firewalld.sh RawHistoryFolder

1#!/bin/bash
2# Post-boot: Configure firewalld for a standard desktop
3
4set -euo pipefail
5
6LOG_FILE="/var/log/archup-first-boot.log"
7log() { echo "[firewalld] $*" | tee -a "$LOG_FILE"; }
8
9log "Configuring firewalld..."
10
11systemctl enable --now firewalld.service
12
13# Use the 'public' zone — sensible defaults for a desktop on untrusted networks
14firewall-cmd --set-default-zone=public
15
16# Allow mDNS so LAN discovery (Avahi, printers, etc.) works
17firewall-cmd --permanent --zone=public --add-service=mdns
18
19# Allow DHCP client (outgoing requests to get an IP)
20firewall-cmd --permanent --zone=public --add-service=dhcpv6-client
21
22# Block everything else incoming — no SSH, no exposed ports by default
23firewall-cmd --permanent --zone=public --remove-service=ssh 2>/dev/null || true
24
25firewall-cmd --reload
26
27log "Firewall configured (zone: public, mDNS + DHCPv6 client allowed)"