mikaela.github.io/n/firewalld.md

2.2 KiB
Raw Blame History

Quick note on firewalld usage

This is practically /ufw, but fore Firewalld which Fedora comes with. The blog post also predates me having a /n directory here.

After done, run sudo firewall-cmd --reload

Zones

firewalld zones are privilege of NetworkManager users, this tends to be a systemd-networkd household. Then again I dont believe in absolutely trusted zones.

Zone would be specified by --zone=home in the commands. The other zone I could imagine using is public.

Protocols

sudo firewall-cmd --add-protocol=ipv6-icmp --permanent

Services

sudo firewall-cmd --add-service=ssh --permanent
sudo firewall-cmd --add-service=mosh --permanent
sudo firewall-cmd --add-service=ntp --permanent
sudo firewall-cmd --add-service=syncthing --permanent
sudo firewall-cmd --add-service=mdns --permanent
  • I trust Chrony (ntp) to not allow it to be used from outside of LAN as firewalld is apparently not designed with limiting source addresses in mind.
  • syncthing is the client, not to be confused with syncthing-gui or syncthing-relay.

Ports

sudo firewall-cmd --permanent --add-port=9001/udp
sudo firewall-cmd --permanent --add-port=6771/udp
  • 9001/udp is Yggdrasil automatic peering, although link-local and unlikely to be recognised by predefined rules.
  • 6771/udp is Bittorrent Local Peer Discovery