Securing Application Servers: How to Configure Firewalld to Allow Incoming Traffic on a Specific Port

Configure the firewalld rules on the Nautilus application server 2 to allow incoming traffic on port 6300, ensuring the proper functionality of the system in accordance with the security requirements.

1. Install and enable the firewalld service.
2. Allow incoming connections on port 6300/tcp.
3. Ensure the zone is set to public.

---

Solution

Step 1: Connect to App Server 2 (stapp02)

ssh steve@stapp02
# Password: Am3ric@

Step 2: Switch to root

sudo su -
# Password: Am3ric@

Step 3: Install, start, and enable firewalld

# Install firewalld
yum install -y firewalld

# Start and enable firewalld
systemctl start firewalld
systemctl enable firewalld

Step 4: Set zone to public and allow port 6300

# Set default zone to public
firewall-cmd --set-default-zone=public

# Allow port 6300/tcp permanently
firewall-cmd --zone=public --add-port=6300/tcp --permanent

# Reload firewall
firewall-cmd --reload

Step 5: Verify configuration

# Check firewall status
systemctl status firewalld

# Verify default zone
firewall-cmd --get-default-zone

# Verify port is open
firewall-cmd --zone=public --list-ports

# Complete verification
firewall-cmd --zone=public --list-all

One-Line Command (Run from jump host)

echo 'Am3ric@' | ssh steve@stapp02 "sudo -S bash -c 'yum install -y firewalld && systemctl start firewalld && systemctl enable firewalld && firewall-cmd --set-default-zone=public && firewall-cmd --zone=public --add-port=6300/tcp --permanent && firewall-cmd --reload && firewall-cmd --zone=public --list-all'"

Expected Output

[root@stapp02 ~]# firewall-cmd --get-default-zone
public

[root@stapp02 ~]# firewall-cmd --zone=public --list-ports
6300/tcp

[root@stapp02 ~]# firewall-cmd --zone=public --list-all
public
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: dhcpv6-client ssh
  ports: 6300/tcp
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

Verification Commands

# Check firewalld status
systemctl is-active firewalld
systemctl is-enabled firewalld

# Verify port is open
firewall-cmd --query-port=6300/tcp

# Check default zone
firewall-cmd --get-default-zone

# Complete verification
firewall-cmd --zone=public --list-all

Summary

• ✅ firewalld installed and enabled on boot
• ✅ Zone set to public
• ✅ Port 6300/tcp allowed permanently
• ✅ Firewall reloaded and verified

The firewall on App Server 2 is now configured to allow incoming traffic on port 6300/tcp.