Hello and welcome to the lecture Introduction to Firewall.
When you need to secure your system, Firewall should be the number one things to be discussed as well.
So let's start with what exactly the firewall is a firewall as what it reads.
It's it's actually like a wall that prevents the spread of fire.
So anything that you put it up, that's not going to let the fire in, that's actually the firewall.
That's how they got there.
This name, when data moves in and out of a server, its packet information is tested against the firewall
rules.
And therefore our rules is actually something that reside on the firewall.
So when that is tested against the firewall rules to see if it should be allowed or not, in my words,
the way I want to describe it is that a firewall is like a watchman or a bouncer or a shield that has
a set of rules given.
And based on those rules, they decide who can enter and who could leave.
There are two types of firewalls in i.t.
The first one is the software firewall, which is actually the firewall that runs on an operating system.
So you have a firewall that runs on linux.
You probably have a firewall that runs on Windows or any operating system.
It has a little software that is called firewall.
Another type of firewall is a hardware firewall.
Now that firewall is is actually a dedicated appliance like a hardware appliance with, of course,
the firewall software running on it.
Now, that type of appliance more often found on the network side, the network team are the one who
actually maintains that type of firewall.
But anyway, our focus is what our focus is the software side of the firewall, which actually runs
on operating system.
All right.
So let me put an in a picture so it will be easier to understand.
So we have a server, a it's a simple it wants to go to server B Now when it goes to server B, it sends
some kind of protocol or a connection request.
And in this case, let's say the server e wants to connect to server B with through SSH and port 22.
But when there is a firewall in the middle, it will check.
It's a rule and it will say, Hey, let me check the rule.
If Server A is allowed to come in on Port 22 and that rule says, yes, this server can come in, then
server says, okay, I have made that clear and connection is established.
Another example would be another server wants to go to server B and they want to connect to server B
to FTP and FTP, as we all know, runs on Port 21.
Now before it goes to an established connection to server B, it goes to the firewall and firewall rule
says on server B that a server A is not allowed to come in using protocol or service FTP.
Then what happened is there will be say, sorry, dude, I cannot let you come in because my firewall
rule says that you are not allowed to enter into my operating system through FTP service.
Now you may see this firewall sitting in the middle and you're probably thinking where exactly sitting.
But in reality this firewall is sitting on server a as well as there's another firewall is also sitting
on server B, so both servers A and B do have firewalls as well.
Server A who wants to connect to server B could also have a rule whether this service is even allowed
to leave the server or not.
And then when it goes to server B, the server B has its own firewall which will say, hey, even though
it came in, but let me see if this service is allowed to be accepted, to serve to, to my server.
So that's how the firewall works.
Okay.
So now it's time to work on firewall, specifically the tool firewalls.
DX Firewall.
DX works the same way as IP table, but of course it has its own commands and the command that it starts
with is firewall dash cmd.
Make sure the command firewall the first part or the first word does not have DX in it.
So it's just firewall dash cmd.
It has a few predefined service rules that are very easy to turn on and off and those services such
as NFS, MTP, http d they are.
Already.
They're in an XML format.
All you have to do is add those services into the firewall de table and the rules will cover that in
the later lecture, of course.
Then I'll show you how exactly the XML file works.
Then the Firewall DX also has the following table chains, rules and targets.
So the table chain rules targets.
You guys already know.
Table is the one that has all the information about chain rules and target chains or the ones that has
outgoing, incoming or forward traffic information.
And the rules are associated to those chains.
Like if incoming traffic is matches or does match this rule, then what to do?
Then comes the target.
That target would be either drop, reject or accept the traffic.
So again, as I said, it works similarly as IP tables.
And if you need to refresh all these different table change rules and target information, you could
go back to IP tables to find more information about them.
Okay.
So you can run one or the other, meaning either IP tables or firewall dx.
It is not recommended to run a both at the same time.
Make sure IP tables is stop disable and mask before you start firewall dx and of course to stop it you
will use system CTL, stop IP tables, then a system CTL to disable it so it won't start at boot and
to mask it so you won't start it accidentally or any other programs don't start it then after it is
stopped.
Now you need to check whether firewall service that you're trying to start has the package or required
package installed in your system.
But as I said, if you're using CentOS seven, Red Hat seven or Fedora seven and above, by default
it would have firewall installed.
By the way, I just checked in the third line.
You see I have a file wall.
