This page is still in process of translation.
firewalld Rich Language
摘要
本特性为firewalld增加了一种可以在不了解 iptables 语法的情况下很容易地创建复杂防火墙规则的富语言（高级语言）特性。
作者
- 姓名: Thomas Woerner
- Email: twoerner@redhat.com
Current status
- Targeted release: Fedora 19
- Last updated: 2013-06-12
- Percentage of completion: 100%
- The feature is limited to milestone 1 (base): configuration with files, no cli and no D-Bus interface
- Milestone 2 (D-BUS, command line client) has been added to Fedora 19 with version 0.3.3.
- Firewalld milestones for rich language and lockdown features, the milestones 1 is part of Fedora 19, milestone 2 (base and cli) will be provided as an update for F-19. Milestone 3 (gui) is planned for F-20.
- Milestone 1: Rich config language via config files; minimal lockdown ~ end of March
- Milestone 2: New config language via D-BUS interfaces with command line client ~ end of May
- Milestone 3: GUI ~ mid July
Detailed Description
Currently, complex firewall rules can only be added using the direct interface of firewalld. But this requires to know the syntax of iptables and the rules are not permanent.
With the rich language more complex firewall rules can be created in an easy to understand way. The language will use keywords with values and will be an abstract representation of ip*tables rules. Zones can be configured using this language, the current configuration will still be supported.
The configuration with files will be available for Fedora 19. The D-BUS interface with the command line client should be finished, but this depends on Fedora 19 schedule. UI work will most likely be available later (depends on Fedora 19 schedule also).
对Fedora的好处
更加强大易用的防火墙配置功能。
Scope
Only needs changes in firewalld and it's components.
How To Test
Create firewall rules using the rich language in services and zones. More to come.
用户体验
用户应该能轻易地创造出更加强大和稳定的防火墙配置。
依赖
无。
Contingency Plan
Disabling or reverting of the feature should be easy as it will be created as an addition to the current configuration. Only users of the new language will be affected.
Documentation
The rich language extends the current zone elements (service, port, icmp-block, masquerade and forward-port) with additional source and destination addresses, logging, actions and limits for logs and actions.
Handle rich rules with the command line client
firewall-cmd [--zone=<zone>] --add-rich-rule='<rule>' [--timeout=<seconds>]
Add rich language rule '<rule>' for zone <zone>. This option can be specified multiple times. If zone is omitted, the default zone will be used. To get the default zone use --get-default-zone. If a timeout is supplied, the <rule>(s) will be active for the amount of seconds and will be removed automatically afterwards.
firewall-cmd [--zone=<zone>] --remove-rich-rule='<rule>'
Remove rich language rule '<rule>' for zone <zone>. This option can be specified multiple times. If zone is omitted, the default zone will be used. To get the default zone use --get-default-zone.
firewall-cmd [--zone=<zone>] --query-rich-rule='<rule>'
Return whether a rich language rule '<rule>' has been added for the zone <zone>. If zone is omitted, the default zone will be used. There is no output. Returns 0 if true, 1 otherwise.
General rich rule structure
rule [family="<rule family>"] [ source address="<address>" [invert="True"] ] [ destination address="<address>" [invert="True"] ] [ <element> ] [ log [prefix="<prefix text>"] [level="<log level>"] ] [ audit type="<audit type>" ] <action>
A rule is part of a zone. A zone can contain several rules. If some rules interact/contradict, the first rule that matches the packet "wins". If the rule family is provided, it can be either "ipv4" or "ipv6", which limits the rule to IPv4 or IPv6. If the rule family is not provided, the rule will be added for IPv4 and IPv6. If source or destination addresses are used in a rule, then the rule family need to be provided. This is also the case for port/packet forwarding.
Source
With the source address the origin of a connection attempt can be limited to the source address. A source address or address range is either an IP address or a network IP address with a mask for IPv4 or IPv6. The network family (IPv4/IPv6) will be automatically discovered. For IPv4, the mask can be a network mask or a plain number. For IPv6 the mask is a plain number. The use of host names is not supported. It is possible to invert the sense of an address by adding invert="true" or invert="yes". All but the used address with match.
