TencentOS Server provides three firewall management tools: firewalld, iptables, and nftables. firewalld is the default recommended advanced firewall management tool. iptables is a traditional firewall tool. nftables is a next-generation firewall framework that will gradually replace iptables.
firewalld
Zones
The following are predefined zones in firewalld:
drop: The policy of this zone is to deny all incoming packets without sending any response. This is the strictest security policy.
block: This zone also denies all incoming packets, but sends an error response to the sender.
public: This zone is intended for public networks. It allows certain incoming connections but still maintains a high security policy.
external: This zone is intended for external networks, such as routers connected to the Internet. It typically enables masquerading to support network address translation.
internal: This zone is intended for internal networks, such as a corporate LAN. It allows more incoming connections but still maintains a certain security policy.
dmz: This zone is intended for a demilitarized zone, a buffer area set up between the internal and external networks. It allows certain incoming connections but limits access to the internal network.
work: This zone is intended for work environments. It allows more incoming connections but still maintains a certain security policy.
home: This zone is intended for home networks. It allows more incoming connections but still maintains a certain security policy.
trusted: The policy of this zone is to allow all incoming and outgoing packets. This is the most permissive security policy.
firewalld Installation
Install firewalld using dnf:
sudo dnf install firewalld
firewalld Configuration
firewalld provides two configuration commands:
When the firewalld service is not running, use firewall-offline-cmd to modify the firewall configuration. The added configuration is permanent and persists after a restart.
When the firewalld service is running, use firewall-cmd to modify the firewall configuration. The added configuration is temporary by default. To save rules permanently to the firewall configuration file, use the --permanent parameter, and then run firewall-cmd --reload for the changes to take effect.
To use firewalld, you must first start the corresponding firewalld service. Before starting the firewalld service, confirm that it will not affect the normal operation of the current system. You can view the default zone and its configuration by using --list-all:
sudo firewall-offline-cmd --list-all
Output example:
public
target: default
icmp-block-inversion: no
interfaces:
sources:
services: dhcpv6-client mdns ssh
ports:
protocols:
forward: yes
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
The default zone is public, and the allowed services are dhcpv6-client mdns ssh. Note that allowing a service here is equivalent to enabling its default port. For example, allowing the ssh service enables port 22. If the current machine does not use the default port, you need to configure a port rule separately.
If you use ssh to log in to the machine and the ssh service is not listening on the default port 22, complete the following operations before enabling the firewall service:
1. Confirm the actual port number on which the ssh service is listening.
2. Enable the port in the firewall:
sudo firewall-offline-cmd --zone=public --add-port=<port>/tcp
3. After confirming that the port is enabled, start the firewalld service.
Start the firewalld service:
sudo systemctl start firewalld.service
sudo systemctl enable firewalld.service
Check the status of firewalld to see if it is running:
sudo firewall-cmd --state
The output running indicates that the service is running normally.
When firewalld is not needed:
sudo systemctl disable firewalld.service
sudo systemctl stop firewalld.service
As mentioned above, firewalld provides multiple zones. Check out the list of pre-configured zones:
sudo firewall-cmd --get-zones
Output example:
block dmz drop external home internal nm-shared public trusted work
Note: The internal network can use the home or work zone, and the external network can use the public or external zone.
View the default zone. The default zone is public. When configuring, you can use --zone= to specify a zone; if not specified, it points to the default zone:
sudo firewall-cmd --get-default-zone
Output example:
If you need to allow http/https services in the public zone, first check the firewalld predefined service list to see whether it contains the required services:
sudo firewall-cmd --get-services | grep http
Output example:
Add the http, http3, and https services to the default public zone. Since public is the default zone, you can omit the --zone parameter. Use the --permanent parameter to make the rule permanent, preventing configuration loss when the firewall restarts:
sudo firewall-cmd --zone=public --add-service=http --permanent
sudo firewall-cmd --zone=public --add-service=http3 --permanent
sudo firewall-cmd --zone=public --add-service=https --permanent
View all enabled ports in the public zone. No output is displayed because in firewalld, ports enabled via services are default ports and will not be displayed via --list-ports.
sudo firewall-cmd --zone=public --list-ports
If you wish to enable a new port, 8080/tcp, for the http service, run the following command:
sudo firewall-cmd --zone=public --add-port=8080/tcp --permanent
Reload the firewall configurations without service interruption:
sudo firewall-cmd --reload
Verify whether the port is enabled:
sudo firewall-cmd --query-port=8080/tcp
Outputting yes indicates that the port is enabled.
