Do I need firewalld

Just installed leap 15.0 up from Leap 42.3 on a new desktop PC. [Asus Prime Z390A i7-9700K 32GB ram]
As is my custom, due to a particular program I run I immediately turn off the firewall.
I am behind a router/modem and have been told I do not need a software firewall.
The things I always do on a new install are:
*Turn off the firewall
Create a ‘static’ ip in my router for the PC
Setup my internet in Yast>Network settings
Make sure the ports are forwarded in my router
Start my program to make sure people are able to receive data from me and vice versa
*I have been doing this since opensuse 11.0 and never had any problems.

Enter *firewalld *
Obviously change isn’t always easy and I am not sure firewalld is the problem, but things are not working seemlessly as they usually do and firewalld is something that is new to me and different to my normal setup.

I have tried stopping and disabling firewalld and checked my ports [42868 tcp and 34219 udp] but they remain closed or something.

dabud@linux-gyy8:~> firewall-cmd --stat
not running
dabud@linux-gyy8:~> sudo lsof -i -P -n | grep LISTEN
cupsd     1078   root    7u  IPv4  22145      0t0  TCP 127.0.0.1:631 (**LISTEN**)
kdeconnec 1868  dabud   13u  IPv6  23432      0t0  TCP *:1716 (**LISTEN**)


For testing purposes with firewalld running how could I open all ports?

Do I need this software - firewalld ?

Can this firewalld be uninstalled?

Could there be something else new to Leap that was different [internet wise] from Leap42.3?

If you are behind an internet firewall already and trust all other hosts on your private LAN, then you can make the reasonable (and educated) choice as an administrator to disable the firewall. All that’s needed is to stop and disable it…

sudo systemctl stop firewalld
sudo systemctl disable firewalld

Can you explain a bit more about what you’re trying to achieve here? Do you run services that need to be accessed externally, or are you trying to reach an external service? A bit more information might help us help you.

Thanks for replying deano_ferrari
Yes I have tried those commands

sudo systemctl stop firewalld  and sudo systemctl disable firewalld and firewall-cmd --stat

and it tells me it is stopped, disabled and not running, but when I do

sudo lsof -i -P -n | grep LISTEN

I get

dabud@linux-gyy8:~> sudo lsof -i -P -n | grep LISTENcupsd     1078   root    7u  IPv4  22145      0t0  TCP 127.0.0.1:631 (**LISTEN****)
kdeconnec 1868  dabud   13u  IPv6  23432      0t0  TCP *:1716 (**LISTEN****)****

What I need to find out is why my other open ports are not showing?

How would I do that?
Is this command

lsof -i -P -n | grep LISTEN

the correct one for this or is there another?

I believe I have seen similar behaviour to what you’re seeing - in the
end, I configured firewalld (too may things like Docker, VirtualBox, &c
trying to add their own firewall rules causing all kinds of confusion).

Jim


Jim Henderson
openSUSE Forums Administrator
Forum Use Terms & Conditions at http://tinyurl.com/openSUSE-T-C

I alwqays used (and stll prefer)

netstat -tulp

but I tried your’s:

