<\/span><\/h3>\nKal\u0131c\u0131 (permanent) modda bir kural ekledi\u011finizde veya de\u011fi\u015ftirdi\u011finizde, bu kural\u0131n anl\u0131k (runtime) yap\u0131land\u0131rmaya uygulanarak aktif hale gelmesi i\u00e7in Firewalld’nin yap\u0131land\u0131rmas\u0131n\u0131 yeniden y\u00fcklemeniz gerekir. Bu i\u015flem, servisi tamamen yeniden ba\u015flatmaktan daha h\u0131zl\u0131d\u0131r ve mevcut aktif ba\u011flant\u0131lar\u0131 sonland\u0131rmaz.<\/p>\n
sudo firewall-cmd --reload<\/code><\/p>\nBu komut, kal\u0131c\u0131 yap\u0131land\u0131rmay\u0131 okur ve mevcut \u00e7al\u0131\u015fan yap\u0131land\u0131rmayla senkronize eder.<\/p>\n
<\/span>Firewalld B\u00f6lgeleri (Zones) ile \u00c7al\u0131\u015fma<\/span><\/h2>\nFirewalld’nin en g\u00fc\u00e7l\u00fc \u00f6zelliklerinden biri, kural y\u00f6netimini basitle\u015ftiren ve farkl\u0131 g\u00fcven senaryolar\u0131na uyum sa\u011flayan b\u00f6lge (zone) konseptidir. B\u00f6lgeler, sunucunuzun farkl\u0131 a\u011f aray\u00fczlerine farkl\u0131 g\u00fcvenlik politikalar\u0131 uygulaman\u0131za olanak tan\u0131r. \u00d6rne\u011fin, genel internete a\u00e7\u0131k bir aray\u00fcz i\u00e7in \u00e7ok k\u0131s\u0131tlay\u0131c\u0131 kurallar uygularken, \u00f6zel bir y\u00f6netim a\u011f\u0131na ba\u011fl\u0131 ba\u015fka bir aray\u00fcz i\u00e7in daha esnek kurallar belirleyebilirsiniz.<\/p>\n
<\/span>B\u00f6lgeler (Zones) Nedir ve Nas\u0131l \u00c7al\u0131\u015f\u0131r?<\/span><\/h3>\nB\u00f6lgeler, a\u011f aray\u00fczlerinin (network interfaces) veya kaynak IP adreslerinin atand\u0131\u011f\u0131 \u00f6nceden tan\u0131mlanm\u0131\u015f kural setleridir. Bir a\u011f paketinin sunucuya nereden geldi\u011fine ba\u011fl\u0131 olarak, o paketin hangi b\u00f6lgenin kurallar\u0131na tabi olaca\u011f\u0131 belirlenir. Firewalld, bir ba\u011flant\u0131 i\u00e7in en spesifik e\u015fle\u015fen b\u00f6lgeyi bulmaya \u00e7al\u0131\u015f\u0131r. \u00d6nce paketin kaynak IP’sine atanm\u0131\u015f bir b\u00f6lge olup olmad\u0131\u011f\u0131na bakar. Yoksa, paketin geldi\u011fi a\u011f aray\u00fcz\u00fcne atanm\u0131\u015f b\u00f6lgenin kurallar\u0131n\u0131 uygular. Hi\u00e7bir aray\u00fcz veya kaynak bir b\u00f6lgeye atanmam\u0131\u015fsa, varsay\u0131lan b\u00f6lgenin kurallar\u0131 ge\u00e7erli olur.<\/p>\n
<\/span>Sunucudaki Mevcut B\u00f6lgeleri ve Varsay\u0131lan B\u00f6lgeyi Listeleme<\/span><\/h3>\nSisteminizde hangi b\u00f6lgelerin tan\u0131ml\u0131 oldu\u011funu ve hangisinin varsay\u0131lan olarak kullan\u0131ld\u0131\u011f\u0131n\u0131 kolayca listeleyebilirsiniz.<\/p>\n
\n- T\u00fcm mevcut b\u00f6lgeleri listelemek i\u00e7in:<\/strong>
firewall-cmd --get-zones<\/code>
Bu komut size `block`, `dmz`, `drop`, `external`, `home`, `internal`, `public`, `trusted`, `work` gibi \u00f6n tan\u0131ml\u0131 b\u00f6lgelerin listesini verecektir.<\/li>\n- Varsay\u0131lan b\u00f6lgeyi \u00f6\u011frenmek i\u00e7in:<\/strong>
firewall-cmd --get-default-zone<\/code>
Genellikle bu komutun \u00e7\u0131kt\u0131s\u0131 `public` olacakt\u0131r.<\/li>\n<\/ul>\n<\/span>Varsay\u0131lan B\u00f6lgeyi De\u011fi\u015ftirme<\/span><\/h3>\nHerhangi bir a\u011f aray\u00fcz\u00fcne \u00f6zel bir b\u00f6lge atanmad\u0131\u011f\u0131nda kullan\u0131lacak olan varsay\u0131lan b\u00f6lgeyi de\u011fi\u015ftirebilirsiniz. \u00d6rne\u011fin, daha k\u0131s\u0131tlay\u0131c\u0131 bir politika uygulamak isterseniz varsay\u0131lan b\u00f6lgeyi `dmz` veya `work` olarak ayarlayabilirsiniz. Bu de\u011fi\u015fiklik kal\u0131c\u0131 olacakt\u0131r.<\/p>\n
sudo firewall-cmd --set-default-zone=work<\/code><\/p>\nDe\u011fi\u015fikli\u011fin uygulanmas\u0131 i\u00e7in `–reload` komutunu \u00e7al\u0131\u015ft\u0131rman\u0131z gerekebilir.<\/p>\n
