Securing Your CentOS7 Server with Firewall Configuration

Understanding the CentOS7 Firewall Basics

If you are running a CentOS7 server, it is important to understand the firewall basics in order to secure your server from potential threats. CentOS7 comes with a firewall package called firewalld, which replaces the previous iptables system. Firewalld is more dynamic and easier to use than iptables because it allows you to make changes without having to reload the entire firewall.

By default, firewalld is installed and enabled on CentOS7. You can check whether firewalld is running by entering the following command:

systemctl status firewalld

If the output shows “active (running)”, it means that the firewall is running. If it isn’t running, you can start it with:

systemctl start firewalld

The firewall has three predefined zones: public, internal, and dmz. Each zone has its own set of rules. By default, all incoming traffic is blocked. Outgoing traffic, on the other hand, is allowed by default. The following zones are available:

• public – for untrusted public networks
• internal – for trusted internal networks
• dmz – for networks that are semi-trusted

You can view the currently active zones by entering the following command:

firewall-cmd --get-active-zones

The output will display the current zones. You can also define your own zones to meet your specific requirements.

The firewall’s default configuration provides a basic level of protection, but it is possible to customize the firewall by defining your own rules. The basic firewall rules are used to allow or block specific ports and protocols. To allow or block ports, use the following commands:

firewall-cmd --add-port=80/tcp

The command above allows incoming traffic on port 80 for the tcp protocol. To block a port, use the following command:

firewall-cmd --remove-port=80/tcp

The command above blocks incoming traffic on port 80 for the tcp protocol.

You can also allow or block specific protocols, such as SSH, by using the following commands:

firewall-cmd --add-service=ssh

The command above allows SSH traffic. To remove the SSH rule, use:

firewall-cmd --remove-service=ssh

You can also whitelist specific IP addresses or ranges to allow traffic from a trusted network. For example,

firewall-cmd --add-source=192.168.0.10

The command above allows incoming traffic from IP address 192.168.0.10. To remove the rule, use:

firewall-cmd --remove-source=192.168.0.10

It is important to note that firewalld uses zones to group machines together based on how trusted they are. If you define a rule in a specific zone, it will only apply to machines in that zone. If you add a new machine to that zone, the rule will apply to that machine automatically.

Another useful feature of firewalld is the ability to create “rich rules.” Rich rules allow you to define more complex firewall rules. For example, you can create rules based on the packet’s protocol, interface, source and/or destination IP address, and port. Here is an example of a rich rule that blocks incoming traffic from IP address 10.0.0.5:

firewall-cmd --add-rich-rule='rule family="ipv4" source address="10.0.0.5/24" drop'

This rule drops all incoming traffic from the IP address range 10.0.0.0/24. Rich rules are a powerful tool that allow you to customize your firewall rules to match your specific needs and requirements.

In conclusion, it is important to have a good understanding of the basics of the CentOS7 firewall. Firewalld is a dynamic and powerful firewall package that provides a basic level of protection for your server. By defining your own rules and zones, you can customize the firewall to meet your specific needs and requirements.

Configuring Firewall Rules in CentOS7

Firewall is an important security feature in any operating system. It filters incoming and outgoing traffic and blocks unauthorized access to the system. CentOS7 comes with a default firewall called firewalld. This article will guide you on how to configure firewall rules in CentOS7.

Before we start, log in to your CentOS7 system as the root user.

Checking Firewall Status

The first step is to check the status of the firewall. To do this, run the following command:

systemctl status firewalld

The output will show the current status of the firewall service. If it is disabled, you can enable it by running the following command:

systemctl enable firewalld

You can also start, stop, and reload the firewall service using the following commands:

• systemctl start firewalld: start the firewall service
• systemctl stop firewalld: stop the firewall service
• systemctl reload firewalld: reload the firewall service

Note that any changes made in the firewall rules will require a firewall reload to take effect.

Adding Firewall Rules

Once the firewall service is running, you can add new firewall rules. To allow incoming traffic for a specific service, you need to know the service name and its port number. The list of pre-defined services can be found in the /usr/lib/firewalld/services directory.

To add a new rule, run the following command:

firewall-cmd --add-service=<service> --permanent

Replace <service> with the service name, such as ssh, http, or https. The –permanent option makes the rule persistent across reboots.

You can also allow incoming traffic from a specific IP address or subnet using the following command:

firewall-cmd --add-source=<ip_address/subnet> --permanent

Replace <ip_address/subnet> with the IP address or the subnet you want to allow. The –permanent option makes the rule persistent.

To remove a rule, use the –remove option with the same syntax as the –add option.

firewall-cmd --remove-service=<service> --permanent

firewall-cmd --remove-source=<ip_address/subnet> --permanent

After adding or removing rules, reload the firewall service using the following command:

firewall-cmd --reload

Managing Zones

Firewall rules are organized into zones in firewalld. Each zone has its own set of rules and applies to a specific network interface. The default zone is public, but firewalld comes with several pre-defined zones.