boven:~ # lsof -i -P -n | grep LISTEN
systemd      1   root   60u  IPv4   2518      0t0  TCP *:111 (LISTEN)
systemd      1   root   62u  IPv6   2520      0t0  TCP *:111 (LISTEN)
rpcbind    596    rpc    4u  IPv4   2518      0t0  TCP *:111 (LISTEN)
rpcbind    596    rpc    6u  IPv6   2520      0t0  TCP *:111 (LISTEN)
cupsd      623   root    7u  IPv4  20392      0t0  TCP *:631 (LISTEN)
cupsd      623   root    8u  IPv6  20393      0t0  TCP *:631 (LISTEN)
xinetd    1250   root    5u  IPv6  22417      0t0  TCP *:21 (LISTEN)
xinetd    1250   root    6u  IPv6  22418      0t0  TCP *:873 (LISTEN)
rpc.statd 1264  statd    9u  IPv4  25209      0t0  TCP *:55981 (LISTEN)
rpc.statd 1264  statd   11u  IPv6  25213      0t0  TCP *:42983 (LISTEN)
rpc.mount 1265   root    8u  IPv4  22153      0t0  TCP *:20048 (LISTEN)
rpc.mount 1265   root   10u  IPv6  22157      0t0  TCP *:20048 (LISTEN)
mysqld    1281  mysql   18u  IPv4  26851      0t0  TCP 127.0.0.1:3306 (LISTEN)
httpd-pre 1293   root    4u  IPv6  25406      0t0  TCP *:80 (LISTEN)
httpd-pre 1293   root    6u  IPv6  25409      0t0  TCP *:443 (LISTEN)
httpd-pre 1599 wwwrun    4u  IPv6  25406      0t0  TCP *:80 (LISTEN)
httpd-pre 1599 wwwrun    6u  IPv6  25409      0t0  TCP *:443 (LISTEN)
httpd-pre 1600 wwwrun    4u  IPv6  25406      0t0  TCP *:80 (LISTEN)
httpd-pre 1600 wwwrun    6u  IPv6  25409      0t0  TCP *:443 (LISTEN)
httpd-pre 1601 wwwrun    4u  IPv6  25406      0t0  TCP *:80 (LISTEN)
httpd-pre 1601 wwwrun    6u  IPv6  25409      0t0  TCP *:443 (LISTEN)
httpd-pre 1603 wwwrun    4u  IPv6  25406      0t0  TCP *:80 (LISTEN)
httpd-pre 1603 wwwrun    6u  IPv6  25409      0t0  TCP *:443 (LISTEN)
httpd-pre 1604 wwwrun    4u  IPv6  25406      0t0  TCP *:80 (LISTEN)
httpd-pre 1604 wwwrun    6u  IPv6  25409      0t0  TCP *:443 (LISTEN)
master    1713   root   13u  IPv4  24541      0t0  TCP 127.0.0.1:25 (LISTEN)
master    1713   root   14u  IPv6  24542      0t0  TCP ::1]:25 (LISTEN)
kdeconnec 2111   henk   13u  IPv6  30095      0t0  TCP *:1716 (LISTEN)
boven:~ #

As you see, all my LISTENING services are there. But when you remove those due to services started by me (Apache, MariaDB, NFS, rsync), there aren’t much.

OTOH, this is only on the LAN, like you I have a router to the internet that I can manage and nothing is opened from the outside. I also do not run a firewall on my internal systems.

You can check the status with

sudo systemctl status firewalld

but when I do

sudo lsof -i -P -n | grep LISTEN

I get

dabud@linux-gyy8:~> sudo lsof -i -P -n | grep LISTENcupsd     1078   root    7u  IPv4  22145      0t0  TCP 127.0.0.1:631 (**LISTEN****)
kdeconnec 1868  dabud   13u  IPv6  23432      0t0  TCP *:1716 (**LISTEN****)****

What I need to find out is why my other open ports are not showing?

Again, what processes do you have running that should be listening to those ports? More info please!

