Day 3 - Firewalls: iptables and firewalld

📌 Key Points

• The engine of the Linux firewall is the kernel's netfilter. The low-level tool that controls it directly is iptables, and the high-level manager on top of it is firewalld.
• The iptables structure is table → chain → rule. The chains of the filter table are INPUT (incoming), OUTPUT (outgoing), and FORWARD (passing through).
• Rules are matched in order from top to bottom, and on a match the packet is handled immediately. If nothing matches, the default policy (-P) applies.
• DROP discards silently (no response), while REJECT sends back a rejection response. -A appends to the end and -I inserts at the front — the order changes the result.
• firewalld is managed with zones (bundles of trust levels). The biggest trap of firewall-cmd is the distinction between runtime vs --permanent (+ --reload).

netfilter and iptables: The Structure of Tables and Chains

• iptables controls the kernel's netfilter to inspect and process packets.
• The structure has three layers: table → chain → rule.
• The most used table is filter (decides whether to allow or block packets). If you use iptables without options, this table is the default target.
• Other tables: nat for NAT processing, and mangle for packet alteration.
• The filter table has three built-in chains, and each chain applies according to the direction of the packet flow.

The chains split by direction. Blocking or allowing connections coming from outside into our server (web, SSH requests, etc.) is the job of the INPUT chain. On the exam, "block external SSH access" → an INPUT chain rule. "Control traffic going out from this host to elsewhere" → the OUTPUT chain. "Traffic passing through a gateway" → the FORWARD chain.

• The rules in each chain are applied in order from top to bottom.
• When a packet matches a rule, that rule's target (the handling action) is executed.
• If it matches no rule, the default policy applies.
• This "match in order, handle immediately on match" is the most important principle for understanding iptables.

Default Policy and Targets: ACCEPT, DROP, REJECT

• Each chain has a default policy. It is the last-resort rule that decides the fate of packets that match no rule.

DROP vs REJECT: both block, but the response differs. DROP discards the packet quietly, so the other side has to wait until a timeout (which has the effect of hindering port scans). REJECT immediately sends an ICMP response saying "refused", so the other side knows right away. For security, some setups use DROP for ports exposed externally and REJECT on the internal network for user convenience.

# Set the chain default policy to DROP (-P = policy)
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

⚠️ The remote work trap: if you run iptables -P INPUT DROP first while connected over remote SSH, you cut yourself off before adding the SSH allow rule. You must add the SSH allow rule (-A INPUT -p tcp --dport 22 -j ACCEPT) first, and only then change the default policy to DROP. It is a trap both in practice and on the exam.

Writing Rules: -A, -j, and Matching Conditions

• The key to the practical exam is distinguishing precisely the core options that add and delete rules.

• You also need to memorize the options that specify matching conditions.

• The following is a typical rule set.

# Allow TCP connections to port 22 (SSH)
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
 
# Allow port 80 (HTTP)
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
 
# Block all packets coming from a specific IP (192.168.1.50)
iptables -A INPUT -s 192.168.1.50 -j DROP
 
# Allow loopback (self) traffic
iptables -A INPUT -i lo -j ACCEPT
 
# Allow response packets of already established sessions (state tracking)
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

The order difference between -A and -I: since a chain matches from top to bottom, the position of a rule changes the result. -A attaches to the very end, and -I inserts at the very front. If an "everything DROP" rule is already at the top, adding an ACCEPT after it with -A is pointless because packets are already caught by the DROP and never reach it. In that case, you must insert the ACCEPT in front with -I.

Checking and Saving Rules

• You need to know how to check the rules you wrote and how to save them so they persist after a reboot.

