firewalld change default target

user_8733724 0
Viewed 10423

From firewalld man page:

–permanent [–zone=zone] --set-target=target Set the target of a permanent zone. target is one of: default, ACCEPT, DROP, REJECT

The default target is REJECT. Is it possible to change the default target to DROP? If not, why does a default option exist if it is always REJECT?

I am using CentOS 7.4

I understand that I can configure firewalld any way I'd like without being able to change the default target, but I'd like to know how to change it if possible.

firewalld centos7 centos
2 Answers

On firewalld(1) and its targets as of 2020:

  • possible POLICY TARGETS
    • CONTINUE
    • ACCEPT
    • DROP
    • REJECT
    • policies are only in firewalld>=0.9.0
  • possible ZONE TARGETS
    • DEFAULT
    • ACCEPT
    • DROP
    • REJECT
  • TARGET: DEFAULT
    • REJECT
    • allow ICMP
    • if ingress zone is default, forwardings will follow egress zone target
    • zone drifting may be applied depending on global setting

The target in a zone is the destination target packets will be sent to if no other zone rules match, and can be

  • ACCEPT
  • DROP
  • REJECT
  • or be... DEFAULT

'DEFAULT' is basically a simple REJECT plus other sane things for a more sensible default setting, its name choice is somewhat unlucky.

The accepted answer is somewhat misleading as it talks about redefining the target destination 'DEFAULT'.

However the question should rather aim at wether setting a different 'default' target in a zone is possible, which it perfectly is:

firewall-cmd --permanent --zone=YOUR_ZONE_HERE --set-target=ACCEPT
firewall-cmd --reload

#some different oneliners to verify your config
#1.
(firewall-cmd --list-all;for i in $(firewall-cmd --get-active-zones|grep -v "^\s");do firewall-cmd --list-all --zone=$i;done)|grep -v ':\s*$'
#2.
fwstatus() { _fwstate=$(firewall-cmd --state 2>&1);printf "FIREWALLD=%s\n" "${_fwstate}";[[ "not running" == ${_fwstate} ]]&&return;_panicstate=$(firewall-cmd --query-panic);if [[ "on" == "${_panicstate}" ]];then printf "\e[41;1m";else printf "\e[32;1m";fi;printf "PANIC MODE=%s\e[m\n" "${_panicstate}";printf "LOCKDOWN=%s\n\n" "$(firewall-cmd --query-lockdown)";_defaultzone=$(firewall-cmd --get-default-zone);firewall-cmd --list-all-zones|sed 's/^'"$_defaultzone"'/& (default)/'|sed -n '/^'"$_defaultzone"'\|active/,/^$/p'|grep -v -e ':\s*$' -e icmp-block-inversion|awk 'NF>0'|grep --color -e$ -e^\\w.\\+;}&&fwstatus  ## show full firewalling state,only works when firewalld is running
#3.
firewall-cmd --zone=YOUR_ZONE_HERE --list-all
user_8052840

It is not possible to change the default target - it's hardcoded. It's possible "default" was included so we could potentially introduce a "--set-default-target" option in the future, but I'm just speculating.

https://github.com/firewalld/firewalld/issues/252

user_87337240
Related