36. Firewalls Flashcards
Learning Objectives
By the end of this chapter, you should be able to?
By the end of this chapter, you should be able to:
- Understand what firewalls are and why they are necessary.
- Know what tools are available both at the command line and using graphical interfaces.
- Discuss about firewalld and the firewall-cmd programs.
- Know how to work with zones, sources, services and ports.
Firewalls
Almost all firewalls are based on ___.
Packet Filtering
Packet Filtering
Information is transmitted across networks in the form of packets, and each one of these packets has these 3 componets?
- Header
- Payload
- Footer.
Packet Filtering
The ___ and ___ contain information about destination and source addresses, what kind of packet it is, and which protocol it obeys, various flags, which packet number this is in a stream, and all sorts of other metadata about transmissions. The actual data is in the payload.
- header
- footer
Firewall
___ ___ intercepts packets at one or more stages in the network transmission, including application, transport, network, and datalink.
Packet filtering
Firewall
A firewall establishes a set of rules by which each packet may be: (what are the 4 actions a firewall does to packets?)
- Accepted or rejected based on content, address, etc.
- Mangled in some way
- Redirected to another address
- Inspected for security reasons, etc.
Firewall Generations
What are the 3 firewall generations and how did they improve upon eachother?
- Early firewalls (dating back to the late 1980s) were based on packet filtering: the content of each network packet was inspected and was either dropped, rejected, or sent on. No consideration was given about the connection state: what stream of traffic the packet was part of.
- The next generation of firewalls were based on stateful filters, which also examine the connection state of the packet, to see if it is a new connection, part of an already existing one, or part of none. Denial of service attacks can bombard this kind of firewall to try and overwhelm it.
- The third generation of firewalls is called Application Layer Firewalls, and are aware of the kind of application and protocol the connection is using. They can block anything which should not be part of the normal flow.
Firewall Interfaces and Tools
What the 3 relatively low-level tools from the command line that are used to configure a systems firewall? combined with editing various configuration files in the /etc subdirectory tree.
- iptables
- firewall-cmd
- ufw
Firewall Interfaces and Tools
What are 4 robust graphical interfaces to manage a systems firewall?
- system-config-firewall
- firewall-config
- gufw
- yast
- etc.
Firewall
What are the reasons to work with lower-level tools firewall tools? What are the cons of using lower-level tools?
- They change less often than the graphical ones.
- They tend to have a larger set of capabilities.
- They vary little from distribution to distribution, while the GUIs tend to be quite different and each confined to only one family of distributions.
The disadvantage is they can seem more difficult to learn at first. In the following, we will concentrate on the use of the modern firewalld package, which includes both firewall-cmd and firewall-config. For distributions which don’t have it by default, it can be installed from source rather easily, as we will do if necessary in an exercise.
Why We Are Not Working with iptables
Most firewall installations today are actually using the iptables package on the user side. This currently interfaces the same kernel firewall implementation code as firewalld, which we will discuss in more detail.
We have decided not to teach iptables because it requires much more time to get to useful functionality.
However, iptables is discussed in detail in the next course in the Linux Foundation system administrator sequence: LFS311 - Linux for System Engineers/LFS211 - Linux Networking and Administration.
firewalld and firewall-cmd
What does firewalld (Dynamic Firewall Manager) utilizes?
It utilizes network/firewall zones which have defined levels of trust for network interfaces or connections. It supports both IPv4 and IPv6 protocols.
firewalld and firewall-cmd
In addition, firewalld separates ___ and ___ changes to configuration, and also includes interfaces for ___ or ___ to add firewall rules.
- runtime
- permanent (persistent)
- services
- applications
firewalld and firewall-cmd
Configuration files for firewalld are kept in ___ and ___; the files in ___ override those in the other directory and are the ones a system administrator should work on.
- /etc/firewalld
- /usr/lib/firewalld
- /etc/firewalld
The command line tool is actually ___ to interact with firewalld which we will discuss.
- firewall-cmd
We recommend that before getting any further, you run:
$ firewall-cmd –help
…
which runs about 200 lines, so it is too long to include here.
However, you will see that almost all options are rather obvious as they are well-named. As a service, firewalld replaces the older iptables. It is an error to run both services, firewalld and iptables, at the same time.
firewalld Service Status
firewalld is a? to be able to?
service which needs to be running to use and configure the firewall, and is enabled/disabled, or started or stopped in the usual way.
$ sudo systemctl [enable/disable] firewalld
$ sudo systemctl [start/stop] firewalld
firewalld Service Status
What is the command to enable/disable the firewalld service?
$ sudo systemctl [enable/disable] firewalld
firewalld Service Status
What is the command to start/stop firewalld service?
$ sudo systemctl [start/stop] firewalld
firewalld Service Status
What are two ways to see the current state of firewalld?
- $ sudo systemctl status firewalld
- $ sudo firewall-cmd –state
firewalld Service Status
Note when using firewalld and if you have more than ___ network interface when using IPv4, you have to turn on ___ ___. You can do this at runtime by doing either of:
- one
- ip forwarding
Note that if you have more than one network interface when using IPv4, you have to turn on ip forwarding. You can do this at runtime by doing either of:
$ sudo sysctl net.ipv4.ip_forward=1
$ echo 1 > /proc/sys/net/ipv4/ip_forward
where the second command has to be run as root to get echo to work properly. However, this is not persistent. To do that, you have to add the following line to /etc/sysctl.conf:
net.ipv4.ip_forward=1
and then reboot or type:
$ sudo sysctl -p
to read in the new setting without rebooting.
Zones
firewalld works with ___, each of which ___. Each interface belongs to a particular zone (normally, it is NetworkManager which informs firewalld which zone is applicable), but this can be changed with firewall-cmd or the firewall-config GUI.
- zones
- has a defined level of trust and a certain known behavior for incoming and outgoing packets
