Firewalld and Iptables

Question 1

ip-table chains

Answer 1

Assume we have 2 if-s: eth0, eth1 on the PC
INPUT Chain: from outside to eth0
OUTPUT Chain: from eth0 outside
from eth0 to eth1 and visa versa: FORWARD

Question 2

Add an entry into iptable to allow outgoing ssh traffic

Answer 2

iptables -I/A CHAIN [-i/o ifname] [-s/d ip-address]
-p udp/tcp --dport/sport nn -j LOG/ACCEPT/DROP/REJECT
A-append
i/o -network card (eth0 or eth1)
s-source address
d-destination address
dport/sport -dest port
sport- source port
nn -port number

iptables -A OUTPUT -p tcp –dport 22 -j ACCEPT

Question 3

List iptables entries

Answer 3

iptables -L

Question 4

Add policy into iptables

Answer 4

iptables -P INPUT DROP
iptables -P OUTPUT DROP
-P -policy OUTPUT

Question 5

Add an entry into iptable to allow incoming traffic, when ssh connection was established with remote server

Answer 5

iptables -A INPUT -m state –state established,related -j ACCEPT
-m match

Question 6

Firewalld

Answer 6

Zone: a collection of network cards to which rules can be assigned

Interfaces: individual network cards, always assigned to zones

Services: xml-based conf that specified ports to be opened and modules that should be used

Forward ports: used to send traffic coming in on specific port to another port, which may be on another machine

Masquerading: provides NAT

Reach rules: extension to firewalld to make more complex conf possible

Question 7

Firewalld:
Show current conf
Show services of current zone (subset of –list-all command)
Get available services

Answer 7

firewall-cmd –list-all
firewall-cmd –list-services
firewall-cmd –get-services

Question 8

Add service to run-time level rules

Remove service permanently

Answer 8

firewall-cmd -add-service=service
firewall-cmd –remove-service=service
firewall-cmd –add-service=https –permanent

Question 9

Add GUI for firewalld

Answer 9

yum install firewall-config

Question 10

Restart firewalld to pick up permanent rules

Answer 10

firewall-cmd –reload

Question 11

Get zones
Get default zone
Get setting for home zone

Answer 11

firewall-cmd –get-zones
firewall-cmd –get-default-zone
firewall-cmd –zone=home –list-all

Question 12

Get help for firewall

Answer 12

firewall-cmd –help

Question 13

Add ip-range 192.168.0.0/24 to zone=home

Answer 13

firewall-cmd –zone=home –add-source 192.168.0.0/24

firewall-cmd –zone=home –add-source 192.168.0.0/24 –permanently

Question 14

Run-time rules vs permanent rules

Answer 14

1. Adding rules to run-time level does not survive reboot, but apply immediately
2. Adding rules to permanent level requires reload of firewall-cmd to apply. Survive reboot

Question 15

Enable firewall rules to get access to apache server

Answer 15

firewall-cmd –zone=public –add-port 80/tcp

firewall-cmd –zone=public –add-port 80/tcp –permanent

Question 16

Ensure that iptables are not running when setting up firewall rules

Answer 16

systemctl mask iptables

systemctl mask ip6tables