Firewall and Packet Filtering Flashcards

A system administrator needs to allow HTTP traffic to a web server. Which of the following `firewall-cmd` commands correctly opens the standard HTTP port in the `public` zone and ensures the rule persists after a system reboot?

Answer: firewall-cmd --permanent --zone=public --add-service=http

The command `firewall-cmd --permanent --zone=public --add-service=http` correctly adds the 'http' service (which corresponds to TCP port 80) to the permanent configuration of the 'public' zone. The `--permanent` flag is crucial for ensuring the rule is saved and reapplied after a reboot or firewall reload. The other options are incorrect because they either only affect the runtime configuration, use incorrect syntax, or misuse the flags.

What is the primary function of the `firewall-cmd --reload` command?

Answer: It applies the permanent configuration to the runtime environment without dropping existing connections.

The `firewall-cmd --reload` command reads the permanent configuration files and applies them as the new runtime configuration. A key feature of `--reload` is that it does this without interrupting or dropping existing connections, making it the preferred way to apply saved changes on a live system. Restarting the service drops connections, and `--runtime-to-permanent` saves the current state.

An administrator wants to enhance security by allowing SSH access (port 22) ONLY from the internal administrative subnet `192.168.50.0/24`. Which of the following `firewall-cmd` commands correctly implements this using a rich rule?

Answer: firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.50.0/24" service name="ssh" accept'

The correct syntax for adding a rich rule involves the `--add-rich-rule` option with the rule enclosed in single quotes. The rule must specify the address family (`ipv4`), the `source address` with its subnet mask, the `service name`, and the action (`accept`). The other options use incorrect syntax, such as `--add-rule`, or an incomplete/improperly formatted rich rule string.

In the context of `firewalld`, what is the primary purpose of a 'zone'?

Answer: To group rules into predefined sets based on the level of trust for a network connection or interface.

Zones are the core concept in firewalld for managing rules. They represent a level of trust for a network. A network interface (like `eth0`) or a source IP address range is assigned to a zone, and that zone's rules (e.g., what services or ports are open) are applied to the traffic. This allows for easily switching between different security policies, for instance, a more restrictive 'public' zone and a more permissive 'internal' zone.

A sysadmin adds a temporary rule to allow traffic on port 5000/tcp using `firewall-cmd --add-port=5000/tcp`. They do not use the `--permanent` flag. What happens to this rule if the `firewalld` service is restarted?

Answer: The rule is removed from the runtime configuration and is no longer active.

Changes made to the firewalld configuration without the `--permanent` flag only apply to the current runtime environment. When the `firewalld` service is restarted or reloaded, it discards the current runtime configuration and loads the saved rules from the permanent configuration. Since the rule for port 5000/tcp was never saved to the permanent configuration, it is lost.

Which of the following best describes the fundamental operation of a packet filtering firewall?

Answer: It examines the header information of a packet, such as source/destination IP and port, against a set of rules.

A packet filtering firewall operates at the network layer. Its primary function is to inspect the headers of each packet (containing information like source IP, destination IP, source port, destination port, and protocol) and compare this information against a pre-defined ruleset to decide whether to permit or deny the packet. It does not typically inspect the payload (content) of the packet.