DEV Community

Janak Shrestha
Janak Shrestha

Posted on

Firewall Configuration

#linux

The Nautilus system administrators team has rolled out a web UI application for their backup utility on the Nautilus application server 1 within the Stratos Datacenter. This application runs on port 3002and appropriate firewall rules must be configured to allow incoming traffic. To achieve this, firewalld needs to be installed and configured on the application server. To ensure proper functionality, the following requirements have been identified:

Install and enable the firewalld service.
Allow all incoming connections on port 3002/tcp.
Ensure the zone is set to public.

Solution

Step 1: Connect to App Server 1 (stapp01) 

ssh tony@stapp01
# Password: Ir0nM@n
Enter fullscreen mode Exit fullscreen mode

Step 2: Switch to root or use sudo 

sudo su -
# Password: Ir0nM@n
Enter fullscreen mode Exit fullscreen mode

Step 3: Install firewalld (if not already installed) 

# Check if firewalld is installed
rpm -qa | grep firewalld

# If not installed, install it
yum install -y firewalld
# or for Ubuntu/Debian (if applicable)
# apt-get install -y firewalld
Enter fullscreen mode Exit fullscreen mode

Step 4: Start and enable firewalld service 

# Start firewalld service
systemctl start firewalld

# Enable firewalld to start on boot
systemctl enable firewalld

# Verify status
systemctl status firewalld
Enter fullscreen mode Exit fullscreen mode

Step 5: Set zone to public 

# Check current default zone
firewall-cmd --get-default-zone

# Set default zone to public
firewall-cmd --set-default-zone=public

# Verify zone
firewall-cmd --get-default-zone
Enter fullscreen mode Exit fullscreen mode

Step 6: Allow port 3002/tcp 

# Add port 3002/tcp to public zone
firewall-cmd --zone=public --add-port=3002/tcp --permanent

# Reload firewall to apply changes
firewall-cmd --reload

# Verify the rule is added
firewall-cmd --zone=public --list-ports
Enter fullscreen mode Exit fullscreen mode

Step 7: Verify all configurations 

# Check firewall status
systemctl status firewalld

# Check default zone
firewall-cmd --get-default-zone

# List all open ports
firewall-cmd --zone=public --list-all

# Check if port 3002 is allowed
firewall-cmd --zone=public --query-port=3002/tcp
Enter fullscreen mode Exit fullscreen mode

Complete One-Line Commands

From jump host with password: 

echo 'Ir0nM@n' | ssh tony@stapp01 "sudo -S bash -c 'yum install -y firewalld && systemctl start firewalld && systemctl enable firewalld && firewall-cmd --set-default-zone=public && firewall-cmd --zone=public --add-port=3002/tcp --permanent && firewall-cmd --reload && firewall-cmd --zone=public --list-all'"
Enter fullscreen mode Exit fullscreen mode

Using heredoc (Recommended): 

ssh tony@stapp01 << 'EOF'
echo 'Ir0nM@n' | sudo -S bash -c '
echo "=== Installing firewalld ==="
yum install -y firewalld

echo "=== Starting and enabling firewalld ==="
systemctl start firewalld
systemctl enable firewalld

echo "=== Setting zone to public ==="
firewall-cmd --set-default-zone=public

echo "=== Allowing port 3002/tcp ==="
firewall-cmd --zone=public --add-port=3002/tcp --permanent
firewall-cmd --reload

echo "=== Verification ==="
firewall-cmd --zone=public --list-all
'
EOF
Enter fullscreen mode Exit fullscreen mode

Step-by-Step Interactive Commands 

# Connect to stapp01
ssh tony@stapp01
# Enter password: Ir0nM@n

# Become root
sudo su -
# Enter password: Ir0nM@n

# Step 1: Check if firewalld is installed
echo "=== Checking if firewalld is installed ==="
rpm -qa | grep firewalld

# Step 2: Install firewalld if not present
echo "=== Installing firewalld ==="
yum install -y firewalld

# Step 3: Start firewalld
echo "=== Starting firewalld ==="
systemctl start firewalld

# Step 4: Enable firewalld to start on boot
echo "=== Enabling firewalld ==="
systemctl enable firewalld

# Step 5: Check firewalld status
echo "=== Firewalld Status ==="
systemctl status firewalld

# Step 6: Set default zone to public
echo "=== Setting zone to public ==="
firewall-cmd --set-default-zone=public
firewall-cmd --get-default-zone