<\/span>Bir A\u011f Aray\u00fcz\u00fcn\u00fc Farkl\u0131 Bir B\u00f6lgeye Atama<\/span><\/h3>\nSunucunuzda birden fazla a\u011f aray\u00fcz\u00fc varsa (\u00f6rne\u011fin `eth0` genel a\u011f i\u00e7in, `eth1` \u00f6zel a\u011f i\u00e7in), her birine farkl\u0131 bir b\u00f6lge atayabilirsiniz. \u00d6rne\u011fin, `eth1` aray\u00fcz\u00fcn\u00fc daha g\u00fcvenli olan `internal` b\u00f6lgesine atamak i\u00e7in a\u015fa\u011f\u0131daki komutu kullanabilirsiniz. Bu komut hem anl\u0131k hem de kal\u0131c\u0131 de\u011fi\u015fiklik yapar.<\/p>\n
sudo firewall-cmd --zone=internal --change-interface=eth1 --permanent<\/code><\/p>\nArd\u0131ndan yap\u0131land\u0131rmay\u0131 yeniden y\u00fckleyin: sudo firewall-cmd --reload<\/code><\/p>\n<\/span>\u00d6n Tan\u0131ml\u0131 B\u00f6lgelerin \u0130ncelenmesi (public, home, work, dmz vb.)<\/span><\/h3>\nFirewalld, yayg\u0131n kullan\u0131m senaryolar\u0131 i\u00e7in bir dizi \u00f6n tan\u0131ml\u0131 b\u00f6lge ile birlikte gelir. Her b\u00f6lgenin kendine \u00f6zg\u00fc bir g\u00fcven seviyesi ve varsay\u0131lan politikas\u0131 vard\u0131r.<\/p>\n
\n
\n\n\n| B\u00f6lge Ad\u0131<\/th>\n | G\u00fcven Seviyesi<\/th>\n | Varsay\u0131lan Davran\u0131\u015f ve Kullan\u0131m Amac\u0131<\/th>\n<\/tr>\n<\/thead>\n |
\n\ndrop<\/strong><\/td>\n| En D\u00fc\u015f\u00fck<\/td>\n | Gelen t\u00fcm paketleri hi\u00e7bir yan\u0131t vermeden sessizce d\u00fc\u015f\u00fcr\u00fcr. Engellenen taraf, sunucunun var olup olmad\u0131\u011f\u0131n\u0131 anlayamaz.<\/td>\n<\/tr>\n | \nblock<\/strong><\/td>\n| D\u00fc\u015f\u00fck<\/td>\n | Gelen t\u00fcm paketleri reddeder ve kar\u015f\u0131 tarafa “icmp-host-prohibited” mesaj\u0131 g\u00f6nderir. Engellenen taraf, bir g\u00fcvenlik duvar\u0131 taraf\u0131ndan engellendi\u011fini anlar.<\/td>\n<\/tr>\n | \npublic<\/strong><\/td>\n| G\u00fcvensiz<\/td>\n | Genel ve g\u00fcvenilmeyen a\u011flar i\u00e7in kullan\u0131l\u0131r. Varsay\u0131lan olarak yaln\u0131zca se\u00e7ili servislere (genellikle SSH) izin verilir. \u00c7o\u011fu sunucunun varsay\u0131lan b\u00f6lgesidir.<\/td>\n<\/tr>\n | \nexternal<\/strong><\/td>\n| Orta<\/td>\n | \u00d6zellikle NAT (Masquerading) etkinle\u015ftirilmi\u015f d\u0131\u015f a\u011flar i\u00e7in kullan\u0131l\u0131r. G\u00fcven seviyesi public’e benzer.<\/td>\n<\/tr>\n | \ndmz<\/strong><\/td>\n| Orta<\/td>\n | “Demilitarized Zone” (Askerden Ar\u0131nd\u0131r\u0131lm\u0131\u015f B\u00f6lge) i\u00e7in tasarlanm\u0131\u015ft\u0131r. D\u0131\u015far\u0131dan eri\u015filebilen ancak i\u00e7 a\u011fdan izole edilmi\u015f sunucular (\u00f6rn. web sunucular\u0131) i\u00e7in kullan\u0131l\u0131r.<\/td>\n<\/tr>\n | \nwork<\/strong><\/td>\n| G\u00fcvenilir<\/td>\n | \u0130\u015f ortam\u0131ndaki bilgisayarlar i\u00e7in tasarlanm\u0131\u015ft\u0131r. \u00c7o\u011fu temel servise g\u00fcvenir.<\/td>\n<\/tr>\n | \nhome<\/strong><\/td>\n| G\u00fcvenilir<\/td>\n | Ev ortam\u0131ndaki cihazlar i\u00e7in tasarlanm\u0131\u015ft\u0131r. ‘work’ b\u00f6lgesine benzer ancak daha fazla servise g\u00fcvenir.<\/td>\n<\/tr>\n | \ninternal<\/strong><\/td>\n| \u00c7ok G\u00fcvenilir<\/td>\n | Yaln\u0131zca i\u00e7 a\u011fdaki di\u011fer sunucular i\u00e7in kullan\u0131l\u0131r. Daha fazla servise varsay\u0131lan olarak izin verilir.<\/td>\n<\/tr>\n | \ntrusted<\/strong><\/td>\n| En Y\u00fcksek<\/td>\n | A\u011fdaki t\u00fcm cihazlara tamamen g\u00fcvenir. Gelen t\u00fcm ba\u011flant\u0131lara izin verilir. \u00c7ok dikkatli kullan\u0131lmal\u0131d\u0131r.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/span>Servis ve Port Y\u00f6netimi: G\u00fcvenlik Duvar\u0131 Kurallar\u0131n\u0131 Yap\u0131land\u0131rma | | | | | | | | | |