DX It's just a mistake.
I instead of l I should have.
Ah Anyway, it's just a little honest mistake then to check if the package is installed you will run
rpm dash key way and grep for firewall dx.
If you don't find it then you will run yum command to install firewall dx and once it is installed you
will start the firewall dx by using the command system.
CTL start.
And then firewall the next command would be sys CTL enabled firewall.
You cannot run all that in one command.
I just put it in one to save some space, then to check the rule of firewall, what's inside and what
is defined.
You will run firewall, dash, cmd, dash, dash list, dash all it will tell you what services are
enabled, what rules are in place, what type of chains in place.
Getting the list of all the services Vivaldi is aware of.
That's the services I talk to you about in the previous slide that there are services predefined by
firewall DH and they are written in XML format and you could simply add those services and remove it
in one single command.
And to get the listing of all those services, you run the firewall, the command, sorry, firewall,
dash, command, get services to make firewall D, reload the configuration added it.
Meaning if you added a rule in firewall dx, you will always have to run the command firewall dash cmd
dash dash reload.
So your firewall process would know about the new rule or new information that you added into the table.
All right.
So now I'm going to go into the Linux machine and we'll try all of that.
So first thing first is first, make sure the IP table is not running sys CTL status IP tables and you'll
see it is running it is active right now.
So the you will have to stop it up hit up arrow key and.
Replace status with stop.
It has stopped now.
Disable it.
So it does not start at PW time and then mask it.
So you don't or any of the programs started by mistake.
You could check the status again and you'll see right now it is masked and it is inactive.
Perfect.
Now it's time to check if we have firewall rd package installed.
So rpm dash qr and grab for firewall dx.
Okay.
So it does have this is a package we concerned about.
Make sure this package is there.
And if there are more firewall DX on the system file system level, you could also install that, but
most likely it will get installed with it if you just type yum install firewall.
DX.
Okay, so now it is installed.
Now the next step is to start that firewall.
System.
CTL start.
Firewall.
D It says the unit is masked, which means it is not allowed to start by mistake or by any other program.
So we have to unmask it.
So unmask.
All right.
It is unmask.
Now, you could go ahead and start it.
It has started perfect and now go ahead and enable it.
So it starts at boot time.
Okay.
Now go ahead and check the status now.
Okay.
It is running.
It is.
The current status is active.
Nice.
Clear the screen.
And now I am going to check what's inside of my firewall rules, what comes out of the box.
And for that I will do a dash, dash list, dash all.
And you will see this is the table.
It's a public table, it's active and it has the services by default.
Sage dhcp v six client.
These two services are already enabled that firewall the services every time I start up and by default
SSH is allowed to come in.
And if you see you could define ports here.
Any specific rules that you have, you could you could put them in there, rich rules which we will
cover in the later lecture.
So if you add something, you could run the command firewall, dash cmd followed by the correct syntax
to add a service or port to get the listing of all the services that firewall DH is aware of.
You will type firewall cmd get.
Services.
Okay.
So these are the list of services.
I was talking to you guys earlier.
These are the predefined services and all of them are separated by a space and they are written in alphabetical
order.
So A, B, C, and if you are looking for, let's say, sage, you'll see an S in S section and you
see Sage is here, SMTP services here.
If you're looking for FTP, you go into F section.
So the F as this is F and you see FTP.
So all these services are actually predefined in there.
Doesn't mean that it is already part of the firewall rules that it will allow all these services by
default to be enabled.
It's not that it's it's telling firewall D Hey, you have the service.
All you have to do run a command.
Tell me this is the service you want to enable and I'll go to its configuration file.
I'll find out what port it runs on and I'll enable it for you.
So I'll cover that XML file in the later lectures.
So for now, just make sure you start your firewall D It's up and running and it has the services listed
as right here to predefined two of the services.
Let's get into some practical examples on firewall DH.
The Firewall DS had multiple zones.
To get a list of all zones, you have to run the command firewall, dash, cmd, dash, dash, get zone.
So let's go into the Linux machine and we'll run it here and we'll see how many zones in the listing
of zones that you could get.
So firewall.
CMD dash.
Dash.
Zones.
And you will see it will give you the list of zones block dmg, drop external home and internal public
trust at work.
You could use any zone that is required by your company or your policies.
Most of the time that I've seen is the public is the zone that is used most of the time.
So our focus on this lecture will remain on public.
