firewalld (RHEL Firewall Daemon)

firewalld est le daemon de gestion firewall sur RHEL, CentOS, Fedora, SUSE — abstrait iptables (RHEL 7) ou nftables (RHEL 8+) avec un model de zones et services plus user-friendly. Permet runtime changes sans dropping connections.

Concepts : (1) **Zones** — trust levels (public, work, home, internal, dmz, trusted, drop, block, external) ; chaque interface assigned à une zone ; ; (2) **Services** — predefined groups of ports/protocols (ssh, http, https, dns) — easier que se rappeler ports numbers ; (3) **Permanent vs runtime** — `--permanent` flag save to config, runtime change immediate but lost on restart unless reloaded.

Commandes essentielles : (1) `firewall-cmd --state` — status ; (2) `firewall-cmd --list-all` — config current zone ; (3) `firewall-cmd --get-active-zones` ; (4) `firewall-cmd --zone=public --add-service=http --permanent` ; (5) `firewall-cmd --reload` ; (6) `firewall-cmd --zone=public --add-port=8080/tcp --permanent` ; (7) `firewall-cmd --list-services --zone=public` ; (8) `firewall-cmd --set-default-zone=internal` ; (9) `firewall-cmd --add-rich-rule='rule family=ipv4 source address=192.168.1.0/24 service name=ssh accept' --permanent`.

Features avancées : (1) **Rich rules** — granular conditions (source, destination, log, limit) ; (2) **Direct rules** — passthrough iptables/nftables syntax si nécessaire ; (3) **IP sets** — manage groups d'IPs efficiently ; (4) **Lockdown mode** — restrict which apps peuvent modifier rules ; (5) **Panic mode** — emergency drop all traffic.

Ubuntu équivalent : ufw (Uncomplicated Firewall). Compétences RHCSA, EX294, RHCE.