For removing a port:
sudo firewall-cmd --zone=public --remove-port=8080/tcp --permanent
Saving and Restoring Configurations
Save: firewalld automatically saves your changes, so no additional action is required.
Restore: To restore the firewalld configuration, simply copy the backed-up /etc/firewalld/ directory back to its original location and then restart the firewalld service.
sudo systemctl restart firewalld
iptables
Basis of iptables
iptables provides flexible and efficient packet processing and forwarding services through tables, chains, and rules.
Rules can be matched based on conditions such as source IP address, destination IP address, source port, destination port, transport protocol (such as TCP, UDP, and ICMP), and service type (such as HTTP, FTP, and SMTP). The feature of blocking traffic from a specific IP address or allowing a specific service can be implemented.
Tables
iptables provides a total of five tables, each of which contains built-in chains and can contain user-defined chains. The tables provided by iptables are as follows:
filter: The default table of iptables, used for filtering packets.
nat: Used for network address translation, typically together with IP address rewriting rules.
mangle: Used to modify specific attributes of packets, such as the TTL (Time to Live) and TOS (Type of Service) of packets.
raw: Used to configure packets that are not tracked.
security: Used to handle rules related to SELinux.
Chains
iptables provides a total of five chains, and users can define custom chains. Each chain is a list of rules that can match a set of packets, and each rule specifies how to handle the matched packets. When a packet passes through the system, it traverses different chains and is matched against the rules on each chain one by one. The chains provided by iptables are as follows:
INPUT: Processes packets entering the local system.
OUTPUT: Processes packets sent from the local system.
FORWARD: Processes packets that are routed within the local system.
PREROUTING: Processes packets that arrive before routing decisions.
POSTROUTING: Processes packets that leave the local system after routing decisions.
The following are the chains contained in each table:
|
PREROUTING | - | ✓ | ✓ | ✓ | - |
INPUT | ✓ | ✓ | ✓ | - | ✓ |
FORWARD | ✓ | - | ✓ | - | ✓ |
OUTPUT | ✓ | ✓ | ✓ | ✓ | ✓ |
POSTROUTING | - | ✓ | ✓ | - | - |
Rules
Each chain contains a series of rules. Each rule consists of a matching condition and a target action. Matching conditions are used to identify network traffic, while the target action controls how the matched traffic is processed.
The primary task of configuring a firewall is to select appropriate tables and chains, and then add, modify, and delete rules. The commonly used targets are as follows:
ACCEPT: Allows packets to pass through. Packets that meet the matching condition are allowed to proceed to the next chain or be processed.
DROP: Drops packets. Packets that meet the matching condition are dropped, and the firewall does not send any prompt or notification to the sender.
REJECT: Rejects packets. Similar to DROP, packets that meet the matching condition are blocked. However, the difference is that REJECT sends an ICMP error message to the sender of the packet, notifying them that the request was rejected.
LOG: Logs packets. Packets that meet the matching condition are recorded in the system log. This is typically used for debugging and monitoring firewall rules.
RETURN: Returns to the previous chain. Processing is returned to the previous chain, and the next rule in that chain is then processed. This target is typically used in custom chains. User rules and policies are often grouped in dedicated chains and end with the RETURN target in the default chain named "user-defined chain".
REDIRECT: Redirects packets to another port. It is similar to DNAT but is limited to the IP address and local packets of a single system. It is used in scenarios such as transparent proxying.
DNAT: Destination NAT. Allows the destination IP address to be changed as packets pass through the system. This is typically used to forward external requests to private servers on the internal network.
SNAT: Source NAT. Allows the source IP address to be changed as packets pass through the system. This operation can hide the internal network structure and map internal IP addresses to external IP addresses.
In addition, iptables provides many other actions for implementing more complex network traffic control. For details, see iptables-extensions(8).
iptables Installation
Install iptables via dnf:
sudo dnf install iptables
Use of iptables
The following is a simple example for enabling iptables and configuring rules. Note that iptables rules take effect immediately after configuration, so special attention is required when configuring firewall rules.
