Your main task for RHCSA is to allow service access.
In order to do so, you will use the firewall CMD command.
That will write the firewall configuration.
You can use the option minus minus permanent
to write to the persistent configuration.
But the funny thing is, if you use minus minus permanent,
you don't write to the runtime configuration.
So it doesn't become active immediately.
And without minus minus permanent,
the rule is written to a runtime, but not to persistent.
So you can approach this in different ways.
Maybe you just want to run the command twice, once with
and once without minus minus permanent.
So the main components in firewalld are the services.
A firewalld service is an XML file
that contains information about ports and other features that
must be allowed.
Default services, as always, are in usuallib.
In this case, usuallib firewalld services.
Don't change them, because they are
managed by the package manager.
Custom services can be created in ETC firewalld services.
Let me show you how to work with services.
So let's start with systemctl status firewalld,
which is showing that firewalld is currently running.
The main command to figure out what's happening
is firewallcmd minus minus list all.
There you can see all the configuration.
So most important components are here, public.
Public is a zone.
Don't worry about it, because on RHCSA,
you are not required to know how to work with zones.
And here we have the default services.
So cockpit and DHCP6 and SSH are enabled by default,
which means that my web server, for instance,
which we've been using for the Azure Linux
demo in the previous lesson, is not
accessible from the outside.
So let's add the service.
First, I want to know which services are available.
Firewallcmd minus minus get services
is going to print that for you.
And oh my goodness, that's a lot of services.
Let's pick out a random one, NFS.
That's a service that allows access to the NFS3 service.
And you want to know what exactly is inside?
Well, then you would use user lib firewalld services.
NFS3, open that XML file with less.
And you can see that, oh, that's not very exciting.
It's just port 2049.
Well, in many cases, these services aren't very exciting.
And that is also why you shouldn't
manage individual ports.
You might as well create a service.
Now, as the output of get services
is a little bit hard to read, you
might want to filter the output to see if it has a service
for what you want to do.
And as we can see, I have a service for HTTP.
And that is exactly what I want to do.
So firewallcmd minus minus add service HTTP.
Notice that add service needs to be followed
by the name of the service that you want to use.
So if you want to use an other option as well,
like minus minus permanent, it can be anywhere,
but not between add service and the name of the service.
So this will make it permanent.
And now, if I'm using the list all again,
let me use Control-R, the reverse I
search, to search backwards in history.
And I type list.
And that is an easy way to repeat the last command
is that list.
And what do we see?
Well, we see no HTTP.
That's because of what I just told you.
If you use minus minus permanent,
you write it to the zone configuration,
but you don't apply it immediately.
So that is why you need to run it again.
And then, if you use your list all again,
you can see that the service has been added.
And that's how you work with services in Firewall D.