Manage Network Security (Firewall) in RHEL - RHCSA (RH134).pdf

Slides on how to manage network security (Firewall) - Part of RHCSA (RH134) syllabus

1. Manage Network Security
(Firewall)

2. Firewall

●Protects machines by filtering
unwanted external traffic

●Allows users to control
incoming network traffic by
setting rules that either block or
permit traffic based on defined
criteria
Source: Firewall in Linux. Firewall — A firewall is a network… | by P3rwez | Aug, 2024 | Medium

3. Types of firewall in IT
1.Hardware firewall:
Physical device that filters network traffic between external networks and
internal systems
Source: Types of Firewalls Defined and Explained - Palo Alto Networks

4. 2. Software Firewall:
Program on individual devices, controls incoming and outgoing network
traffic
Source: Types of Firewalls Defined and Explained - Palo Alto Networks

5. Types of firewall in IT
●Hardware firewall:
physical device that filters network traffic between external
networks and internal systems

●Software Firewall:
program installed on individual devices that controls incoming
and outgoing network traffic

6. Managing network security

Network security in RHEL is managed by firewalld

Firewalld:
●Dynamic firewall management tool

●Provides commands to manage firewall rules

●Includes predefined service rules that are easy to enable/disable (e.g.,
NFS, NTP, HTTPD).

7. Core components of firewalld
Table: Structures that organize chains for packet filtering and
NAT operations
Chains: Ordered sets of rules that control the flow of network
traffic.
Rules: Specific instructions that define how to handle
matching network packets
Targets: Actions applied to packets that match a rule (e.g.,
ACCEPT, REJECT).

8. Proceed with iptables or firewalld:


Check the status of iptables
●Command: systemctl status iptables


Note: verify the status of iptables by using ‘systemctl’ command, if
iptables are present then make sure iptables are stopped disabled and
mask

9. Install firewalld
●Command: yum install firewalld

10. Enable firewalld
●Command: systemctl enable firewalld
Start firewalld
●Command: systemctl start firewalld

11. Check the rule of firewalld
●Command: firewall-cmd --list-all
List all the available services of firewall
●Command: firewall-cmd --get-services

12. Add the http service permanently, to make it permanent use the
‘--permanent’ flag otherwise on reloading the added service will be lost
●Command: firewall-cmd --add-service=http --permanent

Remove the http service and confirm the changes using “firewall-cmd --list-all”
●Command: firewall-cmd --remove-service=http

13. List available zones
●Command: firewall-cmd --get-zones
To get the active zone
●Command: firewall-cmd --get-active-zones

14. Listing all the firewall rules for ‘internal’ zone
●Command: firewall-cmd --zone=internal --list-all

15. Creating a custom service in firewall
Copy the contents of xml file in your file
●Command: cp <existing-xml-file> <new-xml-file>
Edit the xml file and change the port number, description and service name
●Command: vi <path-to-new-xml-file>

16. Restart & check the services available and notice the service which is being
added is listed
●Command: systemctl restart firewalld && firewall-cmd --get-services

17. Add the 'tcp' port '1234' to the inbound firewall then confirm the changes using
‘--list-all’ command
●Command: firewall-cmd --add-port=1234/tcp
Remove the added port
●Command: firewall-cmd --remove-port=1234/tcp

18. Advanced firewall rules for traffic
control
Block the incoming traffic from a particular ip address by adding rich rule
●Command: firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -s
<ip-address> -j REJECT

19. Remove the rich rule
●Command: firewall-cmd --direct --remove-rule ipv4 filter INPUT 0 -s
<ip-address> -j REJECT

20. Block the ICMP 'echo-request' messages to block the outgoing ICMP traffic
●Command: firewall-cmd --permanent --direct --add-rule ipv4 filter
OUTPUT 0 -p icmp --icmp-type echo-request -j DROP &&
firewall-cmd --reload
Note: Make the changes permanent and reload the firewall to make sure the changes
are done

21. Install the bind-utils package
●Command: yum install bind-utils

22. Find the ip address of any website
●Command: dig <website-name>

23. Block the outgoing traffic to that site
●Command: firewall-cmd --direct --add-rule ipv4 filter OUTPUT
0 -d <ip-address> -j DROP
Fetch the content of the website using curl command
●Command: curl <ip-address>

24. Unblock the outgoing traffic to the ip address
●Command: firewall-cmd --direct --remove-rule ipv4 filter OUTPUT
0 -d <ip-address> -j DROP