First, check the default rules configured in iptables and use the --line-numbers parameter to display line numbers. The default table for iptables is filter, which includes the INPUT, FORWARD, and OUTPUT chains.
sudo iptables --list --line-numbers
Output example:
Chain INPUT (policy ACCEPT)
num target prot opt source destination
Chain FORWARD (policy ACCEPT)
num target prot opt source destination
Chain OUTPUT (policy ACCEPT)
num target prot opt source destination
As you can see, the default filter table contains three chains: INPUT, FORWARD, and OUTPUT. Their default rules are all ACCEPT, so when the iptables service is started, traffic passing through the system is accepted by default.
Start the iptables service:
sudo systemctl start iptables.service
sudo systemctl enable iptables.service
When iptables is not needed:
sudo systemctl disable iptables.service
sudo systemctl stop iptables.service
Creating a New Rule
Because iptables rules are read from top to bottom, you need to arrange the rules in a proper order. When creating a new rule, you can use -A, --append to append it to the end of the rules, or use -I, --insert to specify the position (number) at which to insert the rule. If no position is specified, the rule is added to the first line of the rule list by default.
Add a rule to allow connecting to the system via SSH:
sudo iptables -I INPUT -p tcp --dport 22 -j ACCEPT
-p indicates that the packet uses the tcp protocol, --dport indicates that the destination port is port 22 on the local machine, and -j indicates that the action to be performed is ACCEPT.
Add a rule to allow all traffic from the local loopback interface to pass through the firewall:
sudo iptables -A INPUT -i lo -j ACCEPT
-i lo: the matching condition, indicating that only packets passing through the loopback interface lo are processed. The loopback interface is typically used for communication within the local system.
Add a rule to allow traffic from established connections to pass through the firewall:
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-m specifies the use of the state matching module. This module matches packets based on their connection state. --state ESTABLISHED,RELATED: the matching condition, indicating that only packets that are established (ESTABLISHED) or related to an established connection (RELATED) are processed. An established connection means that both parties have exchanged data. A related connection typically refers to a new connection associated with an established connection, such as an FTP data connection or an ICMP error report.
Other rules can then be added as needed to restrict or allow specific types of traffic.
Setting a Default Policy
Set the last policy to deny all traffic. If traffic entering the system does not match any existing rules, deny it to protect system security.
Warning:
iptables rules take effect immediately after configuration, so extra caution is required when DENY ALL rules are configured.
sudo iptables -A INPUT -j DROP
You can also use -P to directly set the policy for each chain. The policy value must be either ACCEPT or DROP. For example, the policy that was just set using -A can also be set using -P:
sudo iptables -P INPUT DROP
Allowing/Denying Specific IPs
Allow access from a specific IP address:
sudo iptables -A INPUT -s 192.168.1.100 -j ACCEPT
Deny access from a specific IP address:
sudo iptables -A INPUT -s 10.0.0.50 -j DROP
Allow a specific IP address range to access a specific port:
sudo iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 80 -j ACCEPT
Allowing/Denying Specific Ports
Allow HTTP (80) and HTTPS (443) ports:
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT
Deny access to a specific port:
sudo iptables -A INPUT -p tcp --dport 3306 -j DROP
Allow multiple ports (such as 8080 and 8443):
sudo iptables -A INPUT -p tcp -m multiport --dports 8080,8443 -j ACCEPT
NAT Configuration
The nat table in iptables is used for network address translation, commonly in scenarios such as shared internet access and port forwarding.
SNAT (Source NAT): Used to translate the source IP address of an internal network to a public IP address, enabling shared internet access:
sudo iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j SNAT --to-source 203.0.113.1
MASQUERADE (dynamic SNAT): Applies to scenarios where public IP addresses are dynamically obtained, such as ADSL dial-up internet access:
sudo iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE
DNAT (Destination NAT): Used to forward external requests to internal servers, enabling port forwarding:
sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.1.100:8080
Port redirection: Redirect traffic from port 80 to port 8080 on the local machine (commonly used for transparent proxies):
sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8080
Enable IP forwarding (required before NAT is configured):
echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward
To make the changes permanent, modify /etc/sysctl.conf:
Run sudo sysctl -p to apply the changes.
Deletion Rule
Note:
Deleted rules take effect immediately. If you accidentally delete a rule that allows critical connections such as SSH, the current session may be interrupted and new connections cannot be established. Before deleting a rule, verify the rule number and its corresponding content, and ensure that necessary allow rules are retained.