Destination
With the destination address the target can be limited to the destination address. The destination address is using the same syntax as the source address.
The use of source and destination addresses is optional and the use of a destination addresses is not possible with all elements. This depends on the use of destination addresses for example in service entries.
The element can be exactly one of the element types service, port, protocol, masquerade, icmp-block and forward-port.
Service
service name="<service name>"
The service <service name> will be added to the rule. The service name is one of the firewalld provided services. To get a list of the supported services, use firewall-cmd --get-services.
If a service provides a destination address, it will conflict with a destination address in the rule and will result in an error. The services using destination addresses internally are mostly services using multicast.
Port
port port="<port value>" protocol="tcp|udp"
The port <value> can either be a single port number or a port range <id>-<id>. The protocol can either be "tcp" or "udp".
Protocol
protocol value="<protocol value>"
The protocol value can be either a protocol id number or a protocol name. For allowed protocol entries, please have a look at /etc/protocols.
ICMP-Block
icmp-block name="<icmptype name>"
The icmptype is the one of the icmp types firewalld supports. To get a listing of supported icmp types: firewall-cmd --get-icmptypes
It is not allowed to specify an action here. icmp-block uses the action reject internally.
Masquerade
masquerade
Turn on masquerading in the rule. A source address can be provided to limit masquerading to this area, but not a destination address.
It is not allowed to specify an action here.
Forward-Port
forward-port port="<port value>" protocol="tcp|udp" to-port="<port value>" to-addr="<address>"
Forward port/packets from local port <value> with protocol "tcp" or "udp" to either another port locally or to another machine or to another port on another machine.
The port <value> can either be a single port number or a port range <id>-<id>. The destination address is a simple ip address.
It is not allowed to specify an action here. forward-port uses the action accept internally.
Log
Log new connection attempts to the rule with kernel logging for example in syslog. You can define a prefix text that will be added to the log message as a prefix. Log level can be one of "emerg", "alert", "crit", "err", "warn", "notice", "info" or "debug". The use of log is optional.
It is possible to limit logging:
log [prefix="<prefix text>"] [level="<log level>"] limit value="<rate/duration>"
The rate is a natural positive number [1, ..], the duration of of "s", "m", "h", "d". "s" means seconds, "m" minutes, "h" hours and "d" days. The maximum limit value is "1/d" which means at maximum one log entry per day.
Audit
Audit provides an alternative way for logging using audit records sent to the service auditd. The audit type can be one of "ACCEPT", "REJECT" or "DROP". The use of audit is optional.
Also audit can be limited using the limit tag.
Actions
An action can be one of accept, reject or drop.
The rule can either contain an element or also a source only. If the rule contains an element, then new connection matching the element will be handled with the action. If the rule does not contain an element, then everything from the source address will be handled with the action (requires firewalld version 0.3.1).
accept | reject [type="<reject type>"] | drop
With accept all new connection attempts will be granted. With reject they will not be accepted and there source will get a reject message. The reject type can be set to use an other value. With drop all packets will be dropped immediately, there is no information sent to the source.
Information about logging and actions
Logging can be done with the LOG and also with audit. A new chain is added to all zones: <zone>_log. This will be jumped into before the deny chain to be able to have a proper ordering.
The rules or parts of them are placed in separate chains according to the action of the rule:
<zone>_log <zone>_deny <zone>_allow
Then all logging rules will be placed in the <zone>_log chain, which will be walked first. All reject and drop rules will be placed in the <zone>_deny chain, which will be walked after the log chain. All accept rules will be placed in the <zone>_allow chain, which will be walked after the deny chain. If a rule contains log and also deny or allow actions, the parts are placed in the matching chains.
