All right.
If you only care about what you need to know for RHCSA,
you can safely skip this lesson.
But I would like to show you a little bit
about the advanced firewall D use as well,
because it never hurts to know what is
going on in a more advanced way.
Firewall D is offering rich rules and direct rules.
A direct rule allows admins to insert hand-coded rules.
And direct rules are processed before anything in the zones.
However, even if they are pretty advanced,
it's not recommended to use them.
Rich rules are a nice addition.
They use an expressive language to create
custom rules that cannot be created with basic syntax.
Because if you are an experienced firewall
administrator, you might be used to more functionality.
You should think of syntax that allows
you to do logging for packets that are blocked,
or port forwarding, or IP masquerading, or rate limiting.
If you want to learn more about them,
use the man page, firewall D rich language.
Let me show you quickly what this man page looks like.
So using man firewall D dot rich language.
And then this is what we get.
A lot of explanation.
If you scroll down a little bit beyond all the listing
of the components, you see the examples.
And these examples are the examples
that you can use behind the command firewall
D minus minus add rich rule.
And the examples look like this.
Like rule service name is FTP.
Log limit value is one per minute.
And all that accepts.
What does that mean?
That means that we are going to access FTP traffic,
and we are going to log FTP traffic with a maximum of one
package per minute.
And here, this is an interesting one as well.
I like this a lot.
You can allow specific source addresses to get in.
I'd say remember this man page.
It's really a very useful man page with examples
that you are probably going to use.
Now, I have a little bit more upcoming.
On this slide, I listed a couple of commands
that I'm going to work out for you and discuss and explain.
So let's have a look.
First command is firewall CMD minus minus permanent.
Minus minus zone is public.
Minus minus add rich rule.
The things that I've said about permanent and non-permanent
apply to rich rules as well.
So this permanent is important to add it
to the persistent configuration.
And then I'm going to make that rule family is IPv4 source
address is 192.168.29.220 reject.
And that's giving me a success.
So this is making sure that no matter what,
packets that are coming from this specific IP address
are never going to be allowed.
Of course, you do need firewall CMD minus minus reload
to activate it as well.
Next example, firewall CMD minus minus add rich rule
is rule service name is HTTP log limit value
is 3 per minute except.
So that is adding some logging for the HTTP service.
Next, we have firewall CMD minus minus add rich rule
is rule protocol value is IGMP except.
Now, what is protocol?
Protocol, you need to know your IPv4 stack.
But let's have a look at ETC protocols.
There we can see all the different protocols
that are available.
And protocols are IP and IPv4, but also ICMP and IGMP.
IGMP is the Internet Group Message Protocol.
It's used by multicast.
ICMP is used by ping, for instance.
And these protocols can be managed at the protocol level
as well.
So if you don't want any ICMP at all,
well, this is what you can do.
Now, let me show you one more that is a little bit more
expressive, which is firewall CMD
minus minus add rich rule is rule family is IPv4.
So this time, we are going to filter out IPv4 only.
Now, you need to pay attention because IPv4 is no longer
the default protocol.
So you might see that the node that is IPv4 address
can still come in on IPv6.
So you might have to do the same on an IPv6 level.
Source address is 10.0.0.0 slash 24.
Port is 7900 up to 7905.
And protocol is TCP.
And that is what we are going to accept.
Now, what I like about this rule is
that this rule is very specific about what you want to do.
It allows a range of ports.
But only if it comes in through IPv4 and through TCP.
Now, one final one would be firewall CMD minus
minus zone is public.
I want to add that once more.
If you don't add it, it gets to the default zone.
But if ever you want to go in a multi-zone configuration,
might be interesting to know how to do this.
Minus minus at reach rule is rule surface name is SSH.
And log prefix is SSH.
And level is notice.
So I want to log when the level is noticed.
That will basically log everything.
And then limit value is 2 per minute.
And we are going to accept that.
And then when you're happy with this,
use a firewall CMD minus minus list all.
And you can see all that is going on in these reach rules.
Again, this is fun stuff.
And feel free to practice with it.
But don't focus on it for RHCSA because you won't
get any questions about it.