So that's how you get the listing of zones to get a list of active zone.
Now to see we have all those zones and which one is the active one.
And for that we will run the command firewall CMD and get the active dash zones.
This is listing that the zone that is active and that is active in terms of in firewall where firewall
is getting all its rules, configuration is public and the interface that is attached to that zone is
our default, uh, interface.
You might have a different one if you're using a different type of Linux, whether physical or virtual.
The next one we will talk about is how to get firewall rules for public zones.
So now you know that we are the public is the zone that is active.
Now, how to get a list of that zone, you can run a command to firewall cmd dash dash zone, equal
public dash, that's list zone.
But if you notice, when you run the command, get active zones, it only gave us the public zone.
So when you only have one zone active, then you really don't have to specify the zone name.
But just to to practice, if let's suppose you had multiple zone, then you would have to specify a
zone equal public.
So let's see.
In that case, we'll do.
Firewall seemed dashed as zone equal.
Public.
And list all.
This is the zone which has a by default out of the box.
If you are running your firewall for the first time, this is what you're going to see and you'll see.
The main thing that you're going to see is the zone is public and it's active.
And the services that is default service that you get is S-H, DHCP, IPV, six and client.
These are the services that are enabled by default.
Again, what I meant was if your public zone is already active and it's the only one that you don't
have to specify, you could just simply run the command without specifying the zone.
I'll get the same result.
Now, you could also, as I said, you could do without zone as well.
So all services are predefined by a firewall.
As explained previously, you have a list of all those services.
Now the question is, I do have the list of all the services I could go in and enable and disable it
and turn it on.
But what if I want to add a third party service in that case, we'll take an example.
Let's say if you want, if you install SAP application in your Linux server and you want to allow that
application to be on and off, then you have to go into user lib firewall services and all those services
that are predefined are in that directory.
And all you have to do is simply copy any data XML file and change the service and its port number.
Now when you open that file, that XML file, this is how it's going to look like.
By the way, this is a smaller version.
There are many files, XML files in that directory that have a longer description.
So the shorter description is a test I am showing you is when you get that file, any of the file in
that directory that ends with that XML, you'll see its version on the first and the second you'll see
that service entire information about the service.
Then you'll see that the service, what type of service it's that you'll see is search and what description
that you want to put on what exactly this service will do.
And of course, the port information and the service name which is in this one is TCP and the port number
is 22.
This is how it looks like.
But in the next slide, we are going to make a customize service, which I just mentioned, support
XML and I will show you how you could make it firewall DX Aware.
So let's go into the next slide and let's see if you want to add a service.
Let's say HTTP in your firewall.
For that you have to run the command firewall, dash cmd, dash, dash, add dash service equals http.
So right now when you run this command, you'll see there is no HTTP service in services.
So if you have Firefox and you could open it up and you could try to access your HTTP service, you
will see that it will not be accessible.
But of course, in order to check that, first you need to make sure your HTTP service is running.
So let's see.
Sys ctl status http dx.
Okay.
It says this mask is inactive, so we have to activate it in order to test our firewall rules when we
add them in.
So we will do is first I will unmask it.
Then I will start the service.
Services started.
Let's check the status.
It is active.
Now I will go ahead and open my browser to make sure I could access my Apache server using a HTTP protocol
service.
So my.
Okay.
So now my IP address of my machine, the Linux that I'm using is 1i21 61.1 62.
So when I reload you will see it is saying problem loading page and it is spinning.
It means it will connection will say it has timed out as you see it's taking too long.
This is the message you will get.
So in order to your in order to get to your server through that HTTP service, you have to enable it.
So let's go to.
Are.
Firewall and let's add that.
So let's clear the screen firewall die cmd dash dash.
Add what service you want to add http.
Okay.
That service is added.
And when you do list again.
You will see in the service section.
There is this last survey that's been added.
Now let's go ahead and verify it by going into our Firefox machine and then refresh the screen and you
got the splash page as a tip, meaning we could get into our splash page and it works perfectly fine.
Good.
Now, one more thing is, if you want to remove that, you could simply hit up arrow key or go back
to the same command and type remove and it will remove it.
You could check the status, whether it's gone or not, but looking at your list all and you'll see
it is gone now.
So that's what to remove the service is about then to reload the firewall configuration.
Meaning let's say if you added some service and now you just want to clear the entire firewall configuration,
whatever that you added and for that you have to type firewall the reload.