The chain (INPUT, OUTPUT, or FORWARD) and the line number of the rule in that chain should be specified. The delete command produces no output.
sudo iptables --list --line-numbers
Output example:
Chain INPUT (policy ACCEPT)
num target prot opt source destination
1 ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
2 ACCEPT all -- anywhere anywhere
3 ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
4 DROP all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
num target prot opt source destination
Chain OUTPUT (policy ACCEPT)
num target prot opt source destination
Delete the fourth rule in the INPUT chain, that is, the DENY ALL rule:
Saving and Restoring Configurations
To save the current iptables rules, you can use the iptables-save command to output the rules to a file:
sudo iptables-save > /etc/sysconfig/iptables
To restore iptables rules, you can use the iptables-restore command to load rules from a file:
sudo iptables-restore < /etc/sysconfig/iptables
To view more parameters and information, see iptables --help and iptables(8).
nftables
Basis of nftables
nftables introduces a new, more concise syntax that can more flexibly handle packets. Compared with iptables, nftables is more recommended for firewall management.
nftables manages rules through tables, chains, and rules, similar to iptables. By default, nftables does not create any tables.
Address Families
Each table in nftables has a corresponding address family that determines the type of packets it processes. When an nftables table is created, the address family should be specified. If not specified, the default value is ip.
ip: IPv4 address family.
ip6: IPv6 address family.
inet: IPv4/IPv6 address family.
arp: ARP address family, which processes IPv4 ARP packets.
bridge: Bridge address family, which processes packets passing through bridge devices.
netdev: Netdev address family, which processes ingress and egress packets.
nftables Installation
Install nftables via dnf:
sudo dnf install nftables
nftables Configuration
The prerequisite for using the nftables service is to start the corresponding nftables service. Since nftables does not create any tables or rules by default, starting the nftables service does not affect the system.
Start the nftables service:
sudo systemctl start nftables.service
sudo systemctl enable nftables.service
When nftables is not needed:
sudo systemctl disable nftables.service
sudo systemctl stop nftables.service
Creating Tables and Chains
View the current rules and list all table information. Since nftables does not create any tables by default, the output should be empty:
1. Create a new table named filter to filter packets, specify the address family as inet, and process IPv4/IPv6 packets:
sudo nft add table inet filter
You can add table, chain, or rule after add to add a table, chain, or rule, respectively.
2. Create a base chain named input for the filter table. A base chain is the entry point for packets from the network stack:
sudo nft add chain inet filter input { type filter hook input priority 0 \\; policy accept \\; }
The backslash \\ is used for escaping to prevent the Shell from interpreting a semicolon as the end of a command.
3. List the chain information, and filter the chain named input in the table that the address family is inet and the table name is filter:
sudo nft list chain inet filter input
Output example:
table inet filter {
chain input {
type filter hook input priority filter; policy accept;
}
}
Configuration Rules
Add a rule to allow ssh login. The dport option accepts either a common service name or a specific port number:
sudo nft add rule inet filter input tcp dport ssh accept
View the current rule set:
Output example:
table inet filter {
chain input {
type filter hook input priority filter; policy accept;
tcp dport ssh accept
}
}
You can see that the default ssh port 22 rule has been added.
Add a rule to allow HTTP and HTTPS traffic:
sudo nft add rule inet filter input tcp dport http accept
sudo nft add rule inet filter input tcp dport https accept
Allow traffic from established connections to pass through the firewall:
sudo nft add rule inet filter input ct state established,related accept
Allow ICMP traffic (ping):
sudo nft add rule inet filter input ip protocol icmp accept
sudo nft add rule inet filter input ip6 nexthdr ipv6-icmp accept
Allow traffic from the local loopback interface:
sudo nft add rule inet filter input iifname "lo" accept
Set the default deny policy, and add a rule to deny all traffic after the above rules:
sudo nft add rule inet filter input drop
Note:
nftables rules are also matched from top to bottom, so the drop rule should be placed after the allow rules. Otherwise, all traffic will be denied.