sudo ss -ltnp

After consulting the lsof man page, i did

boven:~ # lsof -i -n  | grep LISTEN
systemd      1   root   60u  IPv4   2518      0t0  TCP *:sunrpc (LISTEN)
systemd      1   root   62u  IPv6   2520      0t0  TCP *:sunrpc (LISTEN)
rpcbind    596    rpc    4u  IPv4   2518      0t0  TCP *:sunrpc (LISTEN)
rpcbind    596    rpc    6u  IPv6   2520      0t0  TCP *:sunrpc (LISTEN)
cupsd      623   root    7u  IPv4  20392      0t0  TCP *:ipp (LISTEN)
cupsd      623   root    8u  IPv6  20393      0t0  TCP *:ipp (LISTEN)
xinetd    1250   root    5u  IPv6  22417      0t0  TCP *:ftp (LISTEN)
xinetd    1250   root    6u  IPv6  22418      0t0  TCP *:rsync (LISTEN)
rpc.statd 1264  statd    9u  IPv4  25209      0t0  TCP *:55981 (LISTEN)
rpc.statd 1264  statd   11u  IPv6  25213      0t0  TCP *:42983 (LISTEN)
rpc.mount 1265   root    8u  IPv4  22153      0t0  TCP *:mountd (LISTEN)
rpc.mount 1265   root   10u  IPv6  22157      0t0  TCP *:mountd (LISTEN)
mysqld    1281  mysql   18u  IPv4  26851      0t0  TCP 127.0.0.1:mysql (LISTEN)
httpd-pre 1293   root    4u  IPv6  25406      0t0  TCP *:http (LISTEN)
httpd-pre 1293   root    6u  IPv6  25409      0t0  TCP *:https (LISTEN)
httpd-pre 1599 wwwrun    4u  IPv6  25406      0t0  TCP *:http (LISTEN)
httpd-pre 1599 wwwrun    6u  IPv6  25409      0t0  TCP *:https (LISTEN)
httpd-pre 1600 wwwrun    4u  IPv6  25406      0t0  TCP *:http (LISTEN)
httpd-pre 1600 wwwrun    6u  IPv6  25409      0t0  TCP *:https (LISTEN)
httpd-pre 1601 wwwrun    4u  IPv6  25406      0t0  TCP *:http (LISTEN)
httpd-pre 1601 wwwrun    6u  IPv6  25409      0t0  TCP *:https (LISTEN)
httpd-pre 1603 wwwrun    4u  IPv6  25406      0t0  TCP *:http (LISTEN)
httpd-pre 1603 wwwrun    6u  IPv6  25409      0t0  TCP *:https (LISTEN)
httpd-pre 1604 wwwrun    4u  IPv6  25406      0t0  TCP *:http (LISTEN)
httpd-pre 1604 wwwrun    6u  IPv6  25409      0t0  TCP *:https (LISTEN)
master    1713   root   13u  IPv4  24541      0t0  TCP 127.0.0.1:smtp (LISTEN)
master    1713   root   14u  IPv6  24542      0t0  TCP ::1]:smtp (LISTEN)
kdeconnec 2111   henk   13u  IPv6  30095      0t0  TCP *:xmsg (LISTEN)
boven:~ # 

Now we humans can better interprete the ports the system is listening on. And indeed, when you remove Apache (hhttp and https), Mariadb (mysql), NFS (sunrpc, mountd and the those from rcp.statd), CUPS (ipp) and xinetd (ftp and rsync), only smtp and xmsg are left.

@Henk: I wonder if the OP is running the lsof command as a user and missing the root-owned processes perhaps?

I do not think so, he has some “sudo” in there. Also there is not much to show for LISTENING when you do not have switched on things like I have (as I show above). He seems only to have CUPS and the KDE one.

But I admit his CODE is a bit confusingI.
@LaQuirrELL. Please only put between CODE tags exactly what you copy/paste from a terminal window. Thus not, as you did somewhere above putting between code tags

sudo systemctl stop firewalld and sudo systemctl disable firewalld and firewall-cmd --stat

because the word “and” reveals that this is a nonsense command and also all output is missing.
Also saying things like “when I do” CODE “then I get” CODE makes thinks obfuscated. That should all be in one CODE copy/paste.

Post please by copying including the line with the prompt and the command up to including the next prompt line. LIke my examples above. Only so people will trust that what the see is what you saw.

@deano_ferrari

Again, what processes do you have running that should be listening to those ports?

The process that is in question is a program called winmx and it runs through Wine. So it uses wineserver process as welL.
There are two ports I need open 42868 TCP and 34219 UDP

dabud@linux-gyy8:~> sudo ss -ltnp
[sudo] password for root:  
State      Recv-Q Send-Q                    Local Address:Port                                   Peer Address:Port               
LISTEN     0      5                               0.0.0.0:42868                                       0.0.0.0:*                   
users:(("wineserver",pid=20616,fd=130))
LISTEN     0      5                             127.0.0.1:631                                         0.0.0.0:*                   
users:(("cupsd",pid=1078,fd=7))
LISTEN     0      50                                    *:1716                                              *:*                   
users:(("kdeconnectd"


You can check the status with
Code:
sudo systemctl status firewalld

dabud@linux-gyy8:~> sudo systemctl status firewalld 
[sudo] password for root:  
● firewalld.service - firewalld - dynamic firewall daemon 
  Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: disabled) 
  Active: inactive (dead) 
    Docs: man:firewalld(1) 

