Firewalling with firewalld
Zones, services and rules.
Level 201 · 17 lessons · 18 practice labs
Lessons
firewalld basics
- Installing firewalld and managing the service: You will learn to install firewalld on your own lab server, start and stop it, and check whether it is running.
- firewalld: zones and interfaces: You will understand what firewalld zones are for and how to place each network interface in a zone with the right trust level.
- firewalld: runtime versus permanent configuration: You will tell apart firewalld rules that last only until now from those that survive a reboot, and keep the two consistent.
- firewalld: service rules: You will learn to allow a service such as web or SSH by name in firewalld, and to remove permission for services you do not need.
- firewalld: port rules: You will learn to open or close a specific port in firewalld for applications with no ready-made service definition, and to verify the result.
- Short task: set up a zone and service policy for a web server
Fine-grained rules
- firewalld: rich rules: You will learn how firewalld rich rules let you write finer allow or reject conditions based on a specific address and port.
- Filtering by source address with firewalld: You will learn to filter traffic in firewalld by where it comes from, so only networks you trust can reach certain services.
- Writing your own service definition
- Logging rejected traffic with firewalld: You will learn to make firewalld write rejected connections to a log and read those records to see what was blocked.
- firewalld panic mode: You learn to cut all traffic with one command in an emergency and safely restore it using firewalld panic mode.
- Short task: leave the management port reachable from a single network only
Forwarding and the layer underneath
- firewalld: masquerading and port forwarding: You will understand in the lab what masquerading (NAT) and port forwarding do in firewalld, and what risks they bring if used carelessly.
- iptables basics: chains and default policy: You will read the iptables rules found on older systems and write a few basic ones with a default policy on the INPUT chain.
- Introduction to nftables: tables, chains and rules: You will read the table, chain and rule structure of nftables, the modern Linux packet filter, and build a simple rule set.
- Reading the nftables rules behind firewalld
- Capstone: a firewalld firewall policy for a server: Capstone: for a fictional company's server, you use firewalld to build and test a firewall policy that decides which traffic is allowed and keeps logs of what is rejected.
Practice labs
- Pick the right firewalld zone for a web server: Assign the interface to the right zone, open the http and https services and verify the permanent config.
- Make a rule that vanishes on restart permanent: Find rules added to the runtime config only, move them to permanent and show they survive a reload.
- Separate zones on a dual-interface server: Assign the inner interface to internal and the outer to public and show the management port opens only from inside.
- Untangle zone priority with source bindings: Resolve a conflict where two zones apply to one address and test that the expected rules apply.
- Make the management port reachable from one network only: Allow only the management subnet with a rich rule and show a connection from another address is refused.
- Add a rule that logs rejected traffic: Log rejected connections to a given port with a rate limit and show the source in the log.
- Write a service definition for an in-house app: Create an XML service definition for a two-port internal app, add it to the zone and confirm the ports opened.
- Use panic mode correctly during an attack: Turn on panic mode, check its effect from the console, block the attacking address and safely restore traffic.
- Manage a blocklist with an ipset: Load hundreds of addresses into one ipset, bind it to the drop zone and show an address from the list is blocked.
- Forward a port to an internal web server: Forward external port 8080 to port 80 on the internal server and show the page opens from outside.
- Turn on masquerading so the internal network can get out: Enable masquerading in the outer zone, reach an external address from an inside client and show the source changes.
- Read the nftables rules firewalld generates: Find the counterpart of a rich rule in nft list ruleset output and explain which chain the packet passes through.
- Find the rule where iptables and firewalld collide: Show a hand-added iptables rule cancels out a firewalld setting and move the rule into firewalld.
- List which services are open: List services and ports in every active zone and permanently close one that is not needed.
- Fix for good an interface that lands in the wrong zone after reboot: Examine the gap between runtime and permanent configuration and the NetworkManager connection setting, bind the interface to the right zone permanently and verify after a reboot.
- Use a predefined service instead of a port number: Remove the hand-opened ports 443 and 5432, add the https and postgresql service definitions instead and verify the list.
- Tell non-firewalld rules apart in the running ruleset: Mark the firewalld tables and the hand-added tables in nft list ruleset output.
- Reconcile Docker’s rules with firewalld zones: Show a published container port bypasses the zone rules, constrain the traffic with a firewalld policy and confirm it survives a restart.
About this course
Zones, services and rules.
What you will learn
- firewalld basics
- Fine-grained rules
- Forwarding and the layer underneath
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.