Firewall - Revision history

Support at 19:46, 9 May 2017

2017-05-09T19:46:23Z

Support at 19:46, 9 May 2017

2017-05-09T19:46:02Z

Support at 02:25, 9 May 2017

2017-05-09T02:25:10Z

Support at 22:22, 8 May 2017

2017-05-08T22:22:01Z

Support at 22:20, 8 May 2017

2017-05-08T22:20:44Z

Support at 22:18, 8 May 2017

2017-05-08T22:18:46Z

Support at 22:17, 8 May 2017

2017-05-08T22:17:33Z

Support at 22:13, 8 May 2017

2017-05-08T22:13:14Z

Support at 02:18, 8 May 2017

2017-05-08T02:18:57Z

Support at 02:18, 8 May 2017

2017-05-08T02:18:11Z

← Older revision		Revision as of 19:46, 9 May 2017
Line 1:		Line 1:
−

	=== Overview / Gotcha's ===		=== Overview / Gotcha's ===

@@ Line 3: / Line 3: @@
 ===  Overview / Gotcha's ===
 Warning: making firewalld changes are either done to the running/active config or the permanent config, there is not one command for both configurations. However, this was done so you can test changes in the active config (which would not be permanent) and the system could simply be rebooted (if it became unavailable) to get it back to the previous working state. To update both the active and permanent configs, all commands would need to be run twice, once to affect the active state (without --permanent) and a second time (with --permanent) to save/make permanent the change. Alternately you can do all commands with --permanent and then do a 'firewall-cmd --reload', though is not recommended.
 ===  iptables examples (before ent 7) ===
@@ Line 28: / Line 27: @@
 Allow samba
 figure out all it's udp & tcp ports and add the various needed lines for this in a similar fashion to the previous examples
 ===  firewalld examples (ent 7) ===
@@ Line 46: / Line 44: @@
 Allow samba:
   # firewall-cmd --add-service smb --permanent
 ===  firewalld - running/enabling firewalld ===
@@ Line 55: / Line 52: @@
   # systemctl enable firewalld
   # systemctl start  firewalld
 ===  firewalld - zones ===
@@ Line 81: / Line 77: @@
 |}
 The primary zone defaults to public, but the primary interface (and others) can be moved into other zones. Adding new rules automatically go into the default zone, unless the zone is specified.
 ===  firewall-cmd Quick Reference ===
@@ Line 117: / Line 112: @@
   OR
   # firewall-cmd --add-source 98.200.183.180 --zone block
 === Zone Examples ===
@@ Line 136: / Line 130: @@
   # firewall-cmd --list-all --zone=trusted
   # firewall-cmd --list-all --zone=pinemgmt
 ===  iptables Quick Reference ===

