RHCSA Firewalld and Network Configuration Questions and Answers — Questions and Answers
Question 1: A system administrator adds a new firewalld rule to allow HTTP traffic using `firewall-cmd --zone=public --add-service=http`. After a system reboot, they discover that HTTP traffic is no longer allowed. What is the correct procedure to ensure the rule persists across reboots?
- Use the `firewall-cmd --runtime-to-permanent` command after adding the rule.
- Add the `--permanent` flag to the command and then run `firewall-cmd --reload`. (Correct answer)
- Run `systemctl restart firewalld` immediately after adding the rule.
- The rule should be added to `/etc/sysconfig/firewalld.conf` directly.
Correct answer: Add the `--permanent` flag to the command and then run `firewall-cmd --reload`.
Firewalld maintains separate runtime and permanent configurations. Rules added without the `--permanent` flag only apply to the current runtime and are lost on reboot or service reload. To make a rule persistent, it must be added to the permanent configuration using the `--permanent` flag. For the permanent rule to become active in the running configuration, the firewalld service must be reloaded using `firewall-cmd --reload`.
Question 2: A server has two network interfaces, `eno1` connected to an internal network and `eno2` connected to the public internet. The administrator wants to assign `eno1` to the 'internal' firewalld zone and `eno2` to the 'public' zone. Which of the following commands will correctly and persistently assign the interfaces to their respective zones?
- firewall-cmd --zone=internal --add-interface=eno1 && firewall-cmd --zone=public --add-interface=eno2
- firewall-cmd --permanent --change-interface=eno1 --zone=internal && firewall-cmd --permanent --change-interface=eno2 --zone=public
- firewall-cmd --permanent --zone=internal --change-interface=eno1 && firewall-cmd --permanent --zone=public --change-interface=eno2
- nmcli con modify eno1 connection.zone internal && nmcli con modify eno2 connection.zone public (Correct answer)
Correct answer: nmcli con modify eno1 connection.zone internal && nmcli con modify eno2 connection.zone public
While `firewall-cmd` can change an interface's zone for the current session (`--change-interface`), the persistent and recommended method for assigning an interface to a zone is by modifying the NetworkManager connection profile. The command `nmcli connection modify <connection_name> connection.zone <zone_name>` permanently associates the network connection with the specified firewalld zone.
Question 3: Which of the following `nmcli` commands correctly configures a static IPv4 address, gateway, and DNS server for a connection named 'eth0'?
- nmcli con mod eth0 set ipv4.address 192.168.1.100/24 gw4 192.168.1.1 dns 8.8.8.8
- nmcli device mod eth0 ipv4.addresses 192.168.1.100/24 ipv4.gateway 192.168.1.1 ipv4.dns 8.8.8.8 ipv4.method static
- nmcli con add con-name eth0 type ethernet ifname eth0 ip4 192.168.1.100/24 gw4 192.168.1.1
- nmcli con mod eth0 ipv4.addresses 192.168.1.100/24 ipv4.gateway 192.168.1.1 ipv4.dns 8.8.8.8 ipv4.method manual (Correct answer)
Correct answer: nmcli con mod eth0 ipv4.addresses 192.168.1.100/24 ipv4.gateway 192.168.1.1 ipv4.dns 8.8.8.8 ipv4.method manual
The correct command to modify an existing NetworkManager connection is `nmcli connection modify` (or `con mod`). The static IP address and subnet mask are set with `ipv4.addresses`, the gateway with `ipv4.gateway`, and the DNS server with `ipv4.dns`. Crucially, `ipv4.method` must be set to `manual` to disable DHCP and use the static configuration.
Question 4: What is the primary function of the 'default zone' in firewalld?
- It is the zone that contains the most restrictive set of rules.
- It is the only zone that is active after a fresh installation.
- It applies to any network traffic that does not explicitly match a rule in another active zone.
- It is the zone assigned to any network interface that is not explicitly assigned to a different zone. (Correct answer)
Correct answer: It is the zone assigned to any network interface that is not explicitly assigned to a different zone.
The default zone in firewalld is the zone that is used for any network interface or connection that has not been explicitly bound to a different zone. This acts as a catch-all to ensure that all network interfaces are covered by a defined firewall policy.
Question 5: A system administrator needs to allow access to a web server from a specific subnet (10.10.50.0/24) but deny it from all other sources. Which firewalld command will achieve this most effectively?
- firewall-cmd --permanent --zone=public --add-source=10.10.50.0/24 --add-service=http
- firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="10.10.50.0/24" service name="http" accept' (Correct answer)
- firewall-cmd --permanent --add-service=http && firewall-cmd --permanent --add-source=10.10.50.0/24
- firewall-cmd --permanent --zone=public --add-port=80/tcp --source=10.10.50.0/24
Correct answer: firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="10.10.50.0/24" service name="http" accept'
Rich rules provide the flexibility to create more specific and conditional firewall rules. This command creates a permanent rule that specifically accepts traffic for the 'http' service only when it originates from the '10.10.50.0/24' source address. The other options are either syntactically incorrect or do not create the required conditional link between the source and the service.
Question 6: After making several changes to the permanent firewalld configuration, a sysadmin wants to activate them. What is the key difference between running `firewall-cmd --reload` and `systemctl restart firewalld`?
- `--reload` only applies new rules, while `restart` applies new rules and removes old ones.
- `--reload` keeps existing stateful connections alive, while `restart` drops all active connections. (Correct answer)
- `--reload` applies both runtime and permanent rules, while `restart` only applies permanent rules.
- There is no functional difference; both commands achieve the same outcome.
Correct answer: `--reload` keeps existing stateful connections alive, while `restart` drops all active connections.
The `firewall-cmd --reload` command loads the permanent configuration into the running firewall without losing the state information of current network connections. In contrast, `systemctl restart firewalld` stops and then starts the entire daemon, which will drop all active connections as the stateful firewall information is lost. For applying new permanent rules without interrupting service, `--reload` is the preferred method.
RHCSA Firewalld and Network Configuration Questions and Answers
A system administrator adds a new firewalld rule to allow HTTP traffic using `firewall-cmd --zone=public --add-service=http`.
After a system reboot, they discover that HTTP traffic is no longer allowed.
What is the correct procedure to ensure the rule persists across reboots?