Firewalld, a dynamic zone-based firewall daemon, has been under developmwnt since circa 2009, with the latest version Рfirewalld 0.6.3 Рreleased on Oct 11, 2018. The main developer is Thomas W̦rner who currently works for Red Hat. It because the default firewall mechanism in Fedora 18 and, subsequently, in RHEL7 and CentOS 7.
Firewalld has many advantages over the older iptables mechanism. Of note, it solved the problem whereby iptables required a firewall restart at each change thus breaking any stateful connections. It also provides a rich well-thought-out range of D-Bus methods, signals and properties.
This post assumes you are familiar with firewalld and D-Bus concepts and operation. I focus instead on how to use the rich (as in extensive) firewalld D-Bus interface to retrieve information or change settings.
Firewalld is configured as a systemd D-Bus service. Note the “Type=dbus” directive below.
# cat /usr/lib/systemd/system/firewalld.service [Unit] Description=firewalld - dynamic firewall daemon Before=network.target Before=libvirtd.service Before=NetworkManager.service Conflicts=iptables.service ip6tables.service ebtables.service [Service] EnvironmentFile=-/etc/sysconfig/firewalld ExecStart=/usr/sbin/firewalld --nofork --nopid $FIREWALLD_ARGS ExecReload=/bin/kill -HUP $MAINPID # supress to log debug and error output also to /var/log/messages StandardOutput=null StandardError=null Type=dbus BusName=org.fedoraproject.FirewallD1 [Install] WantedBy=basic.target Alias=dbus-org.fedoraproject.FirewallD1.service
Now that we know that the firewalld service is based on D-Bus, we need to find the D-Bus interface used by firewalld:
# dbus-send --system --dest=org.freedesktop.DBus --type=method_call --print-reply \
/org/freedesktop/DBus org.freedesktop.DBus.ListNames | grep FirewallD
string "org.fedoraproject.FirewallD1"
#
This shows that the interface is org.fedoraproject.FirewallD1.
Next we want to see what methods, properties and signals are supported by this D-Bus interface. To do this,we use one of the cooler features of D-Bus, i.e. introspection.
# dbus-send --system --dest=org.fedoraproject.FirewallD1 --print-reply \
/org/fedoraproject/FirewallD1 org.freedesktop.DBus.Introspectable.Introspect
method return sender=:1.7 -> dest=:1.116 reply_serial=2
string "<!DOCTYPE node PUBLIC "-//freedesktop//DTD D-BUS Object Introspection 1.0//EN"
"http://www.freedesktop.org/standards/dbus/1.0/introspect.dtd">
<node name="/org/fedoraproject/FirewallD1">
<interface name="org.fedoraproject.FirewallD1.direct">
<method name="queryPassthrough">
<arg direction="in" type="s" name="ipv" />
<arg direction="in" type="as" name="args" />
<arg direction="out" type="b" />
</method>
<method name="addRule">
<arg direction="in" type="s" name="ipv" />
<arg direction="in" type="s" name="table" />
<arg direction="in" type="s" name="chain" />
<arg direction="in" type="i" name="priority" />
<arg direction="in" type="as" name="args" />
</method>
<method name="passthrough">
<arg direction="in" type="s" name="ipv" />
<arg direction="in" type="as" name="args" />
<arg direction="out" type="s" />
</method>
<method name="getAllPassthroughs">
<arg direction="out" type="a(sas)" />
</method>
<method name="getAllChains">
<arg direction="out" type="a(sss)" />
</method>
<method name="getPassthroughs">
<arg direction="in" type="s" name="ipv" />
<arg direction="out" type="aas" />
</method>
<method name="getRules">
<arg direction="in" type="s" name="ipv" />
<arg direction="in" type="s" name="table" />
<arg direction="in" type="s" name="chain" />
<arg direction="out" type="a(ias)" />
</method>
<method name="getChains">
<arg direction="in" type="s" name="ipv" />
<arg direction="in" type="s" name="table" />
<arg direction="out" type="as" />
</method>
<method name="addPassthrough">
