Unit 6 Lab - Firewalls
Info
If you are unable to finish the lab in the ProLUG lab environment we ask you reboot the machine from the command line so that other students will have the intended environment.
Resources / Important Links
Required Materials
- Rocky 9.4+ - ProLUG Lab
- Or comparable Linux box
- root or sudo command access
Downloads
The lab has been provided for convenience below:
Pre-Lab Warm-Up
Exercises (Warmup to quickly run through your system and practice commands)
cd~pwd (should be /home/<yourusername>)cd /tmppwd (should be /tmp)cdpwd (should be /home/<yourusername>)mkdir lab_firewalldcd lab_firewalldtouch testfile1lstouch testfile{2..10}lsseq 10seq 1 10seq 1 2 10- man seq and see what each of those values mean. It’s important to know the behavior if you intend to ever use the command, as we often do with counting (for) loops.
No worries, there are two ways to fix the mess you've made.
Nothing you've done is permanent, so logging out and reloading a shell (logging back in) would fix this.
We just put the aliases back.
for i inseq 1 10; do touch file$i; done;ls- Think about some of those commands and when you might use them. Try to change command #15 to remove all of those files (rm -rf file$i)
Lab 🧪
This lab is designed to help you get familiar with the basics of the systems you will be working on.
Some of you will find that you know the basic material but the techniques here allow you to put it together in a more complex fashion.
It is recommended that you type these commands and do not copy and paste them. Browsers sometimes like to format characters in a way that doesn't always play nice with Linux.
Check Firewall Status and settings
A very important thing to note before starting this lab. You’re connected into that server on ssh via port 22. If you do anything to lockout port 22 in this lab, you will be blocked from that connection and we’ll have to reset it.
- Check firewall status
Example Output:
Hint: Some lines were ellipsized, use -l to show in full.
If necessary start the firewalld daemon
Set the firewalld daemon to be persistent through reboots
Verify with systemctl status firewalld again from step 1
Check which zones exist
Checking the values within each zone
General Output
Checking the active and default zones
Example Output:
Next Command
Example Output:
Note: this also shows which interface the zone is applied to. Multiple interfaces and zones can be applied
So now you know how to see the values in your firewall. Use steps 4 and 5 to check all the values of the different zones to see how they differ.
Set the firewall active and default zones
We know the zones from above, set your firewall to the different active or default zones. Default zones are the ones that will come up when the firewall is restarted.
Note: It may be useful to perform an ifconfig -a and note your interfaces for the next part
Example Output:
- Changing the default zones (This is permanent over a reboot, other commands require --permanent switch)
Example Output:
Next Command:
Example Output:
Attempt to set it back to the original public zone and verify. Set it to one other zone, verify, then set it back to public.
Changing interfaces and assigning different zones (use another interface from your earlier ifconfig -a
Example Output:
Next Command:
Example Output:
Next Command:
Example Output:
Working with ports and services
We can be even more granular with our ports and services. We can block or allow services by port number, or we can assign port numbers to a service name and then block or allow those service names.
- List all services assigned in firewalld
Example Output:
This next part is just to show you where the service definitions exist. They are simple xml format and can easily be manipulated or changed to make new services. This would require a restart of the firewalld service to re-read this directory.
Next Command:
Example Output:
Next Command:
Example Output:
- Adding a service or port to a zone
Ensuring we are working on a public zone
Example Output:
Listing Services
Example Ouput:
Note: We have 2 services
Permanently adding a service with the --permanent switch
Example Output:
Reloading
Example Output:
Verifying we are in the correct Zone
Example Output:
Verifying that we have successfully added the FTP service
Example Output:
Alternatively, we can do almost the same thing but not use a defined service name. If I just want to allow port 1147 through for TCP traffic, it is very simple as well.
Example Output:
Reloading once again
Example Output:
Listing open ports now
Example Output:
- Removing unwanted services or ports
To remove those values and permanently fix the configuration back we simply use remove.
Firstly, we will permanently remove ftp service
Example Output:
Then we will permanently remove the ports
Example Output:
Now lets do a reload
Example Output:
Now we can list services again to confirm our work
Example Output:
Now we can list ports
Example Output:
Nothing
Before making any more changes I recommend running the list commands above with >> /tmp/firewall.orig on them so you have all your original values saved somewhere in case you need them.
So now take this and set up some firewalls on the interfaces of your system.
Change the default ports and services assigned to your different zones (at least 3 zones)
Read the man firewall-cmd command or firewall-cmd -help to see if there are any other userful things you should know.
Info
Be sure to reboot the lab machine from the command line when you are done.