May 06 16:05:25 linux-gyy8 systemd[1]: Starting firewalld - dynamic firewall daemon... 
May 06 16:05:25 linux-gyy8 systemd[1]: Started firewalld - dynamic firewall daemon. 
May 06 22:12:08 linux-gyy8 systemd[1]: Stopping firewalld - dynamic firewall daemon... 
May 06 22:12:11 linux-gyy8 systemd[1]: Stopped firewalld - dynamic firewall daemon. 
dabud@linux-gyy8:~>

dabud@linux-gyy8:~> lsof -i -n  | grep LISTEN
kdeconnec  1868 dabud   13u  IPv6  23432      0t0  TCP *:xmsg (**LISTEN**)
wineserve 20616 dabud  130u  IPv4 152431      0t0  TCP *:42868 (**LISTEN**)
dabud@linux-gyy8:~> 


@hcvv

dabud@linux-gyy8:~> sudo netstat -tulp
[sudo] password for root:  
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name     
tcp        0      0 0.0.0.0:42868           0.0.0.0:*               LISTEN      20616/wineserver     
tcp        0      0 localhost:ipp           0.0.0.0:*               LISTEN      1078/cupsd           
tcp6       0      0 ::]:xmsg               ::]:*                  LISTEN      1868/kdeconnectd     
udp        0      0 localhost:323           0.0.0.0:*                           1529/chronyd         
udp        0      0 0.0.0.0:34219           0.0.0.0:*                           20613/C:\Program Fi 
udp        0      0 0.0.0.0:50983           0.0.0.0:*                           1077/avahi-daemon:   
udp        0      0 224.0.0.251:mdns        0.0.0.0:*                           7946/chrome --type=  
udp        0      0 224.0.0.251:mdns        0.0.0.0:*                           7879/chrome          
udp        0      0 0.0.0.0:mdns            0.0.0.0:*                           1077/avahi-daemon:   
udp6       0      0 localhost:323           ::]:*                              1529/chronyd         
udp6       0      0 ::]:xmsg               ::]:*                              1868/kdeconnectd     
udp6       0      0 ::]:37416              ::]:*                              1077/avahi-daemon:   
udp6       0      0 ::]:mdns               ::]:*                              1077/avahi-daemon:   
dabud@linux-gyy8:~> 

I see that 42868 is listening, but 34219 is not. What do I do to get [34219] listening?


dabud@linux-gyy8:~> sudo systemctl stop firewalld
[sudo] password for root:  
dabud@linux-gyy8:~> sudo systemctl disable firewalld
dabud@linux-gyy8:~> firewall-cmd --stat
not running
dabud@linux-gyy8:~> 


dabud@linux-gyy8:~> sudo systemctl status firewalld
[sudo] password for root:  
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: disabled)
   Active: inactive (dead)
     Docs: man:firewalld(1)

May 06 16:05:25 linux-gyy8 systemd[1]: Starting firewalld - dynamic firewall daemon...
May 06 16:05:25 linux-gyy8 systemd[1]: Started firewalld - dynamic firewall daemon.
May 06 22:12:08 linux-gyy8 systemd[1]: Stopping firewalld - dynamic firewall daemon...
May 06 22:12:11 linux-gyy8 systemd[1]: Stopped firewalld - dynamic firewall daemon.
dabud@linux-gyy8:~>

That one is UPD, not TCP. The list you ask for is already the list of listening ports. What you see in that column is the State. For TCP the State is LISTEN. For UPD things are done different and the word LISTEN is not shown.

When you read the man page (you realy should read man pages ;)):

State

The state of the socket. Since there are no states in raw mode and usually no states used in UDP and UDPLite, this column may be left blank.

@hcvv

State
The state of the socket. Since there are no states in raw mode and usually no states used in UDP and UDPLite, this column may be left blank. Normally this can be one of several values:

When it says

normally this can be one of several values
does that mean the UDP port or both UDP and TCP?
So if the UDP port doesn’t usually show STATE how can it be established that it is working the way my program/service needs it to be ?
it always did before.
And where would I start looking to solve this problem if the UDP port is OPEN and all the conditions of the program/service are met but It is only working on the TCP port part not the UDP port part.
It is the same program I have been using for years and there have been no updates on it. So nothing has changed there. I have always run it in opensuse through Wine since openSuse 11.0 with no difficulties.