You can list the available zones and their interfaces using the following command:

firewall-cmd --get-zones

You can also list the rules in a specific zone using the following command:

firewall-cmd --zone=<zone> --list-all

Replace <zone> with the zone name, such as public, internal, or trusted.

To change the default zone, use the following command:

firewall-cmd --set-default-zone=<zone>

You can also add a new zone using the following command:

firewall-cmd --new-zone=<zone>

Replace <zone> with the name of the new zone. You can then customize the new zone rules using the –add-service and –add-source options.

Conclusion

Configuring firewall rules in CentOS7 is an important step in ensuring the security of your system. By following the steps outlined in this article, you can add or remove firewall rules, manage zones, and control incoming and outgoing traffic on your CentOS7 server. Remember to always reload the firewall service after making any changes to the firewall rules.

Troubleshooting Common CentOS7 Firewall Issues

The CentOS7 Firewall is a critical component that helps protect your computer systems from unauthorized access and malicious attacks. However, it can sometimes cause issues and prevent legitimate network traffic from reaching your system. This section will discuss some of the most common issues that users face with the CentOS7 Firewall.

1. Firewall Blocks Network Traffic

One issue that users often face is when the Firewall blocks legitimate network traffic from reaching your system. In such cases, you need to check the Firewall settings and ensure that the Firewall is configured to allow traffic from the necessary sources.

You can do this by adding a specific rule to allow traffic from a particular IP address or range. For example, if you want to allow traffic from a specific IP address, you can use the following command:

firewall-cmd --permanent --add-source=[IP_ADDRESS] --zone=public

This command will allow traffic from the specified IP address to pass through the firewall. You can also use this command to allow traffic from a range of IP addresses by replacing the IP address with the appropriate CIDR notation.

After adding the necessary rules, make sure to reload the Firewall rules.

firewall-cmd --reload

If this does not solve the issue, you may need to check if there are any other network devices, such as routers or switches, that may be blocking traffic to your system.

2. Firewall Blocks Services

The CentOS7 Firewall can also sometimes block services that are necessary for your system to function correctly. In such cases, you need to allow access to the necessary services through the Firewall.

You can use the following command to list all the services that are currently available:

firewall-cmd --get-services

If you do not see the necessary service in the list, you can add it using the following command:

firewall-cmd --permanent --add-service=[SERVICE_NAME] --zone=public

This command will allow traffic for the specified service to pass through the firewall. After adding the service, make sure to reload the Firewall rules.

If this does not solve the issue, you may need to check if the service is running correctly on your system or if there are any other issues with the configuration.

3. Firewall Blocks Outgoing Traffic

Sometimes, the CentOS7 Firewall may block outgoing traffic from your system. This can happen if you are trying to access a remote system or service and the Firewall is blocking the connection.

To troubleshoot this issue, you can try disabling the Firewall temporarily and see if the connection goes through. You can use the following command to disable the Firewall temporarily:

systemctl stop firewalld.service

If this solves the issue, you can then add the necessary rules to allow outgoing traffic through the Firewall.

You can use the following command to add a rule to allow outgoing traffic to a specific IP address:

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="[SOURCE_IP]" port protocol="tcp" port="[PORT_NUMBER]" accept'

This command will allow outgoing traffic to the specified IP address and port through the firewall. After adding the necessary rules, make sure to reload the Firewall rules.

If this does not solve the issue, you may need to check if there are any other factors, such as network routing issues, that may be causing the problem.

In conclusion, the CentOS7 Firewall is an essential security component of your system, and it is important to ensure that it is configured correctly to protect your system from malicious attacks. However, if you experience any issues with the Firewall, such as blocking legitimate network traffic or services, you can use the troubleshooting steps outlined above to resolve the issue.

Advanced Firewall Customization in CentOS7

When it comes to securing your server, the firewall plays a critical role in protecting your system from unauthorized access. CentOS7 comes with its default firewall, firewalld, which provides basic security against external threats. However, you may want to customize the firewall settings beyond the defaults, especially if you are running services that require specific ports to be open.

To customize the firewall in CentOS7, you can use the firewall-cmd command-line tool or the firewalld graphical interface, firewall-config. In this article, we will focus on using the firewall-cmd command-line tool to achieve advanced firewall customization in CentOS7.

1. Check Firewall Status

Before you start modifying the firewall settings, you need to check the status of the firewall to ensure that it is running. You can use the following command to check the firewall status:

sudo systemctl status firewalld

The output should show that the firewall is active and running:

firewalld.service - firewalld - dynamic firewall daemon
	  Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
	  Active: active (running) since Thu 2021-08-26 13:31:45 UTC; 23min ago
	  Main PID: 15242 (firewalld)
	  Tasks: 2 (limit: 10213)
	  Memory: 23.8M
	  CGroup: /system.slice/firewalld.service
			  └─15242 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid

2. Allow/Deny Access to a Service or Port

You can allow or deny access to a particular service or port in the firewall using the firewall-cmd command. For example, to allow SSH access, you can run the following command:

sudo firewall-cmd --add-service=ssh --permanent

The --permanent flag makes the rule permanent, meaning that it will be saved even after a system restart.

