documentation_complete: true

title: 'Strengthen the Default Ruleset'

description: |-
    The default rules can be strengthened. The system
    scripts that activate the firewall rules expect them to be defined
    in configuration files under the <tt>/etc/firewalld/services</tt>
    and <tt>/etc/firewalld/zones</tt> directories.
    <br /><br />
    The following recommendations describe how to strengthen the
    default ruleset configuration file. An alternative to editing this
    configuration file is to create a shell script that makes calls to
    the <tt>firewall-cmd</tt> program to load in rules under the <tt>/etc/firewalld/services</tt>
    and <tt>/etc/firewalld/zones</tt> directories.
    <br /><br />
    Instructions apply to both unless otherwise noted. Language and address
    conventions for regular firewalld rules are used throughout this section.

warnings:
    - general: |-
        The program <tt>firewall-config</tt>
        allows additional services to penetrate the default firewall rules
        and automatically adjusts the <tt>firewalld</tt> ruleset(s).