So before I do that, I'll show you first when we add it.
That HTTP service is added.
Now if you do list, you'll see it is there.
But now when you go in and reload.
Reload and check.
That firewall, you'll see that HTTP service that we added.
It's gone.
So it's kind of like a way of firewall to flush whatever the temporary rules are in there.
So if you want to add any rule permanently, you have to specify permanent in the end.
So to add or remove a service permanently, you will run the command firewall.
Dash cmd.
Dash dash add dash service http equal permanent.
And that will add it permanently to that zone, which is the public zone.
Of course, to remove it permanently, you will run the same command with remove and a dash dash permanent
option.
Now let's talk about the third party application we talked about in the last slide.
What if there are there are services that you want to add?
It's not.
It's it it didn't come pre-defined or as a default service in firewall.
So what we have to do is first thing is you have to go into this directory usr bin firewall services,
you could just simply copy any data XML file and make the name of the new service file and change the
service and port number inside of that file.
Then you have to restart the firewall DX And then simply add a firewall and then simply get the, get
the listing of those services to confirm, to verify if that service is there and if it's there, it's
working.
Then you can run the firewall DX command to add that service.
So we'll go, we will go through that exercise now and let's see.
And as I said, we'll use the as an example, we'll use the service SAP and SAP I believe runs on Port
32.
So I'll go into usr lib firewall DX services.
And by the way, if you're doing that for the first time, I recommend you do take a snapshot of your
virtual machine in case things goes wrong.
Okay.
Now in this services, there are a bunch of services.
If you run a list minus LX, you'll see all those services that you get.
When you run the command.
What command?
You run?
Firewall.
Dash.
Seemed dashed to get services.
All these services that you see are actually Vivaldi is pulling them from the these files.
Now, again, we want to add as a sap, I'm going to go ahead and take any files.
So in this case, I'm gonna do copy SSH XML file and I'm going to copy it to SAP XML file verified.
It's there.
I'm going to do it myself here.
It's there all the way to the end.
Now I will go ahead and modify that file via SAP XML.
And you see it has that version service.
The short description is S-H and I'll remove it to a sap.
Okay.
Now, this is a description of a remove everything that is listed for such service description and I
will put the third party description whatever this service will do.
This is a third party.
Application service.
Okay, good.
Now the protocol is TCP or whatever that you wanted to specify and you could use the port 32.
So of course you need to know these things, whether it's a TCP, UDP, what port number it is, what's
the service?
Now, you could go ahead and save that file.
Less say you could verify a SAP XML and you'll see it is there with all the settings that you have specified.
Now if you want to see that sap in your listing, meaning when you run this command and you want to
see it there, then you will have to restart the firewall.
DX.
The system.
CTL restored a firewall.
De it is restarted.
Now when you're going to run that gets services.
You should be able to see your sap service.
So the me what I will do is I will firewall the CMD get services, I'll just simply do crap.
SAP.
And there you go.
So see, it's highlighted for us.
It's easier for us to know where exactly it ended.
So now this SAP service is in there.
Nice.
Now, we could go ahead and add it as a service to the firewall configuration.
So to add it simply firewall.
That seemed.
Add Dash.
Service equal.
The name of the service.
You will add it.
And when you do list.
You will see it added that SAP service.
Now if you're trying to add any other services that is not in that XML file, it will just simply fail.
It's not going to work.
So for example, if I'm trying to add service, call Imron.
It says invalid service.
Imran because it went into that the user lib firewall de services directory, it looked for the Imran
that XML file and it didn't, it doesn't exist.
That's why it's not able to add that.
So it's a good feature of our world.
This way you could just simply have to add or remove services that are defined in that directory.
All right.
So moving on.
By the way, let me remove this service.
So this way I have everything cleaned up.
Or I could just simply do what?
Reload if I have not added it permanently.
Success.
Let's verify it.
It is there.
It's gone.
Good.
Moving on now.
Now what?
If you want to add a port to your firewall de configuration, simply you will run the command, which
is firewall.
Dash cmd dash dash add dash port equal.
I picked this 1101110 as a random port.
You could pick which airport that you wanted to open and the protocol.
Hit enter verify that and you will see it is going to show up under port's TCP when it's added.
Now, again, if you do not specify dash, dash permanent.
Then it will go away.
That moment you do firewall cmd, dash, dash, reload.
