1
00:00:00,000 --> 00:00:12,000
So let's get back to the original state and use Firewall-D on CentOS.

2
00:00:12,000 --> 00:00:23,000
First I need systemctl unmask Firewall-D and then I can use systemctl enable –now Firewall-D.

3
00:00:23,000 --> 00:00:24,500
Then we need to do what?

4
00:00:24,500 --> 00:00:33,500
Well, we need Firewall-CMD –listall, which is a good start to figure out what is allowed.

5
00:00:33,500 --> 00:00:39,500
And we can see that SSH is already there. We don't have HTTP and NTP.

6
00:00:39,500 --> 00:00:49,500
So Firewall-CMD get services by grab NTP.

7
00:00:49,500 --> 00:00:55,500
There you can see the name is just NTP, that makes it easy, and HTTP.

8
00:00:55,500 --> 00:01:00,500
We have different HTTPS, but the question is specifically about HTTP, right?

9
00:01:00,500 --> 00:01:08,500
So Firewall-CMD –add service NTP –permanent.

10
00:01:08,500 --> 00:01:15,500
As you can see, you may, but you don't have to, put an equal sign between the add service and the NTP.

11
00:01:15,500 --> 00:01:23,000
And then the same for HTTP and Firewall-CMD –reload.

12
00:01:23,000 --> 00:01:30,500
But then, the incoming traffic from address 20.0.0.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.J

13
00:01:30,500 --> 00:01:34,500
That is what you need to do using a RITS rule.

14
00:01:34,500 --> 00:01:39,500
Now, if you ever want to work with RITS rules, there are two components.

15
00:01:39,500 --> 00:01:50,500
First, Firewall-CMD –help-pipe-grab-RITS will show you that there is add-RITS rule, equals, and then you have the rule.

16
00:01:50,500 --> 00:01:54,500
And the rule must be in RITS language.

17
00:01:54,500 --> 00:02:06,500
And then, Firewall-CMD –help-pipe-grab-RITS will show you that there is add-RITS rule, equals, and then you have the rule.

18
00:02:06,500 --> 00:02:08,500
That has language examples.

19
00:02:08,500 --> 00:02:13,500
Go all the way down, and there you can find examples.

20
00:02:13,500 --> 00:02:22,500
And here we can see an example, and I like this example, which is going to drop all connections from a specific IP address.

21
00:02:22,500 --> 00:02:23,500
I can work with that.

22
00:02:23,500 --> 00:02:34,500
So, based on that, I'm going to use Firewall-CMD –add-RITS rule, is, and then between single quotes, we put the rule.

23
00:02:34,500 --> 00:02:39,500
And, of course, I need to modify the rule, but rule family is IPv4. That sounds good.

24
00:02:39,500 --> 00:02:47,500
Source address is, well, you should guess that 10.0.20.0 is what was asked for.

25
00:02:47,500 --> 00:02:54,500
20.0.0.16 should be acceptable, and yay, that is a success.

26
00:02:54,500 --> 00:03:02,500
And let's not forget to add that to permanent as well, because otherwise it won't survive a restart of your Firewall.

27
00:03:02,500 --> 00:03:16,500
Now, Firewall-CMD –reload and Firewall-CMD –list all should show you all your current configuration, including the RITS rule that was just added.

28
00:03:16,500 --> 00:03:18,500
And that is what was needed for this lab.