FirewallD - Invalid Zones

Yes, you could shut down and disable or remove Firewalld and use the Linux firewall if you prefer. Debian doesn’t ship a default firewall like other distros but surely iptables is installed and rules could already be setup on the Linux firewall page in Webmin.

If the Linux firewall page is empty of rules or are messed up, there should be a button toward the bottom that resets to a fresh set of fundamental rules.

The Webmin UI for Firewalld doesn’t have that but there’s a way to reset to defaults at the command line:

firewalld --permanent --reset-to-defaults

Check if the public zone is active.

firewall-cmd --zone=public --list-all

If it’s active see how Firewalld in Webmin works at this point.

If you’re still seeing errors about zones look in /etc/firewalld/zones and make sure public.xml and other default zone files exist. Default zones should have been created when the service started and are updated when new rules are applied. If .xml zone files are missing or messed up you can try replacing them from boilerplate files. (Bear in mind I’m accustomed to a CentOS directory structure, Debian’s could be different.)

rm -rf  /etc/firewalld/zones/
cp -r /usr/lib/firewalld/zones  /etc/firewalld/zones

Then try

firewall-cmd --reload
firewall-cmd --zone=public --list-all

If the public zone shows as active try again in Webmin to apply rules to it.

If you are new to firewalls Richard’s CSF suggestion is a good one. I’m comfortable with Firewalld and grew to like its zone system. But next time I’m starting from scratch I’ll be trying CSF and ditching Fail2ban. First thing to know is to install CSF first with Debian’s package manager, then install the Webmin module while it’s running.

1 Like