@@ Line 2: / Line 2: @@
 ===  Overview / Gotcha's ===
+Warning: making firewalld changes are either done to the running/active config or the permanent config, there is not one command for both configurations. However, this was done so you can test changes in the active config (which would not be permanent) and the system could simply be rebooted (if it became unavailable) to get it back to the previous working state. To update both the active and permanent configs, all commands would need to be run twice, once to affect the active state (without --permanent) and a second time (with --permanent) to save/make permanent the change. Alternately you can do all commands with --permanent and then do a 'firewall-cmd --reload', though is not recommended.
-Warning: making firewalld changes are either done to the running/active config or the permanent config, there is not one command for both configurations. However, this was done so you can test changes in the active config (which would not be permanent) and the system could be rebooted if it became unavailable, to get it back to the previous state that was working. To update both the active and permanent configs, all commands would need to be run twice, once to affect the active state (without --permanent) and a second time (with --permanent) to save/make permanent the change. Alternately you can do all commands with --permanent and then do a 'firewall-cmd --reload', though is not recommended.
 ===  iptables examples (before ent 7) ===
 Allow https port:
-  temporary
+  TEMPORARY
   # iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
-  permanent
+  PERMANENT
   do temporary step and "service iptables save", OR
   # vi /etc/sysconfig/iptables
-  add
+  ADD
   -A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
   # service iptables restart
 Allow a custom ssh port:
-  temporary
+  TEMPORARY
   # iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 222 -j ACCEPT
-  permanent
+  PERMANENT
   do temporary step and "service iptables save", OR
   # vi /etc/sysconfig/iptables
-  add
+  ADD
   -A INPUT -m state --state NEW -m tcp -p tcp --dport 222 -j ACCEPT
   # service iptables restart
@@ Line 33: / Line 31: @@
 ===  firewalld examples (ent 7) ===
 Allow https port:
-  temporary
+  TEMPORARY
   # firewall-cmd --add-port 443/tcp
-  permanent (to make active, also do temporary step, or after the permanent step do "firewall-cmd --reload")
+  PERMANENT (to make active, also do temporary step, or after the permanent step do "firewall-cmd --reload")
   # firewall-cmd --add-port 443/tcp --permanent
 Note: you can use; '--add-service http' instead, but this adds a long list of ports 80/443/8080/8443/etc/etc, therefore it's more secure/preferable to only open the individual ports you need
 Allow a custom ssh port:
-  temporary
+  TEMPORARY
   # firewall-cmd --add-port 222/tcp
-  permanent (to make active, also do temporary step, or after the permanent step do "firewall-cmd --reload")
+  PERMANENT (to make active, also do temporary step, or after the permanent step do "firewall-cmd --reload")
   # firewall-cmd --add-port 222/tcp --permanent
@@ Line 52: / Line 49: @@
 ===  firewalld - running/enabling firewalld ===
+when running firewalld, this will conflict with the old iptables service, so if firewalld rules are set up and the iptables service gets started/enabled, this will cause problems/contention between the two services. To ensure this doesn't happen accidentally after you've gotten a firewalld setup configured/working correctly, it is recommended to 'mask' the conflicting services (where they could not just be enabled without someone finding out they've been masked, and explicitly having to disable the masking to enable iptables). Recommended enable procedure for firewalld:
-when running firewalld, this will conflict with the old iptables service, so if firewalld rules are set up and the iptables service get started/enabled, this will cause problems/contention between the two services. To ensure this doesn't happen accidentally after you've gotten a firewalld setup configured/working correctly, it is recommended to 'mask' the conflicting services, where they could not just be enabled without someone finding out they've been masked, and explicitly having to disable the masking to enable iptables. Recommended enable procedure for firewalld:
+  # systemctl mask   iptables
+  # systemctl mask   ip6tables
-  # systemctl mask iptables
+  # systemctl mask   ebtables
   # systemctl mask ip6tables
   # systemctl mask ebtables
   # systemctl enable firewalld
-  # systemctl start firewalld
+  # systemctl start  firewalld
 ===  firewalld - zones ===
 The following is a description of the default zones that currently come preconfigured on a system:
 {| class="wikitable"
@@ Line 82: / Line 76: @@
 | home || For use in home areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.
 |-
-| internal || For use on internal networks. You mostly trust the other computers on the networks to not harm your computer. Only selected incoming connections are accepted.
+| internal || For use on internal networks. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.
 |-
 | trusted || All network connections are accepted.
 |}
-The primary zone defaults to public, but the primary interface (and others) can be moved into other zones. Adding new rules automatically go into the default zone.
+The primary zone defaults to public, but the primary interface (and others) can be moved into other zones. Adding new rules automatically go into the default zone, unless the zone is specified.
 ===  firewall-cmd Quick Reference ===
 Moving interfaces into other zones (actually done via NetworkManager, and not through firewalld):
   # nmcli con mod em1 connection.zone trusted
@@ Line 127: / Line 120: @@
 === Zone Examples ===
 Example setup/scenario for a system at a client site using various zones (p2p1 is a capture interface):
   # nmcli con mod em1 connection.zone public
   # nmcli con mod p2p1 connection.zone trusted
@@ Line 148: / Line 139: @@
 ===  iptables Quick Reference ===
+NAT'ing/forwarding<br>
-NAT'ing/forwarding in Net Discovery
 We're not sure how to get NAT to work via command line (if you type these commands, it fails), however, NAT works if the following is set in the iptables rules file (/etc/sysconfig/iptables)
   *nat

← Older revision		Revision as of 22:22, 8 May 2017
Line 126:		Line 126:


−	=== Examples ===	+	=== Zone Examples ===

	Example setup/scenario for a system at a client site using various zones (p2p1 is a capture interface):		Example setup/scenario for a system at a client site using various zones (p2p1 is a capture interface):

@@ Line 66: / Line 66: @@
 The following is a description of the default zones that currently come preconfigured on a system:
 {| class="wikitable"
-! Zone ! Description
+! Zone !! Description
 |-
 | drop || Any incoming network packets are dropped, there is no reply. Only outgoing network connections are possible.

