This article provides a guide for how to configure additional firewall rules on Rocky Linux VPS for improved security of your system.

Table of Contents

How to Configure Additional Firewall Rules on Rocky Linux VPS

This tutorial will guide you through the process of configuring additional firewall rules on a Rocky Linux VPS using firewalld. Firewalld is the default firewall management tool on many RHEL-based distributions like Rocky Linux.

Prerequisites

You need access to your Rocky Linux VPS with root privileges.
A basic understanding of Linux command line.
A basic understanding of firewall rules and network ports.

Launch a rocky linux vps with 100% ssd from $2. 49/mo!

Getting Started: Firewalld Installation on Rocky Linux

To install and configure firewalld on Rocky Linux, follow these steps:

Update your system
```
sudo dnf update -y
```
Install firewalld
```
sudo dnf install firewalld -y
```
Enable firewalld to start on boot
```
sudo systemctl enable firewalld
```
Start firewalld
```
sudo systemctl start firewalld
```
Check firewalld status
```
sudo systemctl status firewalld
```
You should see that the service is active (running).

Basic firewalld commands

Check default zone:
```
sudo firewall-cmd --get-default-zone
```
List all active rules:
```
sudo firewall-cmd --list-all
```

Open a port (e.g., 80/tcp):

sudo firewall-cmd --permanent --add-port=80/tcp sudo firewall-cmd --reload

Allow a service (e.g., SSH):

sudo firewall-cmd --permanent --add-service=ssh sudo firewall-cmd --reload

List all zones:
```
sudo firewall-cmd --get-zones
```

Make sure firewalld starts after reboot
```
sudo systemctl is-enabled firewalld
```
It should return: enabled.

Configure Additional Firewall Rules on Rocky Linux VPS

Now that Firewalld is installed and we have understanding of its basic functions, it’s time to configure additional firewall rules on Rocky Linux VPS. Follow the steps below:

Connect to Your VPS

First, you need to connect to your VPS via SSH. Open your terminal and use the following command:
```
ssh root@your_vps_ip_address
```
Replace your_vps_ip_address with the actual IP address of your VPS.
Check the Status of firewalld

Once logged in, check the status of firewalld to ensure it is running:
```
systemctl status firewalld
```
If firewalld is not running, you can start it with:
```
systemctl start firewalld
```
To ensure it starts automatically on boot, enable it with:
```
systemctl enable firewalld
```
List Existing Firewall Rules

Before adding new rules, it’s a good practice to check the current firewall rules:
```
firewall-cmd --list-all
```
This command shows all the rules for the active zone, typically public.
Adding a New Firewall Rule
1. Allowing a Specific Port
  
  To allow traffic on a specific port (e.g., HTTP on port 80), use:
```
firewall-cmd --zone=public --add-port=80/tcp --permanent
```
  Here’s a breakdown:
  - --zone=public: Specifies the zone you want to add the rule to. public is the default zone.
  - --add-port=80/tcp: Opens port 80 for TCP traffic.
  - --permanent: Ensures the rule persists after a reboot. Without this, the rule is only temporary.
2. Allowing a Service
  
  You can also allow services by name, which automatically opens the necessary ports. For example, to allow SSH:
```
firewall-cmd --zone=public --add-service=ssh --permanent
```
3. Allowing IP Address
  
  To allow traffic from a specific IP address, use:
```
firewall-cmd --zone=public --add-source=192.168.1.100 --permanent
```
  Replace 192.168.1.100 with the IP address you want to allow.
Reload the Firewall

After adding your rules, reload firewalld to apply the changes:
```
firewall-cmd --reload
```
Verify the New Rules

To confirm that your new rules have been applied, list the active rules again:
```
firewall-cmd --list-all
```
Removing a Firewall Rule

If you need to remove a firewall rule, the process is similar to adding one but with the --remove option.
1. Removing a Port
  
  To remove a rule that opens a port:
```
firewall-cmd --zone=public --remove-port=80/tcp --permanent
```
2. Removing a Service
  
  To remove a service:
```
firewall-cmd --zone=public --remove-service=ssh --permanent
```
3. Removing an IP Address
  
  To remove an IP address:
```
firewall-cmd --zone=public --remove-source=192.168.1.100 --permanent
```
  After removing the rules, don’t forget to reload the firewall:
```
firewall-cmd --reload
```

Advanced Firewall Rules (Optional)

Rich Rules

For more granular control, you can use rich rules. For example, to allow SSH from a specific IP:

firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.100" service name="ssh" accept' --permanent

Blocking an IP Address

To block an IP address:

firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.100" drop' --permanent

Backup and Restore Firewall Rules (Recommended)

To back up your firewall rules:

firewall-cmd --runtime-to-permanent firewall-cmd --permanent --list-all > /etc/firewalld/rules.backup

To restore from a backup:

firewall-cmd --permanent --new-config=rules.backup firewall-cmd --reload

Launch a rocky linux vps with 100% ssd from $2. 49/mo!

Conclusion

You now know how to configure additional firewall rules on Rocky Linux VPS. Regularly review and update your firewall rules to ensure your server remains secure.

This process can be repeated for any additional ports, services, or IP addresses you need to manage on your VPS. Remember that improper firewall rules can lock you out of your server, so always double-check your rules before applying them, especially when working with SSH.