<arg direction="in" type="s" name="ipv" />
<arg direction="in" type="as" name="args" />
</method>
<method name="queryChain">
<arg direction="in" type="s" name="ipv" />
<arg direction="in" type="s" name="table" />
<arg direction="in" type="s" name="chain" />
<arg direction="out" type="b" />
</method>
<method name="removePassthrough">
<arg direction="in" type="s" name="ipv" />
<arg direction="in" type="as" name="args" />
</method>
<method name="removeRules">
<arg direction="in" type="s" name="ipv" />
<arg direction="in" type="s" name="table" />
<arg direction="in" type="s" name="chain" />
</method>
<signal name="RuleAdded">
<arg type="s" name="ipv" />
<arg type="s" name="table" />
<arg type="s" name="chain" />
<arg type="i" name="priority" />
<arg type="as" name="args" />
</signal>
<method name="getAllRules">
<arg direction="out" type="a(sssias)" />
</method>
<signal name="PassthroughRemoved">
<arg type="s" name="ipv" />
<arg type="as" name="args" />
</signal>
<method name="removeRule">
<arg direction="in" type="s" name="ipv" />
<arg direction="in" type="s" name="table" />
<arg direction="in" type="s" name="chain" />
<arg direction="in" type="i" name="priority" />
<arg direction="in" type="as" name="args" />
</method>
<method name="addChain">
<arg direction="in" type="s" name="ipv" />
<arg direction="in" type="s" name="table" />
<arg direction="in" type="s" name="chain" />
</method>
<signal name="PassthroughAdded">
<arg type="s" name="ipv" />
<arg type="as" name="args" />
</signal>
<method name="removeChain">
<arg direction="in" type="s" name="ipv" />
<arg direction="in" type="s" name="table" />
<arg direction="in" type="s" name="chain" />
</method>
<signal name="ChainRemoved">
<arg type="s" name="ipv" />
<arg type="s" name="table" />
<arg type="s" name="chain" />
</signal>
<signal name="RuleRemoved">
<arg type="s" name="ipv" />
<arg type="s" name="table" />
<arg type="s" name="chain" />
<arg type="i" name="priority" />
<arg type="as" name="args" />
</signal>
<method name="queryRule">
<arg direction="in" type="s" name="ipv" />
<arg direction="in" type="s" name="table" />
<arg direction="in" type="s" name="chain" />
<arg direction="in" type="i" name="priority" />
<arg direction="in" type="as" name="args" />
<arg direction="out" type="b" />
</method>
<method name="removeAllPassthroughs">
</method>
<signal name="ChainAdded">
<arg type="s" name="ipv" />
<arg type="s" name="table" />
<arg type="s" name="chain" />
</signal>
</interface>
<interface name="org.fedoraproject.FirewallD1">
<method name="disablePanicMode">
</method>
<method name="listIcmpTypes">
<arg direction="out" type="as" />
</method>
<method name="completeReload">
</method>
<signal name="PanicModeDisabled">
</signal>
<method name="queryPanicMode">
<arg direction="out" type="b" />
</method>
<method name="getDefaultZone">
<arg direction="out" type="s" />
</method>
<signal name="Reloaded">
</signal>
<method name="enablePanicMode">
</method>
<method name="runtimeToPermanent">
</method>
<method name="getIcmpTypeSettings">
<arg direction="in" type="s" name="icmptype" />
<arg direction="out" type="(sssas)" />
</method>
<method name="reload">
</method>
<signal name="PanicModeEnabled">
</signal>
<method name="getServiceSettings">
<arg direction="in" type="s" name="service" />
<arg direction="out" type="(sssa(ss)asa{ss})" />
</method>
<method name="getZoneSettings">
<arg direction="in" type="s" name="zone" />
<arg direction="out" type="(sssbsasa(ss)asba(ssss)asasas)" />
</method>
<method name="setDefaultZone">
<arg direction="in" type="s" name="zone" />
</method>
<method name="listServices">
<arg direction="out" type="as" />
</method>
<signal name="DefaultZoneChanged">
<arg type="s" name="zone" />
</signal>
</interface>
<interface name="org.freedesktop.DBus.Introspectable">
<method name="Introspect">