# Step 7: Allow port 3002/tcp permanently
echo "=== Allowing port 3002/tcp ==="
firewall-cmd --zone=public --add-port=3002/tcp --permanent

# Step 8: Reload firewall
echo "=== Reloading firewall ==="
firewall-cmd --reload

# Step 9: Verify port is open
echo "=== Verifying open ports ==="
firewall-cmd --zone=public --list-ports

# Step 10: Show complete configuration
echo "=== Complete Firewall Configuration ==="
firewall-cmd --zone=public --list-all

# Exit
exit
exit
Enter fullscreen mode Exit fullscreen mode

Expected Output 

[root@stapp01 ~]# yum install -y firewalld
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
Package firewalld-0.9.3-13.el8.noarch already installed and latest version
Nothing to do

[root@stapp01 ~]# systemctl start firewalld
[root@stapp01 ~]# systemctl enable firewalld
Created symlink from /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service to /usr/lib/systemd/system/firewalld.service.
Created symlink from /etc/systemd/system/multi-user.target.wants/firewalld.service to /usr/lib/systemd/system/firewalld.service.

[root@stapp01 ~]# firewall-cmd --set-default-zone=public
success

[root@stapp01 ~]# firewall-cmd --zone=public --add-port=3002/tcp --permanent
success

[root@stapp01 ~]# firewall-cmd --reload
success

[root@stapp01 ~]# firewall-cmd --zone=public --list-all
public
  target: default
  icmp-block-inversion: no
  interfaces: 
  sources: 
  services: dhcpv6-client ssh
  ports: 3002/tcp
  protocols: 
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules:

[root@stapp01 ~]# firewall-cmd --zone=public --query-port=3002/tcp
yes
Enter fullscreen mode Exit fullscreen mode

Additional Verification Commands 

# Check if firewalld is running
systemctl is-active firewalld
# Should output: active

# Check if firewalld is enabled for boot
systemctl is-enabled firewalld
# Should output: enabled

# List all zones
firewall-cmd --get-zones

# List all open ports in public zone
firewall-cmd --zone=public --list-ports

# List all services in public zone
firewall-cmd --zone=public --list-services

# Check if specific port is open
firewall-cmd --zone=public --query-port=3002/tcp

# View rich rules
firewall-cmd --zone=public --list-rich-rules

# Check firewall state
firewall-cmd --state
# Should output: running

# View the current configuration
firewall-cmd --list-all
Enter fullscreen mode Exit fullscreen mode

Troubleshooting

  1. "firewalld: command not found": 
   # Install firewalld
   yum install -y firewalld
   # or
   apt-get install -y firewalld
Enter fullscreen mode Exit fullscreen mode
  1. "Failed to start firewalld": 
   # Check for errors
   journalctl -u firewalld
   # Stop and restart
   systemctl stop firewalld
   systemctl start firewalld
Enter fullscreen mode Exit fullscreen mode
  1. "FirewallD is not running": 
   # Start firewalld
   systemctl start firewalld
   # Check status
   systemctl status firewalld
Enter fullscreen mode Exit fullscreen mode
  1. "Error: COMMAND_FAILED": 
   # Use --permanent flag and reload
   firewall-cmd --zone=public --add-port=3002/tcp --permanent
   firewall-cmd --reload
Enter fullscreen mode Exit fullscreen mode
  1. "Zone public not available": 
   # List available zones
   firewall-cmd --get-zones
   # Set a different zone if needed
Enter fullscreen mode Exit fullscreen mode
  1. "Failed to set default zone": 
   # Check if firewalld is running
   systemctl status firewalld
   # Restart firewalld
   systemctl restart firewalld
Enter fullscreen mode Exit fullscreen mode

