Changes

In this lab you will learn how to use iptables and firewalld to build and test a simple Linux firewall on your first Virtual Machine. You will also get an introduction to firewalld, a new service that manages some firewall configuration for youservers.

Prior to beginning this lab verifying verify network connectivity between your host and your VM 1VMs.

* Start your 1st VMVMs.* On the VMVMs

** Find out the MAC address of the NIC (usually eth0or ens3) and the IP address assigned to it. Record this information on your lab log book.** Disable your current firewall (firewalld), and enable the iptables firewall. systemctl disable firewalld systemctl enable iptables**Reboot the VM, and check to make sure that iptables is running and firewalld is not.***If iptables refuses to start, check your system logs for an error message explaining why. Fix the error and try again.**Flush all rules in all chains in all tables and set the default policy for the INPUT, FORWARD, and OUTPUT chains to ACCEPT.

** Open a terminal window and perform the following connectivity teststo each vm:*** ping -c 2 [ip-of-vm1vm]*** ssh [LearnID]@[ip-of-vm1vm]

*On both systems (Host and VM1VMs)

=*You will now modify the firewall on your host to be more secure. As several rules are automatically added for you because of the virtual network, the next portion of the lab is will be done with your virtual network shut off.*Shutdown your VMs*Stop the libvirtd service on the host*Restart the iptables service on the host ==Building a Simple Firewall on VM1 =the Host =='''On your VM1 Host build a custom firewall by performing the following steps:'''#Add appropriate rule(s) to allow Remove the rules in your input chain that are allowing all icmp and ssh traffic to/from the loopback 'lo' interface.

#Add a rule to Change the default policy on the INPUT chain of and FORWARD chains in the filter table to allow DROP.#Remove the rules from the INPUT and FORWARD chains that are rejecting all ESTABLISHED and RELATED incoming connectionstraffic (we are now better protected by the default policy).

#Add a rule to the beginning of the INPUT chain of your filter table that sends all ssh traffic (tcp packets with destination port 22 ) to your MYSSH chain.#Add a rule to your MYSSH chain to deny accpept all traffic on your virbr0 interface from 192.168.X.1 0/24 (i.e. your hostinternal network). Also #Add rules to the end of the MYSSH chain to drops all remaining ssh connections, but to log these denied packets with log level 'info' and log prefix "DENIED BY MYSSH".#Add a rule to the end of the INPUT chain of the filter table that allows all ssh connectionsbefore doing so.

#find a partner and get the ipaddress and MAC address of their external facing interface.#Add a rule to your MYICMP chain that denies allows ICMP pings packets coming in on your virbr0 interface from 192.168.X.1 0/24 (i.e. your hostinternal network).#Add a rule to your MYICMP chain that denies ICMP pings originating with MAC address of the hostyour partner's virbr0machine.#Add a rule to the end of your INPUT MYICMP chain that allows denies ICMP pings from anywhere.#Change the default policy on the INPUT and FORWARD chains in the filter table to DROPoriginating with ip address of your partner's machine.

===Testing your custom firewall===*On Save your host use nmap to scan your firewall on your VM rules and observe the outputlist them.**If you don't have nmap on your host then install itstart the libvirtd service.*Use ping and ssh from your host (192.168.x.1) *Note how this adds a number of rules to verify your firewall is working properlytables. Be sure to check In the log file on the VM for future, if you save your unsuccessful ssh attempts.*Save your firewall iptables rules with these rules.*Turn the firewall on in your VM offtables, then try scanning again. Note how the output is different.**Make sure you turn the firewall back on when you are donewill notice them start to duplicate.

==Building a Firewall With Firewalld on VM3VMs==On your VM 3 VMs we will build a firewall using the newer standard firewalld.*Start VM1, become root, and make the following changes:*Move your eth0 active interface into the zone 'work'.

*Use the firewallcmd firewall-cmd rich rules to make the following changes (very similar to what you did on VM 1):**Log and block Block all ssh attempts from your host's ip address. Use , adding a log entry with the same log message as on your other machines'DENIED BY MYSSH' every time it attempts to connect.**Block all pings from the host's ip address.**Allow pings expect for those that come from your other VMs.*Unlike iptables where you save your current state in bulk, firewalld requires you to save each change independentlyinternal network.

==Building a Simple Firewall on Testing your VM 2 custom firewall==#Repeat *On your host use nmap to scan your firewall on your VMs and observe the steps from output.**If you don'Building a Simple Firewall t have nmap on your host then install it. Install it on VM1' your VMs as well.*Use ping and ssh between your host and 'Testing VMs to verify your firewall is working properly. Be sure to check the log file on the host for your unsuccessful ssh attempts.*Save your custom firewall' rules.*Turn the firewall on your VM 2off, then try scanning again. Note how the output is different.**Make sure you turn the firewall back on when you are done.#*Double check that the all VMs can still ping and SSH each other.

Upon completion of this lab each of your VMs machines has a firewall protecting them from unexpected traffic. Reboot your machines and ensure that this protection remains in place after they are shut down. You will be building on these rules for the rest of the course. You should now have a basic understanding of the commands necessary to modify firewalls using iptables and firewalld.

You should now have a basic understanding of the commands necessary to modify firewalls using iptables and firewalld. Scan each of your machines with nmap. Observe how the results are different differ depending on which machine you scanned from.

#Which rule in the MYICMP chain is actually responsible for denying icmp packets from your Fedora hostpartner? Why?#Which optional module could be used to work with packets based on whether they are new connections or not?