Okay.
So that's how you add a port.
And of course, to remove a port, you would do remove port.
So let's go ahead and remove port.
Add port.
I will do remove.
Port.
Zero dash tcp.
It is gone.
Let's verify it.
And it's no longer there.
Beautiful.
Okay.
Now to reject incoming traffic from an IP address.
So again, this is kind of a scenario where you have someone coming in to your machine with an IP address
and you don't like that person or you don't like the machine.
Whatever the reason, you just want to block any traffic coming in from that IP address.
So you will run this as a rule.
It's a it's a little long rule, but it is added in the rich rule space all the way at the bottom.
So let's go into our rule.
You see, when you run firewall, cmd, dash, dash, all you see rich rules all the way at the bottom.
This is where you have to add this rule.
So I'm going to do is I'm going to make this smaller so I could grab this up and read the whole command.
I will just make this bigger as well.
So I, I could be able to type everything in one line.
So firewall.
Dash seemed.
Dash dash add you adding a rich rule and that ritual says equal.
What is the rule about family within IPv4?
And which IP address are you trying to block?
It is a source and the address of that source equal code.
192 168 .0. 25.
And then what you want to do?
Remember the target thing that we talked about you wanted to reject?
And coat close.
It has been successful.
Let's verify it is there and you will see this rule is added as a rich rule all the way at the bottom,
which will reject all incoming traffic if they matches this IP address.
Now to block an unblock ICMP traffic.
What if you do not want people to ping you?
So you could run simply this command.
So let me go back in and let me go ahead and remove that rich rule that I added.
So instead of just add, I will do remove.
Or I could have just to firewall that cmd reload.
Anyway, it's gone.
That's verified.
Yep, it's gone.
Now I want to block all incoming traffic firewall.
They seemed I mean, all incoming pink traffic, not all traffic.
And dash ICMP as you know, the pain comes on the protocol ICMP dash block and inversion that is added
less verified and you will see.
ICMP block inversion is set to yes.
Now, if I go into my and hear the machine, let's say I go into my windows machine and I have a DOS
prompt open and I try to ping my Linux machine where I have enabled this rule 1 to 1 61.1 62.
This is the IP of my machine and you'll see it says host unreachable.
Now if I go ahead and remove that rule, meaning instead of add, I'll just to remove.
And now if I try to ping it, I should be able to ping.
That's how you block or unblock and ICMP traffic.
Now this to remove now to block outgoing traffic to a specific website slash IP address as an example,
I'm going to use that example again.
What if you want to block all the traffic that's go that goes outside to Facebook.
You know, just don't want your kids or whoever you're dealing with, you just don't want the person
to go outside to Facebook page or any page for that matter.
But for that, you have to find out what is the IP address of that page.
And to find that you have to run the command host dash t a then the URL to find that IP address.
I have already found that IP address and the IP address is 3113 7136.
And to block that outgoing traffic, this is the command you will run.
So let's run that command.
So I have this.
Linux machine right here and again to find the name of the host.
So I defined the IP address.
Of Dub dub dub dot facebook dot com.
You will see that the IP address is already there.
Confirm.
Now I need to block that firewall.
But before I block that, let me ping that IP address just for now.
Just make sure that I could go out.
Yes.
I could go out.
I could get a response.
Now I'm going to go ahead and block that.
Direct.
Add a rule IPv4 filter.
The output.
Remember, the output is that outgoing traffic is to disable to going to the source 331 1371 and 36
is the IP.
What do you want it to do?
You want to just do the target, which is drop.
It is successful.
Now, you could go ahead and ping that IP address and you will see it would tell you the operation is
not permitted because you are not allowed to go outside.
Now, if I go ahead and reload my.
Entire firewall.
The.
And now if I ping it.
I still cannot.
Let me see if I.
Uh, what's inside my list rule?
It is still there or it's not there, but I cannot ping that.
I guess I have to restart my service here.
So that would be system C to restart.
The firewall.
De.
Restore.
Let's try.
Try it.
And now I'm able to paint it.
Maybe it was in cash, but we have to just restart the entire Vivaldi.
But that's okay.
So now this is how you could block outgoing incoming traffic.
And these are a few commands that we have covered.
And this is pretty much very close to what the commands we ran in our IP tables.
Hopefully the entire Firewall D lecture that was split in two actually served a purpose and you are
able to understand how firewall works.