<arg direction="out" type="s" />
</method>
</interface>
<interface name="org.fedoraproject.FirewallD1.policies">
<signal name="LockdownDisabled">
</signal>
<method name="addLockdownWhitelistContext">
<arg direction="in" type="s" name="context" />
</method>
<method name="getLockdownWhitelistCommands">
<arg direction="out" type="as" />
</method>
<method name="removeLockdownWhitelistCommand">
<arg direction="in" type="s" name="command" />
</method>
<signal name="LockdownEnabled">
</signal>
<signal name="LockdownWhitelistContextAdded">
<arg type="s" name="context" />
</signal>
<method name="addLockdownWhitelistUser">
<arg direction="in" type="s" name="user" />
</method>
<method name="queryLockdownWhitelistContext">
<arg direction="in" type="s" name="context" />
<arg direction="out" type="b" />
</method>
<signal name="LockdownWhitelistUidAdded">
<arg type="i" name="uid" />
</signal>
<method name="getLockdownWhitelistUsers">
<arg direction="out" type="as" />
</method>
<method name="getLockdownWhitelistContexts">
<arg direction="out" type="as" />
</method>
<signal name="LockdownWhitelistCommandRemoved">
<arg type="s" name="command" />
</signal>
<method name="queryLockdown">
<arg direction="out" type="b" />
</method>
<method name="enableLockdown">
</method>
<method name="queryLockdownWhitelistUser">
<arg direction="in" type="s" name="user" />
<arg direction="out" type="b" />
</method>
<method name="removeLockdownWhitelistUid">
<arg direction="in" type="i" name="uid" />
</method>
<method name="removeLockdownWhitelistContext">
<arg direction="in" type="s" name="context" />
</method>
<signal name="LockdownWhitelistCommandAdded">
<arg type="s" name="command" />
</signal>
<method name="disableLockdown">
</method>
<method name="addLockdownWhitelistUid">
<arg direction="in" type="i" name="uid" />
</method>
<method name="removeLockdownWhitelistUser">
<arg direction="in" type="s" name="user" />
</method>
<signal name="LockdownWhitelistContextRemoved">
<arg type="s" name="context" />
</signal>
<method name="getLockdownWhitelistUids">
<arg direction="out" type="ai" />
</method>
<signal name="LockdownWhitelistUserAdded">
<arg type="s" name="user" />
</signal>
<method name="addLockdownWhitelistCommand">
<arg direction="in" type="s" name="command" />
</method>
<signal name="LockdownWhitelistUserRemoved">
<arg type="s" name="user" />
</signal>
<signal name="LockdownWhitelistUidRemoved">
<arg type="i" name="uid" />
</signal>
<method name="queryLockdownWhitelistCommand">
<arg direction="in" type="s" name="command" />
<arg direction="out" type="b" />
</method>
<method name="queryLockdownWhitelistUid">
<arg direction="in" type="i" name="uid" />
<arg direction="out" type="b" />
</method>
</interface>
<interface name="org.freedesktop.DBus.Properties">
<signal name="PropertiesChanged">
<arg type="s" name="interface_name" />
<arg type="a{sv}" name="changed_properties" />
<arg type="as" name="invalidated_properties" />
</signal>
<method name="Set">
<arg direction="in" type="s" name="interface_name" />
<arg direction="in" type="s" name="property_name" />
<arg direction="in" type="v" name="new_value" />
</method>
<method name="GetAll">
<arg direction="in" type="s" name="interface_name" />
<arg direction="out" type="a{sv}" />
</method>
<method name="Get">
<arg direction="in" type="s" name="interface_name" />
<arg direction="in" type="s" name="property_name" />
<arg direction="out" type="v" />
</method>
</interface>
<interface name="org.fedoraproject.FirewallD1.zone">
<method name="changeZone">
<arg direction="in" type="s" name="zone" />
<arg direction="in" type="s" name="interface" />
<arg direction="out" type="s" />
</method>
<signal name="IcmpBlockRemoved">
<arg type="s" name="zone" />
<arg type="s" name="icmp" />
</signal>
<method name="getInterfaces">