Firewalld Commands Reference

Service Management 

systemctl start firewalld    # Start firewalld
systemctl stop firewalld     # Stop firewalld
systemctl restart firewalld  # Restart firewalld
systemctl status firewalld   # Check status
systemctl enable firewalld   # Enable on boot
systemctl disable firewalld  # Disable on boot
Enter fullscreen mode Exit fullscreen mode

Zone Management 

firewall-cmd --get-default-zone              # Get default zone
firewall-cmd --set-default-zone=public       # Set default zone
firewall-cmd --get-zones                     # List all zones
firewall-cmd --list-all                      # List all rules
Enter fullscreen mode Exit fullscreen mode

Port Management 

firewall-cmd --zone=public --add-port=3002/tcp --permanent   # Add port
firewall-cmd --zone=public --remove-port=3002/tcp --permanent  # Remove port
firewall-cmd --zone=public --list-ports                      # List ports
firewall-cmd --zone=public --query-port=3002/tcp            # Query port
firewall-cmd --reload                                        # Reload rules
Enter fullscreen mode Exit fullscreen mode

Service Management 

firewall-cmd --zone=public --add-service=http --permanent    # Add service
firewall-cmd --zone=public --remove-service=http --permanent # Remove service
firewall-cmd --zone=public --list-services                   # List services
Enter fullscreen mode Exit fullscreen mode

Complete Script (Run from Jump Host)

Create a script setup_firewall.sh:

#!/bin/bash

echo "========================================="
echo "Installing and Configuring Firewalld"
echo "========================================="

ssh tony@stapp01 << 'EOF'
echo 'Ir0nM@n' | sudo -S bash -c '
echo ""
echo "=== Step 1: Installing firewalld ==="
yum install -y firewalld

echo ""
echo "=== Step 2: Starting firewalld ==="
systemctl start firewalld
systemctl enable firewalld

echo ""
echo "=== Step 3: Setting default zone to public ==="
firewall-cmd --set-default-zone=public

echo ""
echo "=== Step 4: Allowing port 3002/tcp ==="
firewall-cmd --zone=public --add-port=3002/tcp --permanent
firewall-cmd --reload

echo ""
echo "=== Step 5: Verification ==="
echo "Firewalld Status:"
systemctl status firewalld | grep -E "Active|Loaded"

echo ""
echo "Default Zone:"
firewall-cmd --get-default-zone

echo ""
echo "Open Ports:"
firewall-cmd --zone=public --list-ports

echo ""
echo "Complete Configuration:"
firewall-cmd --zone=public --list-all

echo ""
echo "✅ Firewalld configured successfully!"
'
EOF
Enter fullscreen mode Exit fullscreen mode

Make it executable and run:

chmod +x setup_firewall.sh
./setup_firewall.sh
Enter fullscreen mode Exit fullscreen mode

Security Best Practices

  1. Allow only specific IPs (if needed): 
   firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port protocol="tcp" port="3002" accept' --permanent
Enter fullscreen mode Exit fullscreen mode
  1. Limit source IPs for security: 
   firewall-cmd --zone=public --add-source=10.0.0.0/8 --permanent
Enter fullscreen mode Exit fullscreen mode
  1. Verify after reboot: 
   systemctl reboot
   # After reboot, verify
   systemctl status firewalld
   firewall-cmd --zone=public --list-ports
Enter fullscreen mode Exit fullscreen mode

Complete Solution Summary

The firewall has been configured on App Server 1 (stapp01):

  • ✅ firewalld installed: yum install -y firewalld
  • ✅ firewalld started: systemctl start firewalld
  • ✅ firewalld enabled on boot: systemctl enable firewalld
  • ✅ Default zone set to public: firewall-cmd --set-default-zone=public
  • ✅ Port 3002/tcp allowed permanently: firewall-cmd --zone=public --add-port=3002/tcp --permanent
  • ✅ Firewall reloaded: firewall-cmd --reload
  • ✅ Configuration verified: Port 3002 is open and accessible

The Nautilus backup utility web UI application running on port 3002 can now accept incoming connections through the firewall.

Top comments (0)