Setting Up and Configuring a Firewall on Your CentOS VPS

#### Prerequisites Before you begin, ensure you have: - A CentOS VPS (This guide is tested with CentOS 8) - A user account with sudo privileges - Basic familiarity with the command line #### Step 1: Install Firewalld Firewalld is the default firewall management tool on CentOS 8. If it’s not already installed, install it using the following command: ```bash sudo dnf install firewalld -y ``` #### Step 2: Start and Enable Firewalld Start the Firewalld service and enable it to start on boot: ```bash sudo systemctl start firewalld sudo systemctl enable firewalld ``` #### Step 3: Check Firewalld Status Verify that Firewalld is active and running: ```bash sudo firewall-cmd --state ``` #### Step 4: Understand Firewalld Zones Firewalld uses zones to define the trust level of network connections: - **Drop:** All incoming connections are dropped without any notification. Only outgoing connections are allowed. - **Block:** Similar to Drop, but an ICMP message is sent back to the sender. - **Public:** Represents untrusted public networks. Accepts only selected incoming connections. - **External:** For use with external firewalls with masquerading enabled. - **DMZ:** For computers in your demilitarized zone that are publicly accessible with limited access to the internal network. - **Work:** For work machines that are mostly trusted. - **Home:** For home networks that are mostly trusted. - **Internal:** For internal networks that are mostly trusted. - **Trusted:** All network connections are accepted. #### Step 5: Configure Default Zone Set the default zone to "public" for general-purpose usage: ```bash sudo firewall-cmd --set-default-zone=public ``` #### Step 6: Allow Essential Services Allow SSH to ensure you don’t lock yourself out of your server: ```bash sudo firewall-cmd --zone=public --add-service=ssh --permanent ``` Reload Firewalld to apply the changes: ```bash sudo firewall-cmd --reload ``` #### Step 7: Allow HTTP and HTTPS Traffic If you are running a web server, allow HTTP and HTTPS traffic: ```bash sudo firewall-cmd --zone=public --add-service=http --permanent sudo firewall-cmd --zone=public --add-service=https --permanent sudo firewall-cmd --reload ``` #### Step 8: Allow Specific Ports To allow traffic on specific ports, use the following command format: ```bash sudo firewall-cmd --zone=public --add-port=port_number/protocol --permanent ``` Replace `port_number` with the actual port number and `protocol` with `tcp` or `udp`. For example, to allow MySQL traffic on port 3306: ```bash sudo firewall-cmd --zone=public --add-port=3306/tcp --permanent sudo firewall-cmd --reload ``` #### Step 9: Deny Specific Traffic To explicitly deny traffic from specific IP addresses or networks, use the `--add-rich-rule` command: ```bash sudo firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.100" reject' --permanent ``` Replace `192.168.1.100` with the IP address you want to block. Reload Firewalld to apply the changes: ```bash sudo firewall-cmd --reload ``` #### Step 10: Check Active Rules To view the active firewall rules, use the following command: ```bash sudo firewall-cmd --zone=public --list-all ``` #### Step 11: Disable Firewalld (If Necessary) If you need to temporarily disable Firewalld, use the following command: ```bash sudo systemctl stop firewalld ``` To disable it permanently: ```bash sudo systemctl disable firewalld ``` **Caution:** Disabling your firewall exposes your system to security risks. Only disable Firewalld if absolutely necessary and re-enable it as soon as possible. #### Conclusion You have successfully set up and configured Firewalld on your CentOS VPS, enhancing your server’s security by managing and controlling network traffic. Regularly review and update your firewall rules to adapt to changing security needs and keep your system protected. **Additional Resources:** - **Firewalld Documentation:** [https://firewalld.org/documentation/](https://firewalld.org/documentation/) - **CentOS Documentation:** [https://www.centos.org/docs/](https://www.centos.org/docs/) - **Firewalld Command Line Interface:** [https://firewalld.org/documentation/man-pages/firewall-cmd.html](https://firewalld.org/documentation/man-pages/firewall-cmd.html)