<arg direction="in" type="s" name="zone" />
<arg direction="out" type="as" />
</method>
<method name="removeService">
<arg direction="in" type="s" name="zone" />
<arg direction="in" type="s" name="service" />
<arg direction="out" type="s" />
</method>
<method name="removeInterface">
<arg direction="in" type="s" name="zone" />
<arg direction="in" type="s" name="interface" />
<arg direction="out" type="s" />
</method>
<signal name="MasqueradeRemoved">
<arg type="s" name="zone" />
</signal>
<method name="queryPort">
<arg direction="in" type="s" name="zone" />
<arg direction="in" type="s" name="port" />
<arg direction="in" type="s" name="protocol" />
<arg direction="out" type="b" />
</method>
<method name="addMasquerade">
<arg direction="in" type="s" name="zone" />
<arg direction="in" type="i" name="timeout" />
<arg direction="out" type="s" />
</method>
<method name="getRichRules">
<arg direction="in" type="s" name="zone" />
<arg direction="out" type="as" />
</method>
<method name="getPorts">
<arg direction="in" type="s" name="zone" />
<arg direction="out" type="aas" />
</method>
<signal name="PortAdded">
<arg type="s" name="zone" />
<arg type="s" name="port" />
<arg type="s" name="protocol" />
<arg type="i" name="timeout" />
</signal>
<method name="addService">
<arg direction="in" type="s" name="zone" />
<arg direction="in" type="s" name="service" />
<arg direction="in" type="i" name="timeout" />
<arg direction="out" type="s" />
</method>
<method name="queryInterface">
<arg direction="in" type="s" name="zone" />
<arg direction="in" type="s" name="interface" />
<arg direction="out" type="b" />
</method>
<method name="getServices">
<arg direction="in" type="s" name="zone" />
<arg direction="out" type="as" />
</method>
<signal name="RichRuleAdded">
<arg type="s" name="zone" />
<arg type="s" name="rule" />
<arg type="i" name="timeout" />
</signal>
<method name="queryService">
<arg direction="in" type="s" name="zone" />
<arg direction="in" type="s" name="service" />
<arg direction="out" type="b" />
</method>
<signal name="RichRuleRemoved">
<arg type="s" name="zone" />
<arg type="s" name="rule" />
</signal>
<signal name="SourceRemoved">
<arg type="s" name="zone" />
<arg type="s" name="source" />
</signal>
<method name="isImmutable">
<arg direction="in" type="s" name="zone" />
<arg direction="out" type="b" />
</method>
<method name="addIcmpBlock">
<arg direction="in" type="s" name="zone" />
<arg direction="in" type="s" name="icmp" />
<arg direction="in" type="i" name="timeout" />
<arg direction="out" type="s" />
</method>
<method name="addSource">
<arg direction="in" type="s" name="zone" />
<arg direction="in" type="s" name="source" />
<arg direction="out" type="s" />
</method>
<signal name="ZoneChanged">
<arg type="s" name="zone" />
<arg type="s" name="interface" />
</signal>
<method name="querySource">
<arg direction="in" type="s" name="zone" />
<arg direction="in" type="s" name="source" />
<arg direction="out" type="b" />
</method>
<method name="addPort">
<arg direction="in" type="s" name="zone" />
<arg direction="in" type="s" name="port" />
<arg direction="in" type="s" name="protocol" />
<arg direction="in" type="i" name="timeout" />
<arg direction="out" type="s" />
</method>
<method name="queryIcmpBlock">
<arg direction="in" type="s" name="zone" />
<arg direction="in" type="s" name="icmp" />
<arg direction="out" type="b" />
</method>
<method name="removeIcmpBlock">
<arg direction="in" type="s" name="zone" />
<arg direction="in" type="s" name="icmp" />
<arg direction="out" type="s" />
</method>
<signal name="InterfaceRemoved">
<arg type="s" name="zone" />
<arg type="s" name="interface" />
</signal>
<method name="getZoneOfInterface">
<arg direction="in" type="s" name="interface" />
<arg direction="out" type="s" />
</method>
