On Sun, Jan 31, 2021 at 11:51:07PM +0000, Tim Hughes wrote:
I am trying to get a command that gives a complete listing of the
firewall
state at a point in time.
something like `iptables -L -v -n`
Newer firewalld uses nftables. So `nft list ruleset`.
I had started to write a script which loops over all the interfaces
and
then all the zones and all the other objects and I got to 5 while loops
deep and thought that there must be a better way.
# firewall-cmd --list-all-zones
# firewall-cmd --list-all-policies
In the basic use case the above will be sufficient. The latter only
applies to v0.9.0 or later.
If you use ipsets or direct rules then you'll have to list those as
well.
This is for 2 reasons. One to be able to create a diff of any changes
and
the other to be able to build a mental picture of the whole state for
debugging.
Maybe it's better to diff the configuration files in `/etc/firewalld`.