@@ Line 67: / Line 67: @@
 {| class="wikitable"
 ! Zone ! Description
-|- | drop || Any incoming network packets are dropped, there is no reply. Only outgoing network connections are possible.
+|-
-|- | block || Any incoming network connections are rejected with an icmp-host-prohibited message for IPv4 and icmp6-adm-prohibited for IPv6. Only network connections initiated from within the system are possible.
+| drop || Any incoming network packets are dropped, there is no reply. Only outgoing network connections are possible.
-|- | public || For use in public areas. You do not trust the other computers on the network to not harm your computer. Only selected incoming connections are accepted.
+|-
-|- | external || For use on external networks with masquerading enabled especially for routers. You do not trust the other computers on the network to not harm your computer. Only selected incoming connections are accepted.
+| block || Any incoming network connections are rejected with an icmp-host-prohibited message for IPv4 and icmp6-adm-prohibited for IPv6. Only network connections initiated from within the system are possible.
-|- | dmz || For computers in your demilitarized zone that are publicly-accessible with limited access to your internal network. Only selected incoming connections are accepted.
+|-
-|- | work || For use in work areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.
+| public || For use in public areas. You do not trust the other computers on the network to not harm your computer. Only selected incoming connections are accepted.
-|- | home || For use in home areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.
+|-
-|- | internal || For use on internal networks. You mostly trust the other computers on the networks to not harm your computer. Only selected incoming connections are accepted.
+| external || For use on external networks with masquerading enabled especially for routers. You do not trust the other computers on the network to not harm your computer. Only selected incoming connections are accepted.
-|- | trusted || All network connections are accepted.
+|-
 | dmz || For computers in your demilitarized zone that are publicly-accessible with limited access to your internal network. Only selected incoming connections are accepted.
-The primary zone defaults to public, but the primary interface (and others) can be moved into other zones. Adding new rules automatically go into the default zone.
+|-
 |}
 ===  firewall-cmd Quick Reference ===

@@ Line 65: / Line 65: @@
 The following is a description of the default zones that currently come preconfigured on a system:
+{|
-|| Zone || Description ||
+|+ Zone | Description
-| drop | Any incoming network packets are dropped, there is no reply. Only outgoing network connections are possible. |
+|- drop | Any incoming network packets are dropped, there is no reply. Only outgoing network connections are possible.
-| block | Any incoming network connections are rejected with an icmp-host-prohibited message for IPv4 and icmp6-adm-prohibited for IPv6. Only network connections initiated from within the system are possible. |
+|- block | Any incoming network connections are rejected with an icmp-host-prohibited message for IPv4 and icmp6-adm-prohibited for IPv6. Only network connections initiated from within the system are possible.
-| public | For use in public areas. You do not trust the other computers on the network to not harm your computer. Only selected incoming connections are accepted. |
+|- public | For use in public areas. You do not trust the other computers on the network to not harm your computer. Only selected incoming connections are accepted.
-| external | For use on external networks with masquerading enabled especially for routers. You do not trust the other computers on the network to not harm your computer. Only selected incoming connections are accepted. |
+|- external | For use on external networks with masquerading enabled especially for routers. You do not trust the other computers on the network to not harm your computer. Only selected incoming connections are accepted.
-| dmz | For computers in your demilitarized zone that are publicly-accessible with limited access to your internal network. Only selected incoming connections are accepted. |
+|- dmz | For computers in your demilitarized zone that are publicly-accessible with limited access to your internal network. Only selected incoming connections are accepted.
-| work | For use in work areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted. |
+|- work | For use in work areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.
-| home | For use in home areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted. |
+|- home | For use in home areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.
-| internal | For use on internal networks. You mostly trust the other computers on the networks to not harm your computer. Only selected incoming connections are accepted. |
+|- internal | For use on internal networks. You mostly trust the other computers on the networks to not harm your computer. Only selected incoming connections are accepted.
-| trusted | All network connections are accepted. |
+|- trusted | All network connections are accepted.
 The primary zone defaults to public, but the primary interface (and others) can be moved into other zones. Adding new rules automatically go into the default zone.
+|}
 ===  firewall-cmd Quick Reference ===

← Older revision		Revision as of 02:18, 8 May 2017
Line 1:		Line 1:
		+
		+
	=== Overview / Gotcha's ===		=== Overview / Gotcha's ===