<method name="changeZoneOfInterface">
<arg direction="in" type="s" name="zone" />
<arg direction="in" type="s" name="interface" />
<arg direction="out" type="s" />
</method>
<signal name="ServiceAdded">
<arg type="s" name="zone" />
<arg type="s" name="service" />
<arg type="i" name="timeout" />
</signal>
<method name="removeSource">
<arg direction="in" type="s" name="zone" />
<arg direction="in" type="s" name="source" />
<arg direction="out" type="s" />
</method>
<method name="removeRichRule">
<arg direction="in" type="s" name="zone" />
<arg direction="in" type="s" name="rule" />
<arg direction="out" type="s" />
</method>
<signal name="SourceAdded">
<arg type="s" name="zone" />
<arg type="s" name="source" />
</signal>
<method name="changeZoneOfSource">
<arg direction="in" type="s" name="zone" />
<arg direction="in" type="s" name="source" />
<arg direction="out" type="s" />
</method>
<method name="getForwardPorts">
<arg direction="in" type="s" name="zone" />
<arg direction="out" type="aas" />
</method>
<signal name="ZoneOfInterfaceChanged">
<arg type="s" name="zone" />
<arg type="s" name="interface" />
</signal>
<signal name="ZoneOfSourceChanged">
<arg type="s" name="zone" />
<arg type="s" name="source" />
</signal>
<signal name="InterfaceAdded">
<arg type="s" name="zone" />
<arg type="s" name="interface" />
</signal>
<signal name="ServiceRemoved">
<arg type="s" name="zone" />
<arg type="s" name="service" />
</signal>
<method name="getIcmpBlocks">
<arg direction="in" type="s" name="zone" />
<arg direction="out" type="as" />
</method>
<method name="queryForwardPort">
<arg direction="in" type="s" name="zone" />
<arg direction="in" type="s" name="port" />
<arg direction="in" type="s" name="protocol" />
<arg direction="in" type="s" name="toport" />
<arg direction="in" type="s" name="toaddr" />
<arg direction="out" type="b" />
</method>
<method name="getSources">
<arg direction="in" type="s" name="zone" />
<arg direction="out" type="as" />
</method>
<method name="getZones">
<arg direction="out" type="as" />
</method>
<method name="addRichRule">
<arg direction="in" type="s" name="zone" />
<arg direction="in" type="s" name="rule" />
<arg direction="in" type="i" name="timeout" />
<arg direction="out" type="s" />
</method>
<signal name="MasqueradeAdded">
<arg type="s" name="zone" />
<arg type="i" name="timeout" />
</signal>
<signal name="IcmpBlockAdded">
<arg type="s" name="zone" />
<arg type="s" name="icmp" />
<arg type="i" name="timeout" />
</signal>
<signal name="ForwardPortRemoved">
<arg type="s" name="zone" />
<arg type="s" name="port" />
<arg type="s" name="protocol" />
<arg type="s" name="toport" />
<arg type="s" name="toaddr" />
</signal>
<signal name="PortRemoved">
<arg type="s" name="zone" />
<arg type="s" name="port" />
<arg type="s" name="protocol" />
</signal>
<method name="queryMasquerade">
<arg direction="in" type="s" name="zone" />
<arg direction="out" type="b" />
</method>
<method name="removeMasquerade">
<arg direction="in" type="s" name="zone" />
<arg direction="out" type="s" />
</method>
<signal name="ForwardPortAdded">
<arg type="s" name="zone" />
<arg type="s" name="port" />
<arg type="s" name="protocol" />
<arg type="s" name="toport" />
<arg type="s" name="toaddr" />
<arg type="i" name="timeout" />
</signal>
<method name="removeForwardPort">
<arg direction="in" type="s" name="zone" />
<arg direction="in" type="s" name="port" />
<arg direction="in" type="s" name="protocol" />
<arg direction="in" type="s" name="toport" />
<arg direction="in" type="s" name="toaddr" />
<arg direction="out" type="s" />
</method>
<method name="getZoneOfSource">
<arg direction="in" type="s" name="source" />
<arg direction="out" type="s" />
</method>
<method name="queryRichRule">
<arg direction="in" type="s" name="zone" />
<arg direction="in" type="s" name="rule" />
