Latest News And Updates - Rad Web Hosting Blog

Learn how to configure additional firewall rules on Rocky Linux VPS for improved server security. This article provides a guide for how to configure additional firewall rules on Rocky Linux VPS for improved security of your system. How to Configure Additional Firewall Rules on Rocky Linux VPS This tutorial will guide you through the process of configuring additional firewall rules on a Rocky Linux VPS using firewalld. Firewalld is the default firewall management tool on many RHEL-based distributions like Rocky Linux. Prerequisites You need access to your Rocky Linux VPS with root privileges. A basic understanding of Linux command line. A basic understanding of firewall rules and network ports. Launch a Rocky Linux VPS with 100% SSD from $3.19/mo! Getting Started: Firewalld Installation on Rocky Linux To install and configure firewalld on Rocky Linux, follow these steps: Update your system sudo dnf update -y Install firewalld sudo dnf install firewalld -y Enable firewalld to start on boot sudo systemctl enable firewalld Start firewalld sudo systemctl start firewalld Check firewalld status sudo systemctl status firewalld You should see that the service is active (running). Basic firewalld commands Check default zone: sudo firewall-cmd --get-default-zone List all active rules: sudo firewall-cmd --list-all Open a port (e.g., 80/tcp): sudo firewall-cmd --permanent --add-port80/tcp sudo firewall-cmd --reload Allow a service (e.g., SSH): sudo firewall-cmd --permanent --add-servicessh sudo firewall-cmd --reload List all zones: sudo firewall-cmd --get-zones Make sure firewalld starts after reboot sudo systemctl is-enabled firewalld It should return: enabled. Configure Additional Firewall Rules on Rocky Linux VPS Now that Firewalld is installed and we have understanding of its basic functions, it's time to configure additional firewall rules on Rocky Linux VPS. Follow the steps below: Connect to Your VPS First, you need to connect to your VPS via SSH. Open your terminal and use the following command: ssh root@your_vps_ip_address Replace your_vps_ip_address with the actual IP address of your VPS. Check the Status of firewalld Once logged in, check the status of firewalld to ensure it is running: systemctl status firewalld If firewalld is not running, you can start it with: systemctl start firewalld To ensure it starts automatically on boot, enable it with: systemctl enable firewalld List Existing Firewall Rules Before adding new rules, it’s a good practice to check the current firewall rules: firewall-cmd --list-all This command shows all the rules for the active zone, typically public. Adding a New Firewall Rule Allowing a Specific Port To allow traffic on a specific port (e.g., HTTP on port 80), use: firewall-cmd --zonepublic --add-port80/tcp --permanent Here’s a breakdown: --zonepublic: Specifies the zone you want to add the rule to. public is the default zone. --add-port80/tcp: Opens port 80 for TCP traffic. --permanent: Ensures the rule persists after a reboot. Without this, the rule is only temporary. Allowing Multiple Specific Ports To allow traffic on multiple specific ports (e.g., HTTP on port 80 and HTTPS on port 443), use: firewall-cmd --zonepublic --add-port{80,443}/tcp --permanent Here’s a breakdown: --zonepublic: Specifies the zone you want to add the rule to. public is the default zone. --add-port{80,443}/tcp: Opens ports 80 and 443 for TCP traffic. --permanent: Ensures the rule persists after a reboot. Without this, the rule is only temporary. Allowing a Service You can also allow services by name, which automatically opens the necessary ports. For example, to allow SSH: firewall-cmd --zonepublic --add-servicessh --permanent Allowing IP Address To allow traffic from a specific IP address, use: firewall-cmd --zonepublic --add-source192.168.1.100 --permanent Replace 192.168.1.100 with the IP address you want to allow. Reload the Firewall After adding your rules, reload firewalld to apply the changes: firewall-cmd --reload Verify the New Rules To confirm that your new rules have been applied, list the active rules again: firewall-cmd --list-all Removing a Firewall Rule If you need to remove a firewall rule, the process is similar to adding one but with the --remove option. Removing a Port To remove a rule that opens a port: firewall-cmd --zonepublic --remove-port80/tcp --permanent Removing a Service To remove a service: firewall-cmd --zonepublic --remove-servicessh --permanent Removing an IP Address To remove an IP address: firewall-cmd --zonepublic --remove-source192.168.1.100 --permanent After removing the rules, don’t forget to reload the firewall: firewall-cmd --reload Advanced Firewall Rules (Optional) Rich Rules For more granular control, you can use rich rules. For example, to allow SSH from a specific IP: firewall-cmd --zonepublic --add-rich-rule'rule family"ipv4" source address"192.168.1.100" service name"ssh" accept' --permanent Blocking an IP Address To block an IP address: firewall-cmd --zonepublic --add-rich-rule'rule family"ipv4" source address"192.168.1.100" drop' --permanent Backup and Restore Firewall Rules (Recommended) To back up your firewall rules: firewall-cmd --runtime-to-permanent firewall-cmd --permanent --list-all > /etc/firewalld/rules.backup To restore from a backup: firewall-cmd --permanent --new-configrules.backup firewall-cmd --reload Launch a Rocky Linux VPS with 100% SSD from $3.19/mo! Conclusion You now know how to configure additional firewall rules on Rocky Linux VPS. Regularly review and update your firewall rules to ensure your server remains secure. This process can be repeated for any additional ports, services, or IP addresses you need to manage on your VPS. Remember that improper firewall rules can lock you out of your server, so always double-check your rules before applying them, especially when working with SSH. Further Reading: Order Rocky Linux VPS Firewalld Documentation Firewalld on Github

Rad Web Hosting Blog

Recent Posts

Nothing Found

My Feed at https://radwebhosting.com

Services

Categories

Recent Posts

Save on VPS Hosting!

We’re Social!

Rad Web Hosting Blog