
- Enable ipp-client:
firewall-cmd --add-service=ipp-client
- Disable ipp-client:
firewall-cmd --remove-service=ipp-client
- To restore your static firewall with lokkit again simply use:
lokkit --enabled
You can also use the D-BUS interface directly. This is required for libvirt (and later on also NetworkManager).
User Experience
Connections will be persistent even after changing firewall settings using the firewall daemon.
Dependencies
- system-config-firewall (changes already in place)
- iptables (no changes needed)
Contingency Plan
The current static firewall will still be used as the default firewall solution. The firewall daemon service will be optional and not installed and not activated by default. Therefore there should be no problem by adding this feature.
Documentation
See https://fedoraproject.org/wiki/FirewallD/
The fedorahosted site is here: https://fedorahosted.org/firewalld/
Release Notes
Fedora 15 adds support for the optional firewall daemon, that provides a dynamic firewall management with a D-Bus interface.