Examples
Example 1: Enable new IPv4 and IPv6 connections for protocol 'ah'
firewall-cmd --add-rich-rule='rule protocol value="ah" accept'
Example 2: Allow new IPv4 and IPv6 connections for service ftp and log 1 per minute using audit
firewall-cmd --add-rich-rule='rule service name="ftp" audit type="ACCEPT" limit value="1/m" audit accept'
Example 3: Allow new IPv4 connections from address 192.168.0.0/24 for service tftp and log 1 per minutes using syslog
firewall-cmd --add-rich-rule='rule family="ipv4" source address="192.168.0.0/24" service name="tftp" log prefix="tftp" level="info" limit value="1/m" accept'
Example 4: New IPv6 connections from 1:2:3:4:6:: to service radius are all rejected and logged at a rate of 3 per minute. New IPv6 connections from other sources are accepted.
firewall-cmd --add-rich-rule='rule family="ipv6" source address="1:2:3:4:6::" service name="radius" log prefix="dns" level="info" limit value="3/m" reject rule family="ipv6" service name="radius" accept'
Example 5: Forward IPv6 port/packets receiving from 1:2:3:4:6:: on port 4011 with protocol tcp to 1::2:3:4:7 on port 4012
firewall-cmd --add-rich-rule='rule family="ipv6" source address="1:2:3:4:6::" forward-port to-addr="1::2:3:4:7" to-port="4012" protocol="tcp" port="4011"'
Example 6: White-list source address to allow all connections from 192.168.2.2
firewall-cmd --add-rich-rule='rule family="ipv4" source address="192.168.2.2" accept'
Example 7: Black-list source address to reject all connections from 192.168.2.3
firewall-cmd --add-rich-rule='rule family="ipv4" source address="192.168.2.3" reject'
Example 8: Black-list source address to drop all connections from 192.168.2.4
firewall-cmd --add-rich-rule='rule family="ipv4" source address="192.168.2.4" drop'
With zone configuration file
The rich language extends the current zone elements (service, port, icmp-block, masquerade and forward-port) with additional source and destination addresses, logging, actions and limits for logs and actions.
General rule structure
<rule [family="<rule family>"]> [ <source address="<address>" [invert="True"]/> ] [ <destination address="<address>" [invert="True"]/> ] element [ <log [prefix="<prefix text>"] [level="<log level>"]/> ] [ <audit type="<audit type>"/> ] action </rule>
This <rule> element is part of <zone> element in a zone configuration file. There can be more rules (<rule> elements) in one zone. If some rules interact/contradict, the first rule that matches the packet "wins". If the rule family is provided, it can be either "ipv4" or "ipv6", which limits the rule to IPv4 or IPv6. If the rule family is not provided, the rule will be added for IPv4 and IPv6. If addresses are used in the rule, then the rule family need to be provided. This is the case if source or destination is used and also for port/packet forwarding.
Source and destination addresses
<source address="<address>" [invert="True"]> <destination address="<address>" [invert="True"]>
If source address is specified, the rule from element (see Elements section further down) is further restricted only to packets coming from this address. The same with destination address, i.e. if specified, it restricts the element only to packets with this destination address.
The address can be an ip address or an ip address with a mask, where mask can be either a plain number or for ipv4 also a network mask. The use of host names is not supported. The use of source and destination addresses is optional.
The use of destination addresses is not possible with all elements. This depends on the use of destination addresses for example in services.
It is also possible to invert the sense of an address by adding invert="True" or invert="yes". All but the used address with match.
Elements
The element can be exactly one of the element types service, port, protocol, masquerade, icmp-block and forward-port
Service
<service name="<service name>"/>
The service <service name> will be added to the rule. The service name is one of the firewalld provided services. To get a list of the supported services, use firewall-cmd --get-services.
If a service provides a destination address, it will conflict with a destination address in the rule and will result in an error. The services using destination addresses internally are mostly services using multicast.
Port
<port port="<port value>" protocol="tcp|udp"/>
The port <value> can either be a single port number or a port range <id>-<id>. The protocol can either be "tcp" or "udp".
Protocol
<protocol value="<protocol value>"/>
The protocol value can be either a protocol id number or a protocol name. For allowed protocol entries, please have a look at /etc/protocols.
ICMP-Block
<icmp-block name="<icmtype name>"/>
The icmptype is the one of the icmp types firewalld supports. To get a listing of supported icmp types: firewall-cmd --get-icmptypes
It is not allowed to specify an action here. icmp-block uses the action reject internally.
Masquerade
<masquerade/>
Turn on masquerading in the rule. A source address can be provided to limit masquerading to this area, but not a destination address.
It is not allowed to specify an action here.
