\section{firewalld}
\begin{frame}
   {firewalld and firewall-cmd}
   \begin{itemize}
      \item
      \textbf{Dynamic Firewall Manager}
      (\textbf{firewalld})
      \item
      Works with \textbf{zones}
      \item
      Supports \textbf{IPv4} and \textbf{IPv6}
      \item
      Separates \textbf{Runtime} and \textbf{Permanent}
      configurations
      \item
      Main tool is \textbf{firewall-cmd}
      \item
      Replaces \textbf{iptables} utility
      \item
      Part of \textbf{systemd} universe
      \item
      Gradually being adopted by major distributions, can
      also be installed from source
   \end{itemize}

\end{frame}

\cprotect\note {

   \textbf{firewalld} is the \textbf{Dynamic Firewall
      Manager}.  It utilizes network/firewall
   \textbf{zones} which have defined levels of trust for
   network interfaces or connections.  It supports both
   \textbf{IPv4} and \textbf{IPv6} protocols.

   In addition, it separates \textbf{runtime} and
   \textbf{permanent} (persistent) changes to
   configuration, and also includes interfaces for
   services or applications to add firewall rules.

   Configuration files are kept in
   \filelink{/etc/firewalld} and
   \filelink{/usr/lib/firewalld}; the files in
   \filelink{/etc/firewalld} override those in the other
   directory and are the ones a system administrator
   should work on.

   The command line tool is actually
   \textbf{firewall-cmd} which we will discuss.

   We recommend that before getting any further, you run:
   \begin{cmd}
$ firewall-cmd --help
   \end{cmd}
   \begin{response}
Usage: firewall-cmd [OPTIONS...]
....
Status Options
  --state                Return and print firewalld state
  --reload               Reload firewall and keep state information
  --complete-reload      Reload firewall and loose state information
  --runtime-to-permanent Create permanent from runtime configuration
....
   \end{response}

   which runs about 200 lines, so it is too long to
   include here.  However, you will see that almost all
   options are rather obvious as they are well named.

   As a service, \textbf{firewalld} replaces the older
   \textbf{iptables}.  It is an error to run both services
   at the same time.
}


\begin{frame}
   {firewalld Service Status}
   \begin{itemize}
      \item
      \textbf{firewalld} service must be enabled/disabled,
      start/stopped like any other service:
      \begin{cmd}
$ sudo systemctl [enable/disable] firewalld
$ sudo systemctl [start/stop] firewalld
      \end{cmd}
      \item
      Show status:
      \begin{cmd}
$ sudo systemctl status firewalld
$ sudo firewall-cmd --state
      \end{cmd}

      \item
      With more than one network interface, must turn on
      \textbf{IP Forwarding}:
      \begin{cmd}
$ sudo sysctl net.ipv4.ip_forward=1
$ echo 1 > /proc/sys/net/ipv4/ip_forward
      \end{cmd}
   \end{itemize}

\end{frame}

\cprotect\note{

   \textbf{firewalld} is a service which needs to be running
   to use and configure the firewall, and is
   enabled/disabled, or started or stopped in the usual ways
   as shown above.  You can show the current state in either
   of the following ways:

   \begin{cmd}
$ sudo systemctl status firewalld
   \end{cmd}
   \begin{response}
firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled)
   Active: active (running) since Tue 2015-04-28 12:00:59 CDT; 5min ago
 Main PID: 777 (firewalld)
...
   \end{response}
   \begin{cmd}
$ sudo firewall-cmd --state

running
   \end{cmd}

   Note that if you have more than one network interface
   when using \textbf{IPv4}, you have to turn on \textbf{ip
      forwarding}.  You can do this at run time by doing
   either of:
   \begin{cmd}
$ sudo sysctl net.ipv4.ip_forward=1
$ echo 1 > /proc/sys/net/ipv4/ip_forward
   \end{cmd}
   (where the second command has to be run as root to get
   the \textbf{echo} to work properly.)  However this is not
   persistent.  To do that you have to add the line
   \verb?net.ipv4.ip_forward=1?  to
   \filelink{/etc/sysctl.conf}, and then reboot or type
   \texttt{sudo sysctl -p} to read in the new setting
   without rebooting.

}

