LFCS Firewall and Packet Filtering Questions and Answers — Questions and Answers
Question 1: A system administrator needs to allow HTTP traffic to a web server. Which of the following `firewall-cmd` commands correctly opens the standard HTTP port in the `public` zone and ensures the rule persists after a system reboot?
- firewall-cmd --zone=public --add-port=80/tcp
- firewall-cmd --permanent --zone=public --add-service=http (Correct answer)
- firewall-cmd --reload --add-service=http
- firewall-cmd --add-service=http --runtime-to-permanent
Correct answer: firewall-cmd --permanent --zone=public --add-service=http
The command `firewall-cmd --permanent --zone=public --add-service=http` correctly adds the 'http' service (which corresponds to TCP port 80) to the permanent configuration of the 'public' zone. The `--permanent` flag is crucial for ensuring the rule is saved and reapplied after a reboot or firewall reload. The other options are incorrect because they either only affect the runtime configuration, use incorrect syntax, or misuse the flags.
Question 2: What is the primary function of the `firewall-cmd --reload` command?
- It restarts the entire firewalld service, dropping all active connections.
- It saves the current runtime rules to the permanent configuration.
- It applies the permanent configuration to the runtime environment without dropping existing connections. (Correct answer)
- It lists all the rules in the permanent configuration without applying them.
Correct answer: It applies the permanent configuration to the runtime environment without dropping existing connections.
The `firewall-cmd --reload` command reads the permanent configuration files and applies them as the new runtime configuration. A key feature of `--reload` is that it does this without interrupting or dropping existing connections, making it the preferred way to apply saved changes on a live system. Restarting the service drops connections, and `--runtime-to-permanent` saves the current state.
Question 3: An administrator wants to enhance security by allowing SSH access (port 22) ONLY from the internal administrative subnet `192.168.50.0/24`. Which of the following `firewall-cmd` commands correctly implements this using a rich rule?
- firewall-cmd --permanent --zone=public --add-source=192.168.50.0/24 --add-service=ssh
- firewall-cmd --permanent --zone=public --add-rich-rule='rule service name="ssh" source-address="192.168.50.0/24" accept'
- firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.50.0/24" service name="ssh" accept' (Correct answer)
- firewall-cmd --permanent --zone=public --add-rule='family=ipv4 source=192.168.50.0/24 service=ssh accept'
Correct answer: firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.50.0/24" service name="ssh" accept'
The correct syntax for adding a rich rule involves the `--add-rich-rule` option with the rule enclosed in single quotes. The rule must specify the address family (`ipv4`), the `source address` with its subnet mask, the `service name`, and the action (`accept`). The other options use incorrect syntax, such as `--add-rule`, or an incomplete/improperly formatted rich rule string.
Question 4: In the context of `firewalld`, what is the primary purpose of a 'zone'?
- To define a specific hardware network interface card (NIC) on the system.
- To create a log file for a specific set of rules.
- To group rules into predefined sets based on the level of trust for a network connection or interface. (Correct answer)
- To schedule when specific firewall rules should be active.
Correct answer: To group rules into predefined sets based on the level of trust for a network connection or interface.
Zones are the core concept in firewalld for managing rules. They represent a level of trust for a network. A network interface (like `eth0`) or a source IP address range is assigned to a zone, and that zone's rules (e.g., what services or ports are open) are applied to the traffic. This allows for easily switching between different security policies, for instance, a more restrictive 'public' zone and a more permissive 'internal' zone.
Question 5: A sysadmin adds a temporary rule to allow traffic on port 5000/tcp using `firewall-cmd --add-port=5000/tcp`. They do not use the `--permanent` flag. What happens to this rule if the `firewalld` service is restarted?
- The rule is automatically saved to the permanent configuration and remains active.
- The rule is removed from the runtime configuration and is no longer active. (Correct answer)
- The rule remains active in the runtime configuration but is not saved permanently.
- The system prompts the administrator to save the rule before restarting.
Correct answer: The rule is removed from the runtime configuration and is no longer active.
Changes made to the firewalld configuration without the `--permanent` flag only apply to the current runtime environment. When the `firewalld` service is restarted or reloaded, it discards the current runtime configuration and loads the saved rules from the permanent configuration. Since the rule for port 5000/tcp was never saved to the permanent configuration, it is lost.
Question 6: Which of the following best describes the fundamental operation of a packet filtering firewall?
- It inspects the data payload of each packet for malicious code before allowing it to pass.
- It analyzes application-level data to understand the context of a conversation between two hosts.
- It authenticates the user sending the packet before allowing it through the network.
- It examines the header information of a packet, such as source/destination IP and port, against a set of rules. (Correct answer)
Correct answer: It examines the header information of a packet, such as source/destination IP and port, against a set of rules.
A packet filtering firewall operates at the network layer. Its primary function is to inspect the headers of each packet (containing information like source IP, destination IP, source port, destination port, and protocol) and compare this information against a pre-defined ruleset to decide whether to permit or deny the packet. It does not typically inspect the payload (content) of the packet.
LFCS Firewall and Packet Filtering Questions and Answers
A system administrator needs to allow HTTP traffic to a web server.
Which of the following `firewall-cmd` commands correctly opens the standard HTTP port in the `public` zone and ensures the rule persists after a system reboot?