Red Hat Certified System Administration 8

Chapter 23: Configuring a Firewall

Sommaire

Firewalling
Firewalld Zones
Services

Firewalling

Red hat firewall

If a server is connected to the Internet, it needs to be protected against unauthorized access. SELinux is one part of this protection, and a firewall is the second part. The Linux kernel implements firewalling via the netfilter framework. To configure which packets are allowed and which are not, firewalld is the default solution in RHEL 7.

Firewalld was developed as a complete new solution for managing Linux firewalls. It uses the firewalld service to manage the netfilter firewall configuration. The firewalld service is incompatible with the iptables service. Do not ever use firewalld and iptables on the same system; they are mutually exclusive.

The RHCSA objective does not define which tool you should use to create firewall rules. It just mentions that you should be able to create firewall rules by using iptables, firewall-config, or firewall-cmd. So, you do not have to be able to work with each of these tools; you just have to be able to configure a firewall with the tool that works best for you.

Understanding Firewalld Zones

Firewalld is making firewall management easier by working with zones. A zone is a collection of rules that are applied to incoming packets matching a specific source address or network interface. Firewalld applies to incoming packets only by default, and no filtering is happening on outgoing packets.

The use of zones is particularly important on servers that have multiple interfaces. On such servers, zones allow administrators to easily assign a specific set of rules. On servers that have just one network interface, you might very well do with just one zone, which is the default zone. Every packet that comes into a system is analyzed for its source address, and based on that source address, firewalld analyzes to see whether the packet belongs to a specific zone. If that is not the case, the zone for the incoming network interface is used. If no specific zone is available, the packet is handled by the settings in the default zone.

Rules editing

Firewall GUI tool

#system-config-firewall

Firewalld Zones

Firewalld Default Zones

Zone name Default Settings

Block Incoming network connections are rejected with an “icmp-host-prohibited” message. Only network connections that were initiated on this system are allowed.

Dmz For use on computers in the demilitarized zone. Only selected incoming connections are accepted, and limited access to the internal network is allowed.

Drop Any incoming packets are dropped and there is no reply.

External For use on external networks with masquerading (Network Address Translation [NAT]) enabled, used especially on routers. Only selected incoming connections are accepted.

Home For use with home networks. Most computers on the same network are trusted, and only selected incoming connections are accepted.

Internal For use in internal networks. Most computers on the same network are trusted, and only selected incoming connections are accepted.

Public For use in public areas. Other computers in the same network are not trusted, and limited connections are accepted. This is the default zone for all newly created network interfaces.

trusted All network connections are accepted.

work For use in work areas. Most computers on the same network are trusted, and only selected incoming connections are accepted.

Firewalld Zones

/usr/lib/firewalld/zones/
/etc/firewalld/zones/

Listing Zones

To see which zones are available on your system:

[root@lab ~]# firewall-cmd --get-zones
displays all zones that are available on the system, but it does not show any details for particular zones.

[root@lab ~]# firewall-cmd --list-all-zones To see detailed information for all zones

[root@lab ~]# firewall-cmd --zone=zone-name --list-all To see detailed information for a specific zone

The Default Zone

The Default Zone is the zone affected to unconfigured interfaces. By default, the default zone is "public". It's possible to change the default zone.

[root@lab ~]# firewall-cmd --get-default-zone Display the current default zone

[root@lab ~]# firewall-cmd --set-default-zone zone-name Set up the default zone

Assigning a Network Interface to a Zone

To assign the zone to a specific interface:
1. List the active zones and the interfaces assigned to them:
[root@lab ~]# firewall-cmd --get-active-zones

2. Assign the interface to a different zone:
[root@lab ~]# firewall-cmd --zone=zone-name --change-interface=interface-name

Assigning a Default Zone to a Network Connection

To set a default zone for an Internet connection, use either the NetworkManager GUI or edit the /etc/sysconfig/network-scripts/ifcfg-connection-name file and add a line that assigns a zone to this connection:

ZONE=zone-name

Creating a New Zone

To create a new zone:

[root@lab ~]# firewall-cmd --new-zone=zone-name --permanent
[root@lab ~]# systemctl restart firewalld.service
[root@lab ~]# firewall-cmd --get-zones

Services

Firewalld Services

The second key element while working with firewalld is the service. Note that a service in firewalld is not the same as a service in systemd. In firewalld, some default services are defined, which allows administrators to easily allow or deny access to specific ports on a server.

Behind each service is a configuration file that explains which UDP or TCP ports are involved, and if so required, which kernel modules must be loaded. To get a list of all services available on your computer, you can use the command firewall-cmd --get-services .

✔ List of All Available Services

[root@redhat ~]# firewall-cmd --get-services

✔ Allow Traffic for a service

[root@redhat ~]# firewall-cmd --add-service service_name --permanent
[root@redhat ~]# firewall-cmd --add-service ftp --permanent
[root@redhat ~]# firewall-cmd --add-service ftp --zone=public --permanent
[root@redhat ~]# firewall-cmd --add-service=ssh --zone=public
[root@redhat ~]# firewall-cmd --reload

Services Files

Service files are stored in the directory /usr/lib/firewalld/services or /etc/firewalld/services.

Contents of the ftp Service File

Firewalld Services
Change runtime settings and then make them permanent as follows:
~]# firewall-cmd
~]# firewall-cmd --runtime-to-permanent

It is possible, especially on remote systems, that an incorrect setting results in a user locking themselves out of a machine. To prevent such situations, use the --timeout option. After a specified amount of time, any change reverts to its previous state. Using this options excludes the --permanent option.

For example, to add the SSH service for 15 minutes:
~]# firewall-cmd --add-service=ssh --timeout 15m

[root@localhost user1]# firewall-cmd --list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: ens33
sources:
services: ssh dhcpv6-client
[root@lab ~]# firewall-cmd --list-all --zone=home
[root@lab ~]# firewall-cmd –help
[root@lab ~]# firewall-cmd --list-services
[root@lab ~]# firewall-cmd --list-services --zone=public

Disabling All Traffic in Case of Emergency using CLI

In an emergency situation, such as a system attack, it is possible to disable all network traffic and cut off the attacker.

[root@lab ~]# firewall-cmd --panic-on To immediately disable networking traffic, switch panic mode on

[root@lab ~]# firewall-cmd --panic-off Switching off panic mode reverts the firewall to its permanent settings.

[root@lab ~]# firewall-cmd --query-panic To see whether panic mode is switched on or off

Allow Traffic on ports:

✔ List all allowed ports

[root@lab ~]# firewall-cmd --list-ports

✔ Add a port to the allowed ports to open it for incoming traffic:Allow traffic on a port

[root@lab ~]# firewall-cmd --add-port=port_number/port_type
[root@lab ~]# firewall-cmd --add-port=80/tcp
[root@lab ~]# firewall-cmd --add-port=53/udp

[root@lab ~]# firewall-cmd --runtime-to-permanent Make the new settings persistent

The port types are either tcp, udp, . The type must match the type of network communication.

Eninam BAGNABANA | | bagnadavid@outlook.fr |