How to Disable or Turn Off Firewalld on CentOS 7?

Introduction

Firewalld is a dynamic firewall management tool that is included in CentOS 7. It replaces the previous iptables service as the default firewall tool for CentOS 7.

Firewalld is designed to make it easier to manage firewall rules and provide more flexibility in defining policies and rulesets. The primary purpose of Firewalld on CentOS 7 is to protect your system from unauthorized access by blocking inbound traffic that does not match specific rules or policies.

It also allows you to define different network zones with different levels of security based on the level of trust you have for a particular network or interface. Despite its benefits, there are some reasons why someone might want to disable or turn off Firewalld.

Understanding Firewalld on CentOS 7

Firewalld is a firewall management tool that comes bundled with CentOS 7. It is designed to provide the administrator with an easy-to-use interface for managing firewall rules on the system. Firewalld uses zones to group incoming traffic and services based on their intended use.

By default, CentOS 7 has several predefined zones: public, external, internal, dmz and others. Each zone has its own set of predefined rules that dictate how incoming traffic should be handled.

For example, the public zone allows incoming HTTP and HTTPS traffic while blocking all other incoming traffic by default. The external zone is similar but allows additional protocols such as SMTP or POP3 email traffic.

FirewallD also has a rich set of services that can be enabled or disabled according to the administrator's needs. These services are essentially pre-defined collections of ports and protocols grouped together for easy management within different zones.

Different Zones in Firewalld

As mentioned earlier, Firewalld uses zones to segregate incoming traffic based on their intended use. Here's a brief overview of the different zones available in CentOS 7−

• Public − Suitable for systems connected to public networks like the internet. It allows incoming HTTP and HTTPS traffic while blocking all other incoming traffic by default.

• External − Similar to the public zone but allows additional protocols such as SMTP or POP3 email traffic. - Internal: Used for LAN systems, it allows all outgoing traffic and some common services typically used by clients (e.g., DNS, DHCP).

• DMZ − Suitable for hosting servers that are accessible from both internal and external networks. It allows incoming HTTP, HTTPS, SMTP and SSH traffic while blocking everything else by default.

• Work − Used for desktop systems in a trusted network environment that require certain services like SSH or VNC remote access enabled. Understanding how Firewalld works on CentOS 7 requires a grasp of its two key components: zones and services.

Disabling or Turning Off Firewalld on CentOS 7

Firewalld is an important security feature in CentOS 7, but there are instances where you may need to disable or turn it off temporarily or permanently. In this section, we will discuss three methods of disabling or turning off Firewalld on CentOS 7.

Method 1: Using systemctl command

The systemctl command is a system daemon control utility that is used to start and stop services in CentOS 7. To disable the Firewalld service permanently, follow these steps−

• Open a terminal window as a root user.

• Enter the following command −

systemctl stop firewalld          

This will stop the Firewalld service immediately.

• Enter the following command −

systemctl disable firewalld          

This will prevent the Firewalld service from starting automatically during system boot.

Method 2: Using firewall-cmd command

The firewall-cmd command-line tool allows you to configure and manage FirewallD rules directly from the terminal window. You can use this tool to turn off specific zones temporarily or permanently by following these steps−

• Open a terminal window as a root user.

• Determine which zone(s) you want to disable by running this command−

firewall-cmd --get-active-zones          

This will display all active zones for your system.

• Use this command to turn off your chosen zone(s)−

firewall-cmd --zone=public --remove-interface=eth0 --permanent          

Replace "public" with your desired zone name, and "eth0" with your network interface name.

• Reload FirewallD rules for changes to take effect−

firewall-cmd --reload          

Method 3: Removing Firewalld package

If you don't need FirewallD at all, you can remove the entire package from your system. Removing the Firewalld package will permanently disable and remove FirewallD from CentOS 7. To do this, follow these steps−

• Open a terminal window as a root user.

• Enter the following command to uninstall the firewall-cmd package−

yum remove firewalld          

• Confirm that you want to proceed with removing the package.

• Wait for yum to complete removing the package.

Note: Removing the Firewalld package may cause issues with other services that depend on it.

Troubleshooting Common Issues When Disabling or Turning Off Firewalld

Check if firewalld is running

Before disabling or turning off Firewalld on your CentOS 7 system, you first need to check if the service is currently running. To do this, you can use the following command −

systemctl status firewalld           

If the output of the command shows that Firewalld is currently active and running, then you'll need to stop it before you can disable or turn it off. You can use the `systemctl stop firewalld` command to stop the service.

If for some reason, Firewalld keeps starting even after using these commands, ensure that `firewalld` is not enabled in systemd's bootup sequence by running−

systemctl disable firewalld           

Check if iptables service is running

FirewallD provides a high-level interface for configuring firewall rules and managing network traffic. It runs as a daemon on your system and interacts with iptables/netfilter kernel modules to enforce its rules.

You will have issues when trying to disable FirewallD if `iptables` is not installed and/or enabled on your system. Check if iptables service is running using −

systemctl status iptables          

If it's not installed or enabled run−

yum install iptables-services -y systemctl enable iptables 
systemctl start iptables

After enabling `iptables`, you should have no trouble disabling FirewallD.

Verify if ports are open

Another common issue users face when disabling Firewalld on CentOS 7 is ensuring that all required ports are open. If certain ports are blocked by default even after disabling firewallD, some services may not work correctly.

To verify which ports are currently open and accessible on your system, you can use the `nmap` command: ``` nmap localhost ```

This will give you a list of all open ports on your system. If you find that certain ports are not open, you'll need to add them to your iptables rules or services files to allow traffic through.

Conclusion

Firewalld is an important tool for securing your network and protecting your CentOS 7 system from unauthorized access. However, there may be situations in which you need to disable or turn off Firewalld temporarily or permanently. In this article, we have discussed three methods for disabling or turning off Firewalld on CentOS 7: using the systemctl command, using the firewall-cmd command, and removing the Firewalld package entirely.