Now firewalld is really flexible.
We can go through and take a look at what's included within the HTTP service.
We're probably going to find that it's just got the
single port, port 80, but we might want other ports
involved with this, such as port 443.
Now there are different ways that we can manage this.
We can just add a port rather than a service, although there is a
separate service definition for HTTPS. One of the nice things,
whether I'm doing it for a port or whether I'm doing it for a
service, is I can use the option ‑‑timeout.
This is really useful, especially if you think that you might get
locked out by the rule that you're implementing.
If I put a short timeout, maybe 5 seconds is way too short, but if I put a
timeout let's say of 60 seconds, then it will be dropped, the rule will be
dropped after 60 seconds, which then does mean that if I lose access, within
a minute I'm going to gain access.
So it's a great way of having a very temporary access to a rule.
If I wanted to modify an existing service,
I could choose to copy that service file through to the custom
directory that we're allowed in etc/firewalld/services.
So if I make a copy of the HTTP XML, we can then go
through and edit the recently copied file,
adding in any additional ports that we want. Here of course, we're adding then
our port 443 in, so this is going to add to the existing port that we have,
port 80. We need to reload our configurations, so firewall‑cmd ‑‑reload, so we
reread then our HTTP configuration.
The new settings will have effect anywhere that the HTTP service is
enabled, and we can check what is now enabled in our service by looking
at the info on our service again, and we're going to see that we've got
multiple ports associated with it. Now as always, the best way for us to
learn is by hands‑on practice.
So as always, I'm going to really encourage you to follow through this
investigation, where we can go through and look at adding in ports, timeouts to
those ports or services, as well as modifying existing XML files and getting
information on what's inside of our XML files.
So why don't you join me now on the command line as we dig
into our treasure trove of experience? Yes, because the more
hands‑on practice that you can get,
the more experience you have in managing our firewalls.
So if I go through now and just run my firewall‑cmd command,
we can go through and find out what's actually enabled in our
service. So I can go ‑‑info.
We can always use tab completion here so we can see all of the commands that
start with info, where we can then get info on our service and then our HTTP
service. When we look at this, we can see it's only the one port that is
enabled, and a port is both the number and the protocol, so port 80 on TCP. If
we wanted, let's say, port 443 also to be enabled, then we could do so. There
is a service for HTTPS, but we could also just go through and add it in. I'm
just going to add it into my default zone for the moment, but if I go through
and run a firewall‑cmd ‑‑add, but this time we'll look at adding in a port, and
we can then go through and say we want port 443, so it's the number first, and
then the protocol TCP. But if we only want to test it,
especially as I said in the slides,
is there's a chance of you locking yourself out, we can specify a timeout.
So if I go through and specify a timeout and maybe if we put a longer
timeout then let's say 5 seconds, but if we put let's say 20 seconds, then
that is in place now, but won't be longer than 20 seconds. So I can go
through then and do a list‑all, and we can see now that we have a port 443
that's been enabled. But that's not going to stay, we've only made it to the
runtime configuration, we haven't persisted it, but we're also timing it out
after 20 seconds.
If we go back now and run our ‑‑list‑all, we can see the
20 seconds must have expired because we no longer list
that port. So another really,
really useful feature. Now I could add both the HTTP service and the
HTTPS service to any of my zones that needed it; however,
I might think it's more convenient to go through and edit one
of my service configurations. If I go through and copy the
configuration file that I'm using,
so that's going to be the default in usr/lib/firewalld, and
looking inside of services, and then I could use an http. If
I copy across to the xml file,
this defines my service, and I can copy it across to etc and
firewalld, into the services directory there,
we can keep it with the same name.
If I go through then and edit this, so I can go through vim, Escape and dot
brings up the last directory path, so my last argument, and then I could
easily go through and add in http. As we look at it then, we can see the
definition, and I'm just going to duplicate the port line. So I'm just going
to go y, y, and p, and then I just need to change port 80 on the second
line, or the first line, it doesn't really matter, but if I go through then
and change this to 443. Now I'm using vim, but of course the editor doesn't
matter, but you can use whichever editor you are comfortable with. I'm going
to then save my changes. Having saved my changes though,
we still won't be able to see any of those differences, we've got to pick up
that we've made this customization, so we can run our firewall‑cmd ‑‑reload,
so we reread all of our XML files. And now if I go through and take a look
at my info, so I can use a Ctrl+R and then search for ‑‑info, we can see
then it was getting info on the service HTTP. So I'm just going to hit
Enter, and we can see now that the HTTP service includes both port 443 and
port 80.
So anywhere where this is enabled, such as my internal zone,
we're going to be allowing inbound traffic to both port 80 and port 443.
So hopefully this gives you some great ideas of how firewalld
can become your firewall management system.
We're going to go back to our slides now so we can summarize just a little of what we've looked at.