# Show the rule list (-n: show IPs numerically without name resolution, -v: verbose, --line-numbers: line numbers)
iptables -L -n -v --line-numbers
 
# Show only a specific chain
iptables -L INPUT -n
 
# Reset all rules
iptables -F
 
# Save the rules (RHEL family) — persists after reboot
iptables-save > /etc/sysconfig/iptables
service iptables save

⚠️ Beware of volatility: iptables rules exist only in memory. If you reboot without saving, they all disappear. On the RHEL family, you must persist them with service iptables save or iptables-save. It is common to panic about "my rules vanished" without knowing this.

firewalld: A Zone-Based Dynamic Firewall

• Drawbacks of iptables: it handles rules one by one, so it is not intuitive, and every time you change rules it re-applies everything, which can cut existing connections.
• firewalld, the default since RHEL 7, is a high-level management tool that improves on this.
• The core concept of firewalld is the zone — a bundle of rules that pre-defines "the trust level of a network connection".
• When you assign an interface or a source to a particular zone, that zone's rules apply.

The idea behind zones: if iptables deals with "rules line by line", firewalld applies situation-specific rule bundles, like "this network card is on a public network (public), and that card is on an internal network (internal)". The key is the flexibility, such as switching a laptop to the public zone when it connects to airport Wi-Fi and to the home zone when you get home.

firewall-cmd: The Command for Managing firewalld

• firewalld is controlled with the firewall-cmd command.
• The most important concept is the distinction between runtime and permanent.
• By default, changes made with firewall-cmd are applied to the runtime only and disappear after a reboot.
• To apply permanently, add --permanent. However, it is not reflected immediately, so you need to reload with --reload.

# Check the currently active zones and settings
firewall-cmd --get-active-zones
firewall-cmd --list-all
 
# Check/change the default zone
firewall-cmd --get-default-zone
firewall-cmd --set-default-zone=public
 
# Allow a service (runtime — disappears on reboot)
firewall-cmd --add-service=http
 
# Allow a service permanently (persists after reboot)
firewall-cmd --add-service=http --permanent
 
# Allow a port directly (permanent)
firewall-cmd --add-port=8080/tcp --permanent
 
# Apply the permanent settings immediately
firewall-cmd --reload

The --permanent trap: if you only run firewall-cmd --add-service=http --permanent, it is written to the configuration file but not applied right now. You must follow it with firewall-cmd --reload for it to take effect in the current session too. Conversely, if you add without --permanent, it works now but disappears on reboot. To get both, either run it twice, once for runtime and once with permanent, or use permanent and then reload.

iptables vs firewalld Summary

The two must not be used together: enabling the firewalld and iptables services at the same time causes a conflict. On RHEL 7+, firewalld is the default, and to use iptables directly you must turn off firewalld (systemctl disable firewalld) and enable the iptables service. Since both ultimately control the kernel's netfilter, only one of them should be used as the manager.

Try it yourself: on a test VM, run firewall-cmd --add-service=http (runtime only), check with firewall-cmd --list-services, and confirm it disappears after a reboot. Then do it again with --permanent and also go through --reload to confirm that it persists, and the difference between runtime and permanent will sink in. On the iptables side, look at the line numbers with iptables -L -n --line-numbers and then experiment with the positional difference between -I and -A.

Tomorrow we widen the scope of security with TCP Wrapper, SELinux, and log management.

📖 Glossary

• netfilter : The packet filtering framework built into the Linux kernel. Both iptables and firewalld control it.
• iptables : The traditional command that controls netfilter directly rule by rule. It works in three layers: table → chain → rule.
• chain : A bundle of rules per packet flow direction. INPUT (incoming), OUTPUT (outgoing), FORWARD (passing through).
• default policy : The last-resort rule that decides what to do with packets that match no rule. Specified with -P.
• DROP : A blocking method that silently discards the packet so the other side waits until a timeout.
• REJECT : A blocking method that immediately sends a rejection response so the other side knows right away it was blocked.
• -A / -I : Append a rule to the very end of the chain / Insert it at the very front. The order changes the result.
• firewalld : The default tool on RHEL 7+ that manages the firewall per zone. It does not cut existing connections when rules change.
• zone : A bundle of rules per network trust level. Examples include public (default), home, trusted, and drop.
• --permanent / --reload : The option that keeps a setting after reboot / the command that immediately applies that permanent setting to the current session.