To deny access to the same SSH service, use the following command:

sudo firewall-cmd --remove-service=ssh --permanent

Note that you must reload the firewall configuration for changes to take effect using:

sudo firewall-cmd --reload

3. Allow/Deny Access to IP Address/Ranges

You can also allow or deny access to a particular IP address or range using the firewall-cmd command. For example, to allow access to IP address 192.168.0.10, use:

sudo firewall-cmd --add-source=192.168.0.10 --permanent

To deny access to the same IP address, use:

sudo firewall-cmd --remove-source=192.168.0.10 --permanent

Again, reload the firewall configuration for the changes to take effect:

sudo firewall-cmd --reload

4. Custom Zone Creation and Configuration

By default, CentOS7 firewall comes with three predefined zones: public, internal, and dmz. In addition to these zones, you can create custom zones using the --new-zone option and then configure the zone.

To create a new zone, use:

sudo firewall-cmd --new-zone=myzone --permanent

This creates a new zone called myzone. You can now configure the zone by adding rules using the --zone option. For example, to allow SSH access in the new zone, run the following command:

sudo firewall-cmd --zone=myzone --add-service=ssh --permanent

You can also add interfaces and source ranges to the new zone with:

sudo firewall-cmd --zone=myzone --add-interface=eth0 --permanent
sudo firewall-cmd --zone=myzone --add-source=192.168.1.0/24 --permanent

Reload the firewall configuration to activate the changes:

sudo firewall-cmd --reload

You can also associate a custom zone with a network interface using the --zone= and --change-interface= options as shown below:

sudo firewall-cmd --zone=myzone --change-interface=eth0 --permanent

To delete a custom zone, use:

sudo firewall-cmd --delete-zone=myzone --permanent

This command removes the zone called myzone.

Conclusion

Customizing firewall settings is crucial in securing your server from unauthorized access. CentOS7 provides a flexible way of configuring the firewall using the firewall-cmd command-line tool and the firewalld graphical interface. With the firewall-cmd tool, you can allow or deny access to a particular service, port, IP address, or range, as well as creating and configuring custom zones. Remember to reload the firewall configuration after making changes to activate them.

Best Practices for Securing Your CentOS7 Firewall Configuration

Securing your CentOS7 firewall configuration is crucial to ensuring the safety of your system. Firewalls act as a barrier between your device and the internet, and their job is to keep out malicious traffic while allowing legitimate traffic through. There are various best practices that one should follow to secure their CentOS7 firewall configuration. These practices include:

1. Limit Access to Your Server

One of the best things you can do to secure your CentOS7 firewall configuration is to limit access to your server. To do this, you should only allow traffic to specific ports to prevent intruders from exploiting open ports. You can set rules to only allow traffic coming from specific IP addresses or ranges, and block the rest. Additionally, you can use Virtual Private Networks (VPNs) to restrict access and add another layer of security to your network.

2. Use Secure Protocols

Another best practice for securing your CentOS7 firewall configuration is to use secure protocols. Secure protocols like HTTPS, SSL, and TLS encrypt traffic and keep it secure. They prevent attackers from intercepting and reading sensitive information such as passwords, email addresses, and other personal information.

3. Regularly Update Your Firewall

Regularly updating your firewall is essential to keeping your CentOS7 firewall configuration secure. Firewall updates often contain security patches that address vulnerabilities in the previous version. Ensure to update your firewall regularly to prevent attackers from exploiting any weakness in your firewall configuration.

4. Enable Logging

Enabling logging is an excellent way to detect any malicious activity on your network as it happens. The logs will record all the traffic that passed through your firewall, allowing you to see who or what is accessing your network. Regularly checking your firewall logs is a great way to pinpoint any attempted attacks and take remedial action accordingly.

5. Harden Your Firewall Configuration

Hardening your firewall configuration is the process of tightening the security of your firewall. This can be done in several ways, including changing default passwords, disabling unnecessary services, and removing unused accounts. You can also disable ICMP echo requests and set your firewall rules on a default “deny all” basis. Disabling any unnecessary or unwanted ports and services is another way to help harden your firewall configuration in CentOS7.

Another way to harden your firewall configuration is by using firewalld as your firewall software. Firewalld is a dynamic firewall management tool that provides a simple interface for managing your firewall rules. With firewalld, you can add/remove services, ports, and sources, and specify interface zones for your firewall. Using firewalld can make it easier to manage your firewall rules and allow you to make quick changes to your firewall configuration.

In conclusion, securing your CentOS7 firewall configuration is crucial to keeping your network and data safe from potential cyber attacks. Following these best practices can help you create a more secure firewall configuration that protects your server from a wide range of online threats.