Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
|
linux_wiki:use_firewalld_and_associated_mechanisms_such_as_rich_rules_zones_and_custom_rules_to_implement_packet_filtering_and_configure_network_address_translation_nat [2018/03/30 00:01] billdozor [Configure Interfaces] |
linux_wiki:use_firewalld_and_associated_mechanisms_such_as_rich_rules_zones_and_custom_rules_to_implement_packet_filtering_and_configure_network_address_translation_nat [2018/05/03 23:00] billdozor [Rich Rule Examples] |
||
|---|---|---|---|
| Line 49: | Line 49: | ||
| nmcli con up enp0s8 | nmcli con up enp0s8 | ||
| </ | </ | ||
| - | * Route for server1 to reach server2< | + | * Route for server1 to reach server2< |
| + | any net 172.16.0.0/ | ||
| + | |||
| + | #save, then restart the network service | ||
| + | systemctl restart network</ | ||
| * server2 (192.168.1.151) -> Will be the external system | * server2 (192.168.1.151) -> Will be the external system | ||
| Line 60: | Line 64: | ||
| # Bring interface up | # Bring interface up | ||
| nmcli con up enp0s8</ | nmcli con up enp0s8</ | ||
| - | * Route for server2 to reach server1< | + | * Route for server2 to reach server1< |
| + | any net 10.0.0.0/ | ||
| + | |||
| + | #save, then restart the network service | ||
| + | systemctl restart network</ | ||
| * ipa (192.168.1.152) -> Will be the " | * ipa (192.168.1.152) -> Will be the " | ||
| Line 172: | Line 180: | ||
| \\ | \\ | ||
| **Note:** As of RHEL 7.4, you **do not** need to execute the removal command/ | **Note:** As of RHEL 7.4, you **do not** need to execute the removal command/ | ||
| - | * Removal example< | + | * Removal example< |
| * Network script update example< | * Network script update example< | ||
| Line 251: | Line 259: | ||
| * log level=notice -> Change log level of http access | * log level=notice -> Change log level of http access | ||
| * prefix -> Add this text to the front of the log | * prefix -> Add this text to the front of the log | ||
| - | * limit value -> Limit the amount of connections | + | * limit value -> Limit the amount of logged connection attempts |
| * accept -> Accept the connection | * accept -> Accept the connection | ||
| Line 275: | Line 283: | ||
| Configure masquerading for hosts in a zone | Configure masquerading for hosts in a zone | ||
| <code bash> | <code bash> | ||
| - | firewall-cmd --permanent --zone=public | + | firewall-cmd --permanent --zone=external |
| firewall-cmd --reload | firewall-cmd --reload | ||
| </ | </ | ||
| \\ | \\ | ||
| - | Masquerading for specific source addresses | + | Additional Example: |
| <code bash> | <code bash> | ||
| - | firewall-cmd --permanent --zone=public | + | firewall-cmd --permanent --zone=external |
| </ | </ | ||
| ===== Port Forwarding ===== | ===== Port Forwarding ===== | ||
| - | Forward a connection | + | Port forwarding allows external systems to access internal systems. |
| + | |||
| + | They come in from external on one port, and get forwarded to an internal system on a different port. | ||
| + | |||
| + | \\ | ||
| + | Forward a connection | ||
| <code bash> | <code bash> | ||
| - | firewall-cmd --permanent --zone=public | + | firewall-cmd --permanent --zone=external |
| firewall-cmd --reload | firewall-cmd --reload | ||
| </ | </ | ||
| + | |||
| + | \\ | ||
| + | Test the connection from server2< | ||
| + | |||
| + | The authenticity of host ' | ||
| + | ECDSA key fingerprint is SHA256: | ||
| + | ECDSA key fingerprint is MD5: | ||
| + | Are you sure you want to continue connecting (yes/no)? yes | ||
| + | Warning: Permanently added ' | ||
| + | root@172.16.0.254' | ||
| + | [root@server1 ~]# </ | ||
| + | * server2 connects to port 2222 on the ipa/router VM. | ||
| + | * The firewall port forward rule forwards the connection to port 22 on server1 | ||
| ---- | ---- | ||