firewalld: add firewall configuration guide

[Vairamani-NI]

Summary

Adds a user-facing documentation page for firewalld on NILRT, wired into
the Tutorials section of the docs.

The guide covers:

• Checking firewall status
• The default configuration (zones, open ports)
• NI service definitions shipped with the OS
• Managing the firewall (opening/closing ports and services)
• Persisting rules across reimaging and replication
• Troubleshooting common issues

Notes

firewalld has been available in the NILRT package feed since the 2025 Q1
release and can be installed with opkg if not already present. This is
noted in the guide.

Testing

Built locally with make -C docs html — build succeeds with no warnings.

Justification

3993987

[Copilot]

Pull request overview

Adds a new user-facing documentation page describing how to configure and troubleshoot firewalld on NI Linux Real-Time (x64) targets, and links it from the docs index so it’s discoverable alongside other security/networking guides.

Changes:

• Added a new firewalld guide covering zones, NI service definitions, opening/closing services and ports, runtime vs permanent config, persistence, and troubleshooting.
• Wired the new guide into the main documentation toctree.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
docs/source/index.rst	Adds the new firewalld/firewalld page to the Tutorials toctree.
docs/source/firewalld/firewalld.rst	Introduces the complete firewalld configuration and troubleshooting guide for NILRT.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jpautler]

Can you update the PR description with an Azdo link?

You should confirm, but I don't see firewalld in the published feeds before:
http://nickdanger.amer.corp.natinst.com/feeds/2025Q1/x64/main/core2-64/

Perhaps should add notes to this documentation somewhere stating the first version where firewalld was available as well as the first version including any specific aspects that might have been added more recently.

Finally, here is a list of suggested content changes:

1. Zones description

   • Current: "Zones group a level of trust for network connections..."
   • Suggested: "Zones represent different trust levels for network connections..."

2. Service definitions wording

   • Current: "do not open them on their own"
   • Suggested: "do not automatically open them"

3. Use of "see""

   • Current: "See the system replication documentation for details..."
   • Suggested: "Refer to the system replication documentation for details..."

4. Reachable vs. accessible

   • Current: "services ... are reachable from the network"
   • Suggested: "services ... are accessible from the network"

5. Troubleshooting language

   • Current: "confirm you used --permanent and then --reload"
   • Suggested: "Verify that you used --permanent and then ran --reload."

6. Service information command description

   • Current: "List the exact ports for any service with:"
   • Suggested: "View the ports and protocols defined for a service with:"

7. Default configuration section

   • Current: "Out of the box, the firewall uses the following defaults:"
   • Suggested: "By default, the firewall is configured as follows:"

8. Introduction wording

   • Current: "control which network services are reachable on a target"
   • Suggested: "control which network services can be accessed on a target"

[Vairamani-NI]

Can you update the PR description with an Azdo link?

You should confirm, but I don't see firewalld in the published feeds before: http://nickdanger.amer.corp.natinst.com/feeds/2025Q1/x64/main/core2-64/

Perhaps should add notes to this documentation somewhere stating the first version where firewalld was available as well as the first version including any specific aspects that might have been added more recently.

Finally, here is a list of suggested content changes:

1. Zones description

   • Current: "Zones group a level of trust for network connections..."
   • Suggested: "Zones represent different trust levels for network connections..."

2. Service definitions wording

   • Current: "do not open them on their own"
   • Suggested: "do not automatically open them"

3. Use of "see""

   • Current: "See the system replication documentation for details..."
   • Suggested: "Refer to the system replication documentation for details..."

4. Reachable vs. accessible

   • Current: "services ... are reachable from the network"
   • Suggested: "services ... are accessible from the network"

5. Troubleshooting language

   • Current: "confirm you used --permanent and then --reload"
   • Suggested: "Verify that you used --permanent and then ran --reload."

6. Service information command description

   • Current: "List the exact ports for any service with:"
   • Suggested: "View the ports and protocols defined for a service with:"

7. Default configuration section

   • Current: "Out of the box, the firewall uses the following defaults:"
   • Suggested: "By default, the firewall is configured as follows:"

8. Introduction wording

   • Current: "control which network services are reachable on a target"
   • Suggested: "control which network services can be accessed on a target"

Updated all the corrections, updated PR.

Note: More changes are expected to come because of firewalld feature's successor features.