linuxexpert-practice-labs/labs/linux-plus/3-2-1-firewalld-and-ufw/README.md

Linux+ 3.2.1: firewalld and ufw

Runtime and permanent firewalld rules, a rich rule for one source address, and ufw.

Before you start

The peer, at 10.99.0.2 (name peer), stands in for the other VM. It sits on this VM's second network, 10.99.0.0/24 (this VM is 10.99.0.1 there, on interface le-host). It also has a second address, 10.99.0.3, which stands in for "anywhere else". Get a shell there with sudo ip netns exec lepeer bash; from it, curl --interface 10.99.0.3 sends from the second address.

On this VM, the lab runs web services on ports 8080 and 9000. On the RHEL family it installs and starts firewalld, allowing SSH. Keep a console open: a firewall mistake can cut off SSH.

Tasks

1. RHEL family: allow HTTP in firewalld at runtime, reload and see it gone, then allow it permanently, in the zone of the main interface.
2. RHEL family: with a rich rule, allow port 8080/tcp only from the peer's address 10.99.0.2, persistently. From the peer, curl http://10.99.0.1:8080/ works, and from 10.99.0.3 it fails.
3. Ubuntu: turn on ufw, allowing OpenSSH first.
4. Ubuntu: allow port 9000/tcp only from the peer's address 10.99.0.2. From the peer, curl http://10.99.0.1:9000/ works, and from 10.99.0.3 it fails. Look at the rules with ufw status numbered.

Hints

• firewall-cmd --add-service, --permanent, --reload, --list-services, --get-active-zones.
• --add-rich-rule='rule family="ipv4" source address="..." port port="8080" protocol="tcp" accept', --list-rich-rules.
• ufw allow OpenSSH, ufw enable, ufw status verbose.
• ufw allow from ADDRESS to any port PORT proto tcp, ufw delete N.