<arg direction="out" type="b" />
</method>
<method name="addInterface">
<arg direction="in" type="s" name="zone" />
<arg direction="in" type="s" name="interface" />
<arg direction="out" type="s" />
</method>
<method name="addForwardPort">
<arg direction="in" type="s" name="zone" />
<arg direction="in" type="s" name="port" />
<arg direction="in" type="s" name="protocol" />
<arg direction="in" type="s" name="toport" />
<arg direction="in" type="s" name="toaddr" />
<arg direction="in" type="i" name="timeout" />
<arg direction="out" type="s" />
</method>
<method name="removePort">
<arg direction="in" type="s" name="zone" />
<arg direction="in" type="s" name="port" />
<arg direction="in" type="s" name="protocol" />
<arg direction="out" type="s" />
</method>
<method name="getActiveZones">
<arg direction="out" type="a{sa{sas}}" />
</method>
</interface>
<node name="config"/>
</node>
"
The above output lists all the methods, singals and properties available via the firewalld D-Bus interface. This is the standard D-Bus introspection output format based on the D-Bus DTD. All D-Bus services are required to implement the org.freedesktop.DBus.Introspectable.Introspect method.
With this extensive firewalld D-Bus interface, it is simple for services, applications and users to manage firewall settings. The interface is used by all the firewall configuration tools such as firewall-cmd, firewall-config and firewall-applet.
Turning now to our first example. Consider the following simple firewall-cmd which retrieves and prints the default zone, i.e. public.
# firewall-cmd --get-default-zone public #
Here is how to retrieve the same information using the firewalld D-Bus interface and dbus-send:
# dbus-send --system --dest=org.fedoraproject.FirewallD1 --print-reply --type=method_call \ /org/fedoraproject/FirewallD1 org.fedoraproject.FirewallD1.getDefaultZone method return sender=:1.7 -> dest=:1.133 reply_serial=2 string "public" #
The dbus-send command is used to send a message to a D-Bus message bus and display the result of that message. There are two well-known message buses: the systemwide message bus (option –system) and the per-user-login-session message (option –session). With firewalld, we use the system bus to talk to it’s interface. Also, nearly all uses of dbus-send must provide the –dest argument which is the name of an interface (connection) on the bus to send the message to. In our case, it is org.fedoraproject.FirewallD1 The object path and the name of the message to send must always be specified. Following arguments, if any, are the message contents (message arguments). These are given as type-specified values.
Here we use both firewall-cmd and dbus-send to retrieve a list of zones:
# firewall-cmd --get-zones
block dmz drop external home internal public trusted work
# dbus-send --system --dest=org.fedoraproject.FirewallD1 --print-reply --type=method_call \
/org/fedoraproject/FirewallD1 org.fedoraproject.FirewallD1.zone.getZones
method return sender=:1.7 -> dest=:1.363 reply_serial=2
array [
string "block"
string "dmz"
string "drop"
string "external"
string "home"
string "internal"
string "public"
string "trusted"
string "work"
]
#
In the following example we use firewall-cmd and dbus-send to retrieve information about a zone:
# firewall-cmd --zone=public --list-all
public (default)
interfaces:
sources:
services: dhcpv6-client ssh
ports:
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
# dbus-send --system --dest=org.fedoraproject.FirewallD1 --print-reply --type=method_call \
/org/fedoraproject/FirewallD1 org.fedoraproject.FirewallD1.getZoneSettings string:"public"
method return sender=:1.7 -> dest=:1.351 reply_serial=2
struct {
string ""
string "Public"
string "For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted."
