\section{Zones}

\begin{frame}
   {Zones}
   \begin{itemize}
      \item
      Each zone has defined trust level and packet management
      behavior:

      \begin{itemize}
         \item \textbf{drop} All incoming packets dropped
         \item \textbf{block} All incoming network connections
         rejected
         \item \textbf{public} By default trust none
         \item \textbf{external} public with masquerading
         \item \textbf{dmz} (Demilitarized Zone) Allow some
         services to some connections
         \item \textbf{work} Trust (somewhat) certain network
         connections.
         \item \textbf{home} Trust (mostly) certain network
         connections.
         \item \textbf{internal} Similar to the \textbf{work}
         zone.
         \item \textbf{trusted} All connections allowed.
      \end{itemize}
   \end{itemize}

\end{frame}

\cprotect\note{

   \textbf{firewalld} works with \textbf{zones}, each of
   which has a defined level of trust and a certain known
   behavior for incoming and outgoing packets.  Each
   interface belongs to a particular zone (normally it is
   \textbf{NetworkManager} which informs \textbf{firewalld}
   which zone is applicable), but this can be changed
   with \textbf{firewall-cmd} or the
   \textbf{firewall-config} GUI.
   The zones are:
   \begin{itemize}
      \item \textbf{drop}: All incoming packets are dropped
      with no reply.  Only outgoing connections are
      permitted.
      \item \textbf{block}: All incoming network connections
      are rejected.  The only permitted connections are
      those from within the system.
      \item \textbf{public}: Do not trust any computers on the
      network; only certain consciously selected incoming
      connections are permitted.
      \item \textbf{external}: Used when \textbf{masquerading}
      is being used, such as in routers.  Trust levels the
      same as in \textbf{public}.
      \item \textbf{dmz}: (Demilitarized Zone) Used when
      access to some (but not all) services are to be
      allowed to the public.  Only particular incoming
      connections are allowed.
      \item \textbf{work}: Trust (but not completely)
      connected nodes to be not harmful.  Only certain
      incoming connections are allowed.
      \item \textbf{home}: You mostly trust the other network
      nodes, but still select which incoming connections are
      allowed.
      \item \textbf{internal}: Similar to the \textbf{work}
      zone.
      \item \textbf{trusted}: All network connections are
      allowed.
   \end{itemize}

   On system installation, most if not all \textbf{Linux}
   distributions will select the \textbf{public} zone as
   default for all interfaces.
   The differences between some of the above zones are not
   obvious and we do not need to go into that much detail
   here, but note that one should not use a more open zone
   than necessary.  }


\begin{frame}
   {Zone Management Examples I}
   \begin{itemize}
      \item Get the default zone:
      \begin{cmd}
$ sudo firewall-cmd --get-default-zone
      \end{cmd}
      \begin{response}
public
      \end{response}
      \item Obtain a list of zones currently being used:
      \begin{cmd}
$ sudo firewall-cmd --get-active-zones
      \end{cmd}
      \begin{response}
public
  interfaces: eno16777736
      \end{response}
      \item List all available zones:
      \begin{cmd}
$ sudo firewall-cmd --get-zones
      \end{cmd}
      \begin{response}
block dmz drop external home internal public trusted work
      \end{response}

   \end{itemize}

\end{frame}

\cprotect\note {
   \begin{cmd}
$ firewall-cmd --help
    \end{cmd}
   \begin{response}
....
Zone Options
  --get-default-zone   Print default zone for connections and interfaces
  --set-default-zone=<zone>
                       Set default zone
  --get-active-zones   Print currently active zones
  --get-zones          Print predefined zones [P]
  --get-services       Print predefined services [P]
  --get-icmptypes      Print predefined icmptypes [P]
  --get-zone-of-interface=<interface>
                     Print name of the zone the interface is bound to [P]
  --get-zone-of-source=<source>[/<mask>]
                 Print name of the zone the source[/mask] is bound to [P]
  --list-all-zones  List everything added for or enabled in all zones [P]
  --new-zone=<zone>    Add a new zone [P only]
  --delete-zone=<zone> Delete an existing zone [P only]
  --zone=<zone>  Use this zone to set or query options, else default zone
                       Usable for options maked with [Z]
  --get-target         Get the zone target [P] [Z]
  --set-target=<target>
                       Set the zone target [P] [Z]
  \end{response}

}


\begin{frame}
   {Zone Management Examples II}
   \begin{itemize}
      \item To change the default zone to \textbf{trusted} and
      then change it back:
      \begin{cmd}
$ sudo firewall-cmd --set-default-zone=trusted
      \end{cmd}
      \begin{response}
success
      \end{response}
      \begin{cmd}
$ sudo firewall-cmd --set-default-zone=public
      \end{cmd}
      \begin{response}
success
      \end{response}
      \item To assign an interface temporarily to a particular
      zone:
      \begin{cmd}
$ sudo firewall-cmd --zone=internal --change-interface=eno1
      \end{cmd}
      \begin{response}
success
      \end{response}
      \item To do so permanently:
      \begin{cmd}
$ sudo firewall-cmd --permanent --zone=internal --change-interface=eno1
      \end{cmd}
      \begin{response}
success
      \end{response}
      which creates the file
      \filelink{/etc/firewalld/zones/internal.xml}.
   \end{itemize}

\end{frame}

\cprotect\note {

   All work at controlling \textbf{firewalld} is done through
   the \textbf{firewall-cmd} program.
   More detailed information can be obtained with:
   \begin{cmd}
 man firewalld-cmd
   \end{cmd}


}


\begin{frame}
   {Zone Management Examples III}
   \begin{itemize}
      \item To ascertain the zone associated with a particular
      interface:
      \begin{cmd}
$ sudo firewall-cmd --get-zone-of-interface=eno1
      \end{cmd}
      \begin{response}
public
      \end{response}

      \item
      To get all details about a particular zone:
      \begin{cmd}
$ sudo firewall-cmd --zone=public --list-all
        \end{cmd}
      \begin{responsevarnoline}{\small}
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eno1
  sources: 
  services: chromecast libvirt libvirt-tls nfs nfs3 rsyncd ssh
  ports: 
  protocols: 
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 
      \end{responsevarnoline}

   \end{itemize}
\end{frame}

\cprotect\note {
}

