Introduction
In this lab, you will explore Firewalld, a modern firewall management tool available on many Linux distributions.
A firewall controls which network traffic is allowed in or out of a system. Traditional packet-filtering rules can feel rigid to beginners. Firewalld adds a higher-level management model so administrators can adjust policy more safely and dynamically.
The core concept of Firewalld is zones. Zones let you apply different trust levels to different network interfaces or connections.
- Home Zone: Like your living room. You trust the people (devices) here, so the door is mostly open.
- Public Zone: Like a coffee shop. You don't trust the other people (devices) around you, so you lock your doors and only allow very specific interactions.
Firewalld allows you to assign different network connections (interfaces) to these zones.
By the end of this lab, you will be able to:
- Install and start the Firewalld service safely.
- Identify which security "Zones" are active.
- Look at the rules inside a zone.
- Move a network interface from one zone to another.
Install and Start Firewalld
In this step, you will install the Firewalld software and make sure it is running.
Critical Safety Step: In this remote lab environment, your connection to the terminal depends on the network being open. If we start the firewall with its default settings (usually "Public" or "Drop"), it might block your connection and lock you out immediately. To prevent this, we will explicitly configure Firewalld to use the "Trusted" zone for our connection.
This is an important operational lesson: firewall work is about reducing attack surface, but it can also cut off your own access if you change policy carelessly. Good administrators think about recovery and current access paths before they change network controls.
First, install the package.
sudo apt-get update
sudo systemctl mask firewalld
sudo apt-get install firewalld -y
Masking prevents package installation from automatically starting firewalld. Before starting the service, configure the trusted default zone and bind eth0 with firewall-offline-cmd. This client works while firewalld is stopped. Unmask the service only after these permanent management settings are saved.
sudo firewall-offline-cmd --set-default-zone=trusted
sudo firewall-offline-cmd --zone=trusted --add-interface=eth0
sudo systemctl unmask firewalld
sudo systemctl start firewalld
sudo firewall-cmd --reload
Enable the service to launch automatically on boot.
sudo systemctl enable firewalld
Finally, verify that Firewalld is running.
sudo firewall-cmd --state
You should see the output running.
Check Active Zones
In this step, now that Firewalld is running, let's look at Zones.
Zones are Firewalld's main abstraction layer. Instead of memorizing a giant flat list of packet rules, you group interfaces by trust level and let the zone express the baseline policy for that environment.
To see which zones are currently being used, run the following command.
sudo firewall-cmd --get-active-zones
Because we configured it in the previous step, you should see:
trusted
interfaces: eth0
This tells you:
- The trusted zone is active.
- The network interface eth0 (your main connection) is safely inside this zone.
If you are curious about what other zones exist, you can list all available zones.
sudo firewall-cmd --get-zones
This will show names like block, home, work, public, etc.
List Zone Configuration
In this step, you will inspect the detailed rules of the active zone.
This is where Firewalld starts to feel more concrete. A zone is not just a label like public or trusted; it is a bundle of real policy decisions such as default target, allowed services, ports, and forwarding behavior.
Use the --list-all option to see the full configuration of the current default zone (trusted).
sudo firewall-cmd --list-all
The output will display the configuration. For the trusted zone, the key field is:
- target:
ACCEPT. This means "Accept everything."
This confirms why your connection is safe.
If you want to peek at the rules for a different zone—for example, the public zone—you can specify the zone name.
sudo firewall-cmd --zone=public --list-all
You will see that the public zone is much more restrictive.
Change Interface Zone
In this step, now we want to practice moving an interface to a different zone.
Changing an interface's zone is really changing the trust classification of the traffic arriving on that interface. The same host can therefore behave differently on different networks without rewriting every rule from scratch.
Warning: If we moved our main interface eth0 to the work zone, we would be disconnected immediately because the work zone blocks our web terminal connection!
To practice safely, we will create a "dummy" (virtual) network interface and use that for our experiment.
First, create a dummy interface named dummy0.
sudo ip link add dummy0 type dummy
sudo ip link set dummy0 up
Add this interface to the public zone initially (just to give it a home).
sudo firewall-cmd --zone=public --add-interface=dummy0
Now, imagine dummy0 is your laptop's Wi-Fi card and you just walked into your office. You want to switch it to the work zone.
sudo firewall-cmd --zone=work --change-interface=dummy0
Verify the change.
sudo firewall-cmd --get-active-zones
You should now see two active zones:
- trusted: Containing
eth0(keeping you connected). - work: Containing
dummy0(your test interface).
trusted
interfaces: eth0
work
interfaces: dummy0
You have successfully learned how to change zones without locking yourself out!
Summary
In this lab, you have taken your first steps with Firewalld. You have:
- Installed the service and configured it safely to avoid lockout.
- Learned that Zones are like security profiles.
- Inspected the rules within a zone.
- Created a virtual interface and practiced switching it between zones.
Understanding zones is the foundation of Firewalld. In the next labs, you will learn how to customize these zones by opening specific ports.