boolean false
string "{chain}_{zone}"
array [
string "dhcpv6-client"
string "ssh"
]
array [
]
array [
]
boolean false
array [
]
array [
]
array [
]
array [
]
}
#
In the following example we retrieve all the properties of the org.fedoraproject.FirewallD1 interface:
# dbus-send --system --print-reply --dest=org.fedoraproject.FirewallD1 /org/fedoraproject/FirewallD1 \
org.freedesktop.DBus.Properties.GetAll string:"org.fedoraproject.FirewallD1"
method return sender=:1.7 -> dest=:1.311 reply_serial=2
array [
dict entry(
string "BRIDGE"
variant boolean true
)
dict entry(
string "interface_version"
variant string "1.1"
)
dict entry(
string "IPv6_rpfilter"
variant boolean true
)
dict entry(
string "state"
variant string "RUNNING"
)
dict entry(
string "version"
variant string "0.3.9"
)
dict entry(
string "IPv4"
variant boolean true
)
dict entry(
string "IPv6"
variant boolean true
)
]
In this example we retrieve individual properties of the org.fedoraproject.FirewallD1 interface:
# dbus-send --system --print-reply --dest=org.fedoraproject.FirewallD1 \ /org/fedoraproject/FirewallD1 org.freedesktop.DBus.Properties.Get \ string:"org.fedoraproject.FirewallD1" string:"version" method return sender=:1.7 -> dest=:1.328 reply_serial=2 variant string "0.3.9" # dbus-send --system --print-reply --dest=org.fedoraproject.FirewallD1 \ /org/fedoraproject/FirewallD1 org.freedesktop.DBus.Properties.Get \ string:"org.fedoraproject.FirewallD1" string:"interface_version" method return sender=:1.7 -> dest=:1.329 reply_serial=2 variant string "1.1" # dbus-send --system --print-reply --dest=org.fedoraproject.FirewallD1 \ /org/fedoraproject/FirewallD1 org.freedesktop.DBus.Properties.Get \ string:"org.fedoraproject.FirewallD1" string:"state" method return sender=:1.7 -> dest=:1.330 reply_serial=2 variant string "RUNNING" # dbus-send --system --print-reply=literal --dest=org.fedoraproject.FirewallD1 \ /org/fedoraproject/FirewallD1 org.freedesktop.DBus.Properties.Get \ string:"org.fedoraproject.FirewallD1" string:"state" variant RUNNING
The above output shows that RHEL 7.2 uses version firewalld release 0.3.9 – which is quite an old version of firewalld.
The following example shows you how to use dbus-send to get (view) and set (change) the default zone:
# dbus-send --system --dest=org.fedoraproject.FirewallD1 --print-reply --type=method_call \ /org/fedoraproject/FirewallD1 org.fedoraproject.FirewallD1.getDefaultZone method return sender=:1.7 -> dest=:1.133 reply_serial=2 string "public" # dbus-send --system --dest=org.fedoraproject.FirewallD1 --print-reply --type=method_call \ /org/fedoraproject/FirewallD1 org.fedoraproject.FirewallD1.setDefaultZone string:"publiciiii" Error org.freedesktop.DBus.Python.dbus.exceptions.DBusException: INVALID_ZONE: publiciiii # dbus-send --system --dest=org.fedoraproject.FirewallD1 --print-reply --type=method_call \ /org/fedoraproject/FirewallD1 org.fedoraproject.FirewallD1.setDefaultZone string:"work" method return sender=:1.7 -> dest=:1.344 reply_serial=2 # dbus-send --system --dest=org.fedoraproject.FirewallD1 --print-reply --type=method_call \ /org/fedoraproject/FirewallD1 org.fedoraproject.FirewallD1.getDefaultZone method return sender=:1.7 -> dest=:1.345 reply_serial=2 string "work" #
Well, time to end this post. The above examples should be sufficient to enable you to gain an understanding of how use the D-Bus interface to firewallld. Whilst I used the dbus-send utility, with slight sytax modifications the examples will also work with the Qt qdbus utility.
All the examples provided above work on RHEL 7.2 but there is no guarantee that they will work on later releases of RHEL, or downstream distrubutions, as firewalld is still in fairly active development.
Enjoy!
