So let's get back to the original state and use Firewall-D on CentOS.
First I need systemctl unmask Firewall-D and then I can use systemctl enable –now Firewall-D.
Then we need to do what? Well, we need Firewall-CMD –listall, which is a good start to figure out what is allowed.
And we can see that SSH is already there. We don't have HTTP and NTP.
So Firewall-CMD –get-services –pipe-grab-ntp.
There you can see the name is just NTP, that makes it easy, and HTTP.
We have different HTTPS, but the question is specifically about HTTP, right?
So Firewall-CMD –add-service-ntp –permanent.
As you can see, you may, but you don't have to, put an equal sign between the add-service and the NTP.
And then same for HTTP and Firewall-CMD –reload.
But then the incoming traffic from address 20.00.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.6 and is blocked.
That is what you need to do using RIDS rules.
Now, if you ever want to work with the RIDS rules, there are two components.
First, Firewall-CMD. – minus –help-pipe-grab-RIDS
will show you that there is add RIDS rule –equals and then you have the lugar rule.
Man-K-RIDS is telling you Firewall-D.RIDS-language.
And I'm going to have a look at Firewall-D.RIDS-language.
That has language examples.
Go all the way down and there you can find examples.
And here we can see an example and I like this example,
which is going to drop all connections from a specific IP address.
I can work with that.
So based on that, I'm going to use Firewall-CMD. – minus –add-RIDS-rule-is
and then between single quotes, we put the rule.
And of course, I need to modify the rule, but rule family is IPv4.
That sounds good. Source address is, well, you should guess that 10.0.20.0
is what was asked for. 20.0.0 slash 16.
It should be acceptable and, yay, that is a success.
Let's not forget to add that to permanent as well,
because otherwise, it won't survive a restart of your firewall.
Now Firewall-CMD– reload and Firewall-CMD–list
all should show you all your current configuration,
including the rich rule that was just added.
And that is what was needed for this lab.