- So, when firewall D was first introduced,
people complained that it wasn't offering
enough advanced features.
And that is why some solutions were proposed.
There is direct rules,
Direct rules allow admins to insert hand-coded rules.
And direct rules are processed before anything in the zones,
but it's not really recommended to use them.
The recommended interface is the rich rule.
Rich rules use an expressive language
to create custom rules
that cannot be created with basic syntax.
And you need it if you want to do
logging, or port forwards,
or masquerading, or rate limiting,
and if you want to get more information,
including some examples,
you should consult the man page,
firewalld.richlanguage.
It's a man page that contains
some pretty nice examples.
In order to compose rich rules,
you should use
firewall-cmd--add-rich-rule=''
and then between single quotes, the rules.
And if you read the man page
for firewalld.richlanguage,
you will see some rule examples.
Let me demonstrate.
So to start with I would like to show you
firewalld.richlanguage.
This is the rich language documentation.
In this rich language documentation,
you find these examples.
Now what is confusing about these examples is
that you just have the rule itself.
So in front of it you need to use
firewall-cmd --add-rich-rule=
And then between single quotes, this entire rule
I would advise, go have a look, get inspired
because it's pretty nicely explaining how to
use each of these rules.
Now let's have a look at the
the demo that I prepared to firewall-cmd --permanent --
zone=public --add-rich-rule='rule family=ipv4
source address=192.168.29.220 reject'
And here you can see success.
Next, let's also add another rule.
We can keep the beginning.
So add-rich-rule=' and this time rule service name=htp
log limit value is three per minutes.
- And accept. Small typo. So what is this doing?
Well, this is going to log HTP packets with a maximum
of three per minute so that your log is not getting flooded.
And another one is where we can use a rule
protocol value is igmp
accept igmp is one of these routing protocols.
And here, if you want to to know what exactly
the protocol is about, then have a look at etc protocols.
So etc protocols is defining the different
protocols that are available.
So all of these protocols can be used.
Now one more, and that is a rule.
Family is ipv4. Source address= 10.0.0.0/24.
So anything coming from the network
10.0.0.0 port is 7,900 up to 7,905.
And protocol is tcp.
And that's what we are going to accept as well.
Uh oh, forgetting something.
We don't have the element
and we don't have the element because it looks like a typo.
We are missing port here.
So the error is telling us invalid rule attribute port
outside of any element.
So after source we have the element source where
we specify the address
and then we have the element port where
we specify the port rates and that should be doing it.
There we go. Now it is successful.
I wanted to make this error because these elements
are a little bit confusing and when you see it
in the documentation, you think, "oh this is a typo.
We have port and port equals, that doesn't make sense."
Well, it does make sense.
OK, one more. And that is the rich rule where we
are going to use service name=ssh log prefix="ssh" level=
"notice" and limit value is two per minute.
And that's what we are going to accept as well.
Uh Oh, it's opening a secondary prompt.
Why is it opening a secondary prompt?
Well, for the simple reason that I made an error
in the quotes, I used double quotes
to the end instead of single quote.
Now we're good. So at this point, what is going to happen
if you use firewalls-cmd --list-all?
Where are all my beautiful rich rules?
Well, my beautiful rich rules aren't there
because I've added all of them using -- permanent.
And if you use -- permanent, you write it
to the persistent configuration but not to ruin time.
So I need to restart the firewalld
and then I can do this list all again.
And there we can see all the rules are being listed
and that's how you add rich rules.