CentOS 7.3 Firewall Setup
=========================



Install firewalld
~~~~~~~~~~~~~~~~~

GMN will require ports 80 and 443 to be opened. So after logging in to your server as a user with sudoer privileges, the first step is to get the firewall
 setup. We begin by ensuring that the firewall management package is installed on your server and started.


**Update yum.**::

    $ sudo yum -y update


**Install firewalld**::

	$ sudo yum install firewalld
	$ sudo systemctl unmask firewalld
	$ sudo systemctl start firewalld




Configure Firewall with Network Interfaces
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Next we want to achieve the binding of network interfaces to firewalld zones. This example uses the default public zone. First we need to identify your network interfaces.::

	$ ifconfig -a


The interfaces described in response will look something like this::

	eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 138.197.100.216  netmask 255.255.240.0  broadcast 138.197.111.255
        inet6 fe80::3c64:d3ff:fe95:187b  prefixlen 64  scopeid 0x20<link>
        ether 3e:64:d3:95:18:7b  txqueuelen 1000  (Ethernet)
        RX packets 467254  bytes 268127560 (255.7 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 335825  bytes 72203530 (68.8 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

    eth1: flags=4098<BROADCAST,MULTICAST>  mtu 1500
        ether f2:ac:61:7b:73:10  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

    lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1  (Local Loopback)
        RX packets 81687  bytes 26998580 (25.7 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 81687  bytes 26998580 (25.7 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0



There should be one or more network interfaces available, such as "eth0" or
"eth1". Ignore an entry such as *“LOOPBACK,RUNNING”*.The firewall management system we are using binds these network interfaces to something called a “zone”. There is the potential for multiple zones which can have different configuration options, but we aren’t going to worry about that here. We just need t he simplest configuration using the default zone. The
*public zone* will be the default. So at this point we will check whether or not the network interfaces we identified with “ifconfig -a” are bound to the public zone. We can check that with this command::

	$ sudo firewall-cmd --zone=public --list-all


Which return::

  public (active)
    target: default
    icmp-block-inversion: no
    interfaces:
    sources:
    services: dhcpv6-client http https ssh
    ports: 443/tcp
    protocols:
    masquerade: no
    forward-ports:
    sourceports:
    icmp-blocks:
    rich rules:


If the space next to the “interfaces” line contains the network interfaces, such as eth0 and eth1 in this example, then they are already bound to the public zone. However, if that line is empty, you will need to bind your network interfaces to the firewall zone as follows.



**Bind Network Interfaces to Zone**::

  $ sudo firewall-cmd --permanent --zone=public --change-interface=eth0
  $ sudo firewall-cmd --permanent --zone=public --change-interface=eth1
  $ sudo firewall-cmd --reload


Substituting the names of your interfaces in ``--change-interface=``. Now, when you enter the command::

  $ sudo firewall-cmd --zone=public --list-all

The network interfaces should be listed::

  public (active)
    target: default
    icmp-block-inversion: no
    interfaces: eth0 eth1
    sources:
    services: dhcpv6-client ssh
    ports:
    protocols:
    masquerade: no
    forward-ports:
    sourceports:
    icmp-blocks:
    rich rules:


Another way to confirm that everything is as it should be is to use this command::

  $ firewall-cmd --get-active-zones


Which will return output similar to::

  public
    interfaces: eth1 eth0

Open HTTP & HTTPS Ports
~~~~~~~~~~~~~~~~~~~~~~~


Now we can specify rules for handling specific ports and services, using the below commands.::

  $ sudo firewall-cmd --permanent --add-service=http
  $ sudo firewall-cmd --permanent --add-service=https
  $ sudo firewall-cmd --permanent --add-port=80/tcp
  $ sudo firewall-cmd --permanent --add-port=443/tcp
  $ sudo firewall-cmd --reload

  $ sudo systemctl enable firewalld