Editing Firewalls

The Internet is a dangerous place, by being out in the open, your server is exposed to major threats. Threats exploit vectors of entry, which could be exposed services that run or listen to certain ports.

Thus, the right thing to do is to build a firewall to block these ports from outside access, and allow others with reservations.

== FirewallD ==

Install and enable FirewallD at boot:

<pre>sudo yum install firewalld
sudo systemctl start firewalld
sudo systemctl enable firewalld</pre>
We will use the <code>public</code> zone as our foremost and only zone, since we are using a server with only one network interface, <code>eth0</code>, and we are firewalling against the whole internet.

The first step is to enable the SSH service, since you probably want to retain the ability to connect remotely.

<pre>sudo firewall-cmd --permanent --zone=public --add-service=ssh</pre>
If you want to enable the HTTP and HTTPS service, add these services as well.

<pre>sudo firewall-cmd --permanent --zone=public --add-service=http 
sudo firewall-cmd --permanent --zone=public --add-service=https</pre>
Finally, when you are sure that the <code>ssh</code> service is still enabled on the <code>public</code> zone, reload the rules and enable the zone. If it worked, you will still be able to connect via SSH, and can now access HTTP and HTTPS servers externally. All other ports/services will be blocked to the world (for now).

<pre>sudo firewall-cmd --reload
sudo firewall-cmd --zone=public --change-interface=eth0</pre>
You can now set up other services with the firewall in a similar way. Make sure to reload the rules right to commit your changes.

<pre>sudo firewall-cmd --reload</pre>
* [https://www.digitalocean.com/community/tutorials/how-to-set-up-a-firewall-using-firewalld-on-centos-7 DigitalOcean - Firewalld on CentOS]
* [https://fedoraproject.org/wiki/FirewallD Fedora Project Wiki - FirewallD]

== ufw ==

A CLI interface to iptables that is utterly uncomplicated. Great for Debian/Ubuntu home servers.

== iptables ==

There's good ol' iptables for advanced configuration, but I don't really deal with it, so look elsewhere.

[[Category:Home Servers]]