From 7030b996e931e6588253283261e318d4bd14dea8 Mon Sep 17 00:00:00 2001
From: puneetse <22071208+puneetse@users.noreply.github.com>
Date: Fri, 4 Oct 2019 11:22:49 -0700
Subject: [PATCH] Add a new document for firewall options (#639)
---
source/guides/network/firewall.rst | 201 +++++++++++++++++++++++++++++
1 file changed, 201 insertions(+)
create mode 100644 source/guides/network/firewall.rst
diff --git a/source/guides/network/firewall.rst b/source/guides/network/firewall.rst
new file mode 100644
index 00000000..fe8fd446
--- /dev/null
+++ b/source/guides/network/firewall.rst
@@ -0,0 +1,201 @@
+.. _firewall:
+
+Firewall
+#########
+
+Firewalls control access to and from systems based on network packet
+attributes like IP address, port, payload and more.
+
+The `Netfilter `_ framework in the Linux kernel
+performs packet filtering and provides the means for implementing a software
+firewall in Linux. |CL-ATTR| has a couple different firewall front-end options
+for managing the Linux firewall.
+
+
+.. contents:: :local:
+ :depth: 2
+
+
+Default ruleset
+***************
+
+|CL| does not impose a firewall policy out of the box. All traffic is allowed
+inbound and all traffic is allowed outbound. However, `tallow`_ is installed
+by default and may dynamically create a rule temporarily restricting access
+from external hosts.
+
+.. warning::
+
+ Changing firewall configuration can cause abrupt network disconnection. If
+ this happens on a remote host, local recovery may be required.
+
+ Be sure to test your firewall configuration before committing it
+ permanently to ensure your system will remain accessible remotely, if
+ required.
+
+Firewall software
+*****************
+
+iptables
+========
+
+:command:`iptables` is a well-known user-space administration tool for
+configuring IPv4 Linux firewall rules. :command:`ip6tables` is the
+complimentary tool for configuring IPv6 Linux firewall rules.
+
+Below is information on using :command:`iptables` on |CL|:
+
+#. Make sure the *iptables* bundle is installed
+
+ .. code:: bash
+
+ sudo swupd bundle-add iptables
+
+
+#. Define new iptables rules/chains for the running configuration using the
+ :command:`iptables` command. See :command:`man iptables` for iptables
+ concepts and configuration options.
+
+ Below is a common restrictive firewall configuration which denies all
+ incoming connections, unless the connection was initiated by the host.
+
+ .. code:: bash
+
+ # Set default chain policies
+ sudo iptables -P INPUT DROP
+ sudo iptables -P FORWARD DROP
+ sudo iptables -P OUTPUT ACCEPT
+
+ # Accept on localhost loopback device
+ sudo iptables -A INPUT -i lo -j ACCEPT
+ sudo iptables -A OUTPUT -o lo -j ACCEPT
+
+ # Allow established sessions to receive traffic
+ sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+
+
+#. Test the running firewall configuration to make sure it behaving as
+ you expect.
+
+#. Run the *iptables-save* service to make the running configuration
+ persistent. This will perform a one-time save of the running configuration
+ to :file:`/etc/iptables.rules` :
+
+ .. code:: bash
+
+ sudo systemctl start iptables-save
+
+#. Enable the *iptables-resolve* service the iptables rules to be
+ automatically applied at boot from the :file:`/etc/iptables.rules` file:
+
+ .. code :: bash
+
+ sudo systemctl enable iptables-restore.service
+
+
+ipset
+=====
+
+`ipset `_ is a framework in the Linux kernel for
+storing and efficiently indexing combinations of IP addresses, networks,
+(TCP/UDP) port numbers, MAC addresses, and interface names.
+
+IP sets makes writing network policy rules simpler and processing them against
+a large and/or changing sets of hosts more efficient.
+
+By themselves, IP sets do not enforce network traffic rules but can be used to
+extend iptables rules for matching. It is important to note that the ipset
+must be defined before a netfilter rule can match against it.
+
+* Running IP sets can be manipulated with the :command:`ipset` utility.
+
+* Custom IP sets can be stored in the :file:`/etc/ipset.conf` file
+
+* IP sets in :file:`/etc/ipset.conf` can be automatically applied at boot by
+ enabling the *ipset* service with the command :command:`sudo systemctl
+ enable ipset`.
+
+See :command:`man ipset` to learn more about using ipsets.
+
+
+firewalld
+=========
+
+`firewalld `_ is based on nftables, the successor to
+iptables and parts of the netfilter framework. The description of firewalld
+helps highlight some of the differences compared to iptables:
+
+ firewalld provides a dynamically managed firewall with support for
+ network/firewall zones to define the trust level of network connections or
+ interfaces. It has support for IPv4, IPv6 firewall settings and for
+ ethernet bridges and has a separation of runtime and permanent
+ configuration options. It also supports an interface for services or
+ applications to add firewall rules directly.
+
+See :command:`man firewalld` for more information.
+
+Below is information on using :command:`firewalld` on |CL|:
+
+#. Install he *firewalld* bundle:
+
+ .. code:: bash
+
+ sudo swupd bundle-add firewalld
+
+
+#. Disable *iptables* and *ipset* services as they conflict with firewalld:
+
+ .. code::
+
+ sudo systemctl mask iptables-restore ipset
+
+
+#. :command:`firewall-cmd` can be used to configure the running or permanent
+ firewall configuration. See the `firewalld documentation
+ `_ to learn more about
+ firewalld concepts and configuration options.
+
+ Below is a common example to allow HTTPS traffic in public zones:
+
+ .. code::
+
+ sudo firewall-cmd --permanent --zone=public --add-service=https
+
+
+#. Enable the *firewalld* service the so that the firewalld daemon is
+ automatically started and rules applied at boot from the
+ :file:`/etc/firewalld/*` file:
+
+ .. code :: bash
+
+ sudo systemctl enable --now firewalld.service
+
+
+#. Verify that firewalld is running:
+
+ .. code :: bash
+
+ sudo firewall-cmd --state
+
+
+
+Troubleshooting
+***************
+
+When troubleshooting connectivity issues that may be related to firewall
+rules.
+
+* Consider restrictions at the physical network level.
+
+* For inbound connections, make sure your application is listening on the
+ network port you're expecting with :command:`lsof` or :command:`netstat`.
+
+* For outbound connections, make sure the destination host is responding to
+ the network port you're expecting with :command:`nc`. If the connection is
+ refused, then there may be a problem with the destination server.
+
+* If you're using firewalld, check the daemon status with the command:
+ :command:`systemctl status firewalld`.
+
+
+.. _`tallow`: https://github.com/clearlinux/tallow