{"id":678,"date":"2018-05-22T17:42:21","date_gmt":"2018-05-22T10:42:21","guid":{"rendered":"http:\/\/www.otakudang.org\/?p=678"},"modified":"2018-05-22T17:42:21","modified_gmt":"2018-05-22T10:42:21","slug":"mencoba-firewalld-sebagai-pengganti-iptables","status":"publish","type":"post","link":"https:\/\/www.otakudang.org\/?p=678","title":{"rendered":"Mencoba &#8216;firewalld&#8217; Sebagai Pengganti &#8216;iptables&#8217;"},"content":{"rendered":"<p>Dari awal dulu kenal\u00a0<em>ipchains<\/em> trus ganti jadi\u00a0<em>iptables<\/em>. Belum sempet mainan sampe ngeh banget, eh sekarang sudah ada\u00a0<em>firewalld<\/em>. Karena kebanyakan berkutat dengan distro Centos 7 yang defaultnya menggunakan\u00a0<em>firewalld<\/em>, akhirnya mau ndak mau ya harus ngeh juga walaupun sedikit-sedikit. Sebelumnya saya pernah posting soal\u00a0<em>iptables<\/em> untuk Asterisk di <a href=\"http:\/\/www.otakudang.org\/?p=208\">sini<\/a>. Jadi saya coba ndak jauh-jauh mengingat perintah berikut ini untuk server-server VoIP saya. Yang biasanya saya lakukan sebagai berikut:<\/p>\n<p>Mengaktifkan\u00a0<em>firewalld\u00a0<\/em>agar secara default up setelah reboot atau start.<\/p>\n<pre># systemctl enable firewalld\r\n# systemctl start firewalld\r\n<\/pre>\n<p>Mengganti port ssh dari 22 ke 8022 (soalnya kalo ndak begitu, selalu di<em>probe<\/em> dari mana-mana):<\/p>\n<pre># firewall-cmd --permanent --zone=public --add-port=8022\/tcp\r\n# firewall-cmd --permanent --zone=public --remove-service=ssh\r\n<\/pre>\n<p>Lalu menambahkan port-port penting untuk produksi:<\/p>\n<pre># firewall-cmd --permanent --zone=public --add-service={http,https}\r\n# firewall-cmd --permanent --zone=public --add-port={5060,5061,7000,7001,8000,8443,11000}\/tcp\r\n# firewall-cmd --permanent --zone=public --add-port={5060,5061,7000,7001,8000,8443,11000}\/udp\r\n# firewall-cmd --permanent --zone=public --add-port=16384-32784\/udp\r\n<\/pre>\n<p>Lalu menambahkan blok ip address yang diperbolehkan untuk mengakses service ke server:<\/p>\n<pre># firewall-cmd --permanent --zone=public --add-rich-rule='rule family=\"ipv4\" source address=\"1.2.3.4\" accept'\r\n# firewall-cmd --permanent --zone=public --add-rich-rule='rule family=\"ipv4\" source address=\"6.7.8.0\/24\" accept'\r\n<\/pre>\n<p>Optional, kita bisa menambahkan blocking ICMP. Pertama, kita bisa lihat list tipe ICMP:<\/p>\n<pre>#\u00a0firewall-cmd --get-icmptypes\r\naddress-unreachable bad-header communication-prohibited destination-unreachable echo-reply echo-request fragmentation-needed host-precedence-violation host-prohibited host-redirect host-unknown host-unreachable ip-header-bad neighbour-advertisement neighbour-solicitation network-prohibited network-redirect network-unknown network-unreachable no-route packet-too-big parameter-problem port-unreachable precedence-cutoff protocol-unreachable redirect required-option-missing router-advertisement router-solicitation source-quench source-route-failed time-exceeded timestamp-reply timestamp-request tos-host-redirect tos-host-unreachable tos-network-redirect tos-network-unreachable ttl-zero-during-reassembly ttl-zero-during-transit unknown-header-type unknown-option\r\n<\/pre>\n<p>dari list di atas misal kita akan melakukan block\u00a0<em>echo-reply<\/em>:<\/p>\n<pre># firewall-cmd --permanent --zone=public --add-icmp-block=echo-reply\r\n<\/pre>\n<p>Jika dirasa sudah cukup, reload rule di atas dengan perintah:<\/p>\n<pre># firewall-cmd --reload\r\n<\/pre>\n<p>Dari contoh di atas, sudah keliatan polanya kan? Jika masih belum juga, url berikut ini bisa membantu menjelaskan cara kerja\u00a0<em>firewalld<\/em> dengan lebih jelas.<\/p>\n<ul>\n<li><a href=\"https:\/\/www.digitalocean.com\/community\/tutorials\/how-to-set-up-a-firewall-using-firewalld-on-centos-7\">https:\/\/www.digitalocean.com\/community\/tutorials\/how-to-set-up-a-firewall-using-firewalld-on-centos-7<\/a><\/li>\n<\/ul>\n<p>Selamat mencoba!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Dari awal dulu kenal\u00a0ipchains trus ganti jadi\u00a0iptables. Belum sempet mainan sampe ngeh banget, eh sekarang sudah ada\u00a0firewalld. Karena kebanyakan berkutat dengan distro Centos 7 yang defaultnya menggunakan\u00a0firewalld, akhirnya mau ndak mau ya harus ngeh juga walaupun sedikit-sedikit. Sebelumnya saya pernah posting soal\u00a0iptables untuk Asterisk di sini. Jadi saya coba ndak jauh-jauh mengingat perintah berikut ini &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/www.otakudang.org\/?p=678\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;Mencoba &#8216;firewalld&#8217; Sebagai Pengganti &#8216;iptables&#8217;&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-678","post","type-post","status-publish","format-standard","hentry","category-etc","entry"],"_links":{"self":[{"href":"https:\/\/www.otakudang.org\/index.php?rest_route=\/wp\/v2\/posts\/678","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.otakudang.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.otakudang.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.otakudang.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.otakudang.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=678"}],"version-history":[{"count":3,"href":"https:\/\/www.otakudang.org\/index.php?rest_route=\/wp\/v2\/posts\/678\/revisions"}],"predecessor-version":[{"id":681,"href":"https:\/\/www.otakudang.org\/index.php?rest_route=\/wp\/v2\/posts\/678\/revisions\/681"}],"wp:attachment":[{"href":"https:\/\/www.otakudang.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=678"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.otakudang.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=678"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.otakudang.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=678"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}