Network Firewall

Software Firewall (Runs on operating system)

Hardware Firewall (Dedicated network appliance)

Modern Linux uses firewalld as front-end & nftables under the hood

organises rules by "zones" (like public, home, work)
exposes "services" (ssh, http, samba, nfs, etc.)

temporary changes are active immediately but vanish on reload
permanent changes are written to disk and take effect after reload

unspecified zone will be applied to the default (public) zone
services not on --list-all can be enabled by opening specific ports

Examples

allow SSH from jump hosts
open http/https on a web server
open NFS only to specific subnets

Exam

start/enable firewall, list zones, see active zone
add/remove a service, open/close a port, make changes permanent
reload, create, or use a custom XML service file
basic rich rules for blocking a specific source IP
temporary vs permanent

Basic Commands

dnf install firewalld	install firewalld
systemctl enable --now firewalld	enable now
systemctl status firewalld	details & uptime
firewall-cmd --state	status
firewall-cmd --get-active-zones
firewall-cmd --get-zones	list predefined zone profiles public - locked down default home/work - more relaxed (known networks) trusted - allow all dmz/external - edge scenarios
firewall-cmd --list-all	shows all zones, rules, services, etc. (only a few enabled by default)
firewall-cmd --get-services	list of all services that can be allowed
firewall-cmd --reload	write permanent and custom rules to memory

Adding and Removing Temporary and Permanent Rules

firewall-cmd --add-service=http	add http (temporary)
firewall-cmd --permenent --add-service=http	add http (permanent)
firewall-cmd --remove-service=http	remove http (temporary)
firewall-cmd --permanent --remove-service=http	remove http (permanent)
firewall-cmd --add-port=1110/tcp	add TCP 1110 (temporary)
firewall-cmd --permanent --add-port=1110/tcp	add TCP 1110 (permanent)
firewall-cmd --remove-port=1110/tcp	remove TCP 1110 (temporary)
firewall-cmd --permanent --remove-port=1110/tcp	remove TCP 1110 (permanent)
firewall-cmd --add-rich-rule='rule family="ipv4" source address="192.168.0.25" reject'	block incoming packets from specific IP
firewall-cmd --remove-rich-rule='rule family="ipv4" source address="192.168.0.25" reject'	remove
firewall-cmd --add-icmp-block=echo-request	block icmp (ping) requests
firewall-cmd --remove-icmp-block=echo-request	remove
firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -d 203.0.113.10 -j DROP	block outgoing packets to IP (priority)
firewall-cmd --direct --remove-rule ipv4 filter OUTPUT 0 -d 203.0.113.10 -j DROP	remove
nano /etc/firewalld/services/sap.xml xml version="1.0" encoding="utf-8" <service version=1.0"> <short>SAP</short> <description>Third-party application service</description> <port protocol="tcp" port="3200"/> </service>	add a custom service definition for SAP xml header for firewalld
firewall-cmd --get-services \| grep -i sap	verify
firewall-cmd --add-service=sap	add the custom rule (temporary)
firewall-cmd --permanent --add-service=sap	add the custom rule (permanent)

dnf install -y httpd	install apache web service
systemctl enable --now httpd
curl -I http://localhost	verify (403 Forbidden)
curl -I http://192.168.50.164/	verify (403 Forbidden)

Back to top