Forward-Port
<forward-port port="<port value>" protocol="tcp|udp" to-port="<port value>" to-addr="<address>"/>
Forward port/packets from local port <value> with protocol "tcp" or "udp" to either another port locally or to another machine or to another port on another machine.
The port <value> can either be a single port number or a port range <id>-<id>. The destination address is a simple ip address.
It is not allowed to specify an action here. forward-port uses the action accept internally.
Log
Log new connection attempts to the rule with kernel logging for example in syslog. You can define a prefix text that will be added to the log message as a prefix. Log level can be one of "emerg", "alert", "crit", "err", "warn", "notice", "info" or "debug". The use of log is optional.
It is also possible to limit logging:
<log [prefix="<prefix text>"] [level="<log level>"]/> <limit value="<rate/duration>"/> </log>
The rate is a natural positive number [1, ..], the duration of of "s", "m", "h", "d". "s" means seconds, "m" minutes, "h" hours and "d" days. The maximum limit value is "1/d" which means at maximum one log entry per day.
Audit
Audit provides an alternative way for logging using audit records sent to the service auditd. The audit type can be one of "ACCEPT", "REJECT" or "DROP". The use of audit is optional.
Also audit can be limited using the limit tag.
Actions
An action can be one of accept, reject or drop.
The rule can either contain an element or also a source only. If the rule contains an element, then new connection matching the element will be handled with the action. If the rule does not contain an element, then everything from the source address will be handled with the action (requires firewalld version 0.3.1).
<accept/> <reject [type="<reject type>"]/> <drop>
With accept all new connection attempts will be granted. With reject they will not be accepted and there source will get a reject message. The reject type can be set to use an other value. With drop all packets will be dropped immediately, there is no information sent to the source.
Information about logging and actions
Logging can be done with the LOG and also with audit. A new chain is added to all zones: <zone>_log. This will be jumped into before the deny chain to be able to have a proper ordering.
The rules or parts of them are placed in separate chains according to the action of the rule:
<zone>_log <zone>_deny <zone>_allow
Then all logging rules will be placed in the <zone>_log chain, which will be walked first. All reject and drop rules will be placed in the <zone>_deny chain, which will be walked after the log chain. All accept rules will be placed in the <zone>_allow chain, which will be walked after the deny chain. If a rule contains log and also deny or allow actions, the parts are placed in the matching chains.
例子
例 1: 用协议“ah”建立新的IPv4和IPv6连接
<rule> <protocol value="ah"/> <accept/> </rule>
例 2: 允许ftp服务建立新的IPv4和IPv6连接，同时使用audit每分钟做1次记录
<rule>
<service name="ftp"/>
<audit type="ACCEPT">
<limit value="1/m"/>
</audit>
<accept/>
</rule>
例 3: 允许地址为192.168.0.0/24的tftp服务建立新IPv4连接，同时使用syslog每分钟做1次记录
<rule family="ipv4">
<source address="192.168.0.0/24"/>
<service name="tftp"/>
<log prefix="tftp" level="info">
<limit value="1/m"/>
</log>
<accept/>
</rule>
例 4: 拒绝所有1:2:3:4:6::的radius服务建立的新IPv6连接，同时以每分钟3次的频率进行记录。来自其他源头的新IPv6连接则可以接收。
<rule family="ipv6">
<source address="1:2:3:4:6::"/>
<service name="radius"/>
<log prefix="dns" level="info">
<limit value="3/m"/>
</log>
<reject/>
</rule>
<rule family="ipv6">
<service name="radius"/>
<accept/>
</rule>
例 5: 使用tcp协议将1:2:3:4:6::端口4011的所有IPv6的包转发至1::2:3:4:7的4012端口
<rule family="ipv6"> <source address="1:2:3:4:6::"/> <forward-port to-addr="1::2:3:4:7" to-port="4012" protocol="tcp" port="4011"/> </rule>
例 6: 源地址白名单，允许该源地址的所有连接
<rule family="ipv4"> <source address="192.168.2.2"/> <accept/> </rule>
发行记录
Fedora19已经包含最新的支持富语言的firewalld版本，它可以使用简便的途径来创造更加复杂的防火墙。