Configuring NAT
nftables also supports NAT. First, create the corresponding chain in the nat table:
Create the nat table:
sudo nft add table inet nat
Create the PREROUTING chain (for DNAT):
sudo nft add chain inet nat prerouting { type nat hook prerouting priority -100 \\; policy accept \\; }
Create the POSTROUTING chain (for SNAT):
sudo nft add chain inet nat postrouting { type nat hook postrouting priority 100 \\; policy accept \\; }
MASQUERADE (dynamic SNAT):
sudo nft add rule inet nat postrouting oifname "eth0" masquerade
DNAT (port forwarding): Forward external port 80 to internal server 192.168.1.100:8080:
sudo nft add rule inet nat prerouting tcp dport 80 dnat to 192.168.1.100:8080
Viewing Rules with Line Numbers
Use the -a option to view the rule handle, which is used to specify the rule when it is deleted:
Output example:
table inet filter {
chain input {
type filter hook input priority filter; policy accept;
tcp dport ssh accept
tcp dport http accept
tcp dport https accept
drop
}
}
Deletion Rule
Warning:
Deleted and flushed rules take effect immediately. Accidentally deleting a rule that allows critical connections such as SSH will interrupt the connection. After all rulesets are flushed (flush ruleset), the default chain policy will allow all traffic, which poses a security risk. Before performing any operation, verify the rule content and retain the necessary allow rules.
Delete the specified rule by handle:
sudo nft delete rule inet filter input handle 5
Clearing Rules
Flush all rules in the specified chain:
sudo nft flush chain inet filter input
Flush all chains and rules in the specified table:
sudo nft flush table inet filter
Flush all rulesets:
Deleting Chains and Tables
Delete a chain (the chain must be empty or have no rule references):
sudo nft delete chain inet filter input
Delete the table:
sudo nft delete table inet filter
Saving and Restoring Configurations
The nftables configuration file is located at /etc/sysconfig/nftables.conf or /etc/nftables.conf by default.
1. Save the current rules to a file:
sudo nft list ruleset | sudo tee /etc/nftables.conf
2. Load rules from a file:
sudo nft -f /etc/nftables.conf
3. Restarting the nftables service automatically loads the rules from the configuration file:
sudo systemctl restart nftables.service
A complete nftables configuration file example (/etc/nftables.conf):
#!/usr/sbin/nft -f
flush ruleset
table inet filter {
chain input {
type filter hook input priority 0; policy drop;
# Allow the local loopback interface
iifname "lo" accept
# Allow traffic from established connections
ct state established,related accept
# Allow SSH
tcp dport ssh accept
# Allow HTTP and HTTPS
tcp dport { http, https } accept
# Allow ICMP (ping)
ip protocol icmp accept
ip6 nexthdr ipv6-icmp accept
# Deny all other traffic
drop
}
chain forward {
type filter hook forward priority 0; policy drop;
}
chain output {
type filter hook output priority 0; policy accept;
}
}
To view more parameters and information, see nft --help and nft(8).
Comparison Between nftables and iptables
|
Syntax | Separate command for each rule with complex syntax | More concise syntax with support for scripted configuration. |
Tables/Chains | Predefined tables and chains with limited flexibility. | Tables and chains can be freely created, offering higher flexibility. |
Address Family | ipv4, ipv6, arp, and bridge use different commands respectively. | Use the inet address family to handle IPv4/IPv6 in a unified manner. |
Update Rules | Updating each rule requires replacing the entire rule set. | Supports incremental updates with higher performance. |
Configuration File | /etc/sysconfig/iptables
| /etc/nftables.conf
|
NAT | Supported, requiring the nat table to be specified. | Supported with simpler syntax. |
State Tracking | -m state --state
| ct state(connection tracking)
|
Collection | Not supported | Supports named sets to simplify rule management. |
Migrating from iptables to nftables
nftables provides the iptables-translate and ip6tables-translate tools, which can automatically convert iptables rules to nftables format.
Convert iptables rules:
sudo iptables-translate -A INPUT -p tcp --dport 22 -j ACCEPT
Output example:
add rule inet filter input tcp dport 22 counter accept
Convert ip6tables rules:
sudo ip6tables-translate -A INPUT -p tcp --dport 22 -j ACCEPT
Output example:
add rule inet filter input tcp dport 22 counter accept
Convert existing rules in batches:
sudo iptables-save | sudo iptables-restore-translate
This command converts all rules output by iptables-save to nftables format in batches, facilitating overall migration.
Note:
Converted rules need to be adjusted appropriately according to the table and chain structure of nftables. It is recommended to fully test nftables rules before migration to ensure that firewall policies are correct.