dabud@linux-gyy8:~> netstat -atu
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       
tcp        0      0 0.0.0.0:42868           0.0.0.0:*               LISTEN      
tcp        0      0 localhost:ipp           0.0.0.0:*               LISTEN      
tcp        0    146 linux-gyy8:44850        47-192-73-28.drr02:6699 ESTABLISHED
tcp        0      0 linux-gyy8:37370        a23-14-154-19.dep:https ESTABLISHED
tcp        0      0 linux-gyy8:33628        cloudproxy10003.s:https ESTABLISHED
tcp        0      0 localhost:44277         localhost:40004         ESTABLISHED
tcp        0    981 linux-gyy8:60944        softbank1260101971:6699 ESTABLISHED
tcp        0    114 linux-gyy8:43126        cpc77859-stav20-2-:6698 ESTABLISHED
tcp        9   1514 linux-gyy8:41222        209-225-105-68.sou:6699 ESTABLISHED
tcp        0      0 linux-gyy8:38274        104.19.198.151:https    ESTABLISHED
tcp        0      0 localhost:40004         localhost:44277         ESTABLISHED
tcp        0      0 linux-gyy8:59620        ec2-3-210-29-106.:https ESTABLISHED
tcp        0    398 linux-gyy8:48324        p265079-ipngn20020:5335 ESTABLISHED
tcp6       0      0 ::]:xmsg               ::]:*                  LISTEN      
udp        0      0 localhost:323           0.0.0.0:*                           
udp        0      0 0.0.0.0:34219           0.0.0.0:*                           
udp        0      0 0.0.0.0:50983           0.0.0.0:*                           
udp        0      0 224.0.0.251:mdns        0.0.0.0:*                           
udp        0      0 224.0.0.251:mdns        0.0.0.0:*                           
udp        0      0 0.0.0.0:mdns            0.0.0.0:*                           
udp6       0      0 localhost:323           ::]:*                              
udp6       0      0 ::]:xmsg               ::]:*                              
udp6       0      0 ::]:37416              ::]:*                              
udp6       0      0 ::]:mdns               ::]:* 
dabud@linux-gyy8:~> netstat -vaun
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       
udp        0      0 127.0.0.1:323           0.0.0.0:*                           
udp        0      0 0.0.0.0:34219           0.0.0.0:*                           
udp        0      0 0.0.0.0:50983           0.0.0.0:*                           
udp        0      0 224.0.0.251:5353        0.0.0.0:*                           
udp        0      0 224.0.0.251:5353        0.0.0.0:*                           
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           
udp6       0      0 ::1:323                 :::*                                
udp6       0      0 :::1716                 :::*                                
udp6       0      0 :::37416                :::*                                
udp6       0      0 :::5353                 :::* 
dabud@linux-gyy8:~> lsof -i udp
COMMAND     PID  USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
kdeconnec  1868 dabud   12u  IPv6  23431      0t0  UDP *:xmsg  
chrome     7879 dabud  128u  IPv4  54382      0t0  UDP 224.0.0.251:mdns  
chrome     7946 dabud   53u  IPv4  52025      0t0  UDP 224.0.0.251:mdns  
WinMX.exe 20613 dabud   26u  IPv4 152434      0t0  UDP *:34219  
wineserve 20616 dabud  139u  IPv4 152434      0t0  UDP *:34219  
dabud@linux-gyy8:~

>

Aren’t we going a bit off-topic now? This thread is about “Do I need firewalld”.

New question, new thread with a new title that will draw the attention of maybe other people that know something about your application.

I can only tell you what the netstat man page says about it’s output.

The output lists that that UDP port is open. When you nevertheless say that the application “does not work”, that may have miriads of causes, So getting the attention of those who know the program (and Wine) and telling them what “not working” means might help.

Yes I guess the problem does not lay within the firewalld program.

@hcvv and deano_ferrari

Thanks for your help and advice.
I feel better for having learned something about firewalld, even tho’ it has not solved my problem.

Should I start the new thread here [Network/Internet] or move over to [Applications]?

Glad to have been of guidance. Yes, start a new thread in Applications. That’s what your problem is really about (and why I was requesting several posts back about exactly which app/process this really concerned).