Okay, in this demonstration,
we're going to walk through
how to configure the firewall daemon.
Now the firewall's default state
is to deny any network access.
So that means anything that we're going to allow,
we have to explicitly allow.
In most networks,
especially enterprise level networks,
we're going to create something called a screen subnet
where you allow things that are very susceptible to attack,
and that's what area you're going to put in.
So a web facing server, DNS servers, things of the nature,
where you need external users or services
to use that system or network,
you're going to put in a separate area
to where your internal network is blocked
by another set of controls,
in which usually is the firewall.
So we're going to go through and figure how to allow HTTP,
HTTPS, and also a custom port that we will sometimes use.
So, first thing we need to do,
we're going to check the status of the firewall.
So we're going to use our handy-dandy system control.
Okay, now we see it's up and running for us,
so that's good.
Next we're going to use nmap,
which is a network mapping tool.
It's used a lot with penetration testing,
and some attackers use it as well,
but we're just going to see if we can get the status
and version of whatever's running on port 80,
which should be HTTP on our partner's network.
Can do SUDO.
Now the location of this is in the local bin, nmap,
get the service version information,
do server zero two.
As far as the other port, it's going to be 80.
Okay, now we see that the state is showed as filtered.
There's typically going to be three states in this mode:
open, filtered, and closed.
Now open means that the service is up and running,
and they're listening for connections.
Filtered means it's being blocked actively
by either a firewall or some other network protocol
that's restricting access
to that particular port or service.
And closed means that that connection
is not actively listening for that service or port.
Next we're going to get information about the zones.
So let's do a new firewall.
Command.
We want to get the zones,
let's get a list of them.
Okay, so we have the block DMZ drop,
external home, internal public, and trusted and work zones.
Now, if this was a physical device,
these would literally be different ports on the firewall.
So they would be separated physically.
Everything has to go through the firewall,
and it will decide if it's able to go to the next port.
Now this one is a logical one,
which works in a similar way.
Now next we're going to focus on the DMZ.
Okay, so what we're going to do.
Firewall command, zone.
Okay, now we see what we have currently allowed
on this particular firewall.
So we're currently allowing HTTP,
HTTPS, SSH, port 7743 TCP.
And if you look at this target, the default,
what that means is anything that's not listed as a service
or a port that's allowed will be blocked
'cause that's the default setting of this.
Now, usually for troubleshooting,
you might be able to change the default to accept,
which means that everything that comes through
will get accepted.
And you only want to do that to kind of troubleshoot
and see if your firewall's the issue
for connectivity problems.
Now, we also notice what interface that it's supplied to,
'cause I have multiple on this one.
So for my enps03,
that interface is going to be designated as our DMZ area.
Okay, next what we're going to do
is want to get the active zones
that are currently being used.
All right, so we see that the DMZ
and the public interfaces,
these are the ones that are currently being engaged with.
Now, if I wanted to add the enp0s3 to the DMZ interface,
I can do that.
And we're going to simply use sudo firewall,
specify the zone equal to DMZ.
Change the interface.
Do permanent because all these changes are runtime changes,
meaning that they will not persist if a reboot.
So the permanent allows it to be stored,
and whenever we reboot the system,
these settings will be saved.
Okay, we see that was success.
So if we can go to get active zones again,
we'll see that enp0s8 is now part of the DMZ zone.
So next thing we're going to do,
we're going to add different services
and a custom port to the zone.
Now, as you saw earlier that they were already there,
so I'm going through and remove those and then add 'em,
so you can see how to remove and ad services as well.
So we're going to use this firewall command right here,
just to remove the services.
We're going to focus on the additions,
but I'm going to go through
and remove these services really quick,
so we can see 'em at it.
Okay.
All right, now let's take a view
at current services that's running.
Okay, so we see we don't have any services that are allowed
or any ports except for SSH.
Okay, let's go ahead and make some changes.
I'm going to do SUDO firewall command,
specify the zone.
I'm going to add a service.
It's going to be HTTP,
and we want this to be permanent,
meaning that we want it to persist during a reload.
Okay, that was successful.
Now we're going to do HTTPS.
Okay.
And then we're going to do the custom port
that I specified earlier,
and we're just going to have to make sure
we have the port number,
and then the protocol that we're going to use, TCP or UDP.
Okay.
Now if we look here,
we'll see that it's not going to show initially.
So what we have to do is we're going to reload this firewall.
Okay, now we should see it.
Okay, so now we have our services that are allowed HTTP,
HTTPS, and also the custom port that we're using,
7743 on a TCP.
Next I want to make changes to my partner's firewall.
So we see earlier that it show filter,
but next is just show open.
So I'll be right back.
Okay, I'm back.
Now let's try to do our nmap scan again,
and we're going to look for the service
and it should be running now.
It should be showing open.
Okay, now we see that the state is now open for HTTP,
and we actually got some version information
about it as well.
So again, when we're using a lot
of network information gathering tools like nmap,
it'll give us all this information.
And that's also something to be aware of
when you're trying to secure your system,
because you know what type of information
is vulnerable to these type of information grabs
with specific ports being open.
Okay, we're going to try it one more time.
We're going to use port 21,
which is for file transfer protocol
and it should be blocked.
Okay, we see that it's filtered,
meaning that it's blocked.
So remember also a filter doesn't mean
that the system isn't necessarily listening for it.
You don't know if it's open or closed,
but we do know that something is blocking it.
And since we have the firewall set up
on our partner's network,
we know that's going to default to block anything
that's not explicitly established to go through,
and TCP port 21 was not.
Okay, just one more time.
We're going to do SSH,
and we're going to use our server zero one SSH.
I'm going to connect to server zero two,
just to make sure that's able to go through, okay?
So we're still able to go through to server zero two,
'cause we do allow SSH.
So again, the firewall by default blocks everything,
and it only allows what we explicitly tell it to.
Thank you for sticking with this lesson,
and I'll see you in the next walkthrough.