> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/linux-server-administrator/servers-configurations-centos7/firewall.md).

# Firewall

## What is a Firewall?

A firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. It can be hardware-based, software-based, or a combination of both. Firewalls help protect networks or devices from external threats, ensuring only authorized traffic is allowed to pass through.

***

### How Firewalls Are Managed

The **input**, **forward**, and **output** chains are used to control and monitor traffic in a firewall. These chains help protect the network or device by filtering traffic based on security rules.

***

### Configure Firewall

* **Install iptables:**

  ```bash
  yum install iptables
  ```
* **Restart the iptables service:**

  ```bash
  systemctl restart iptables.service
  ```
* **Enable iptables service to start automatically:**

  ```bash
  systemctl enable iptables.service
  ```

#### Manage Tables

* **View iptables help:**

  ```bash
  iptables --help
  ```
* **List current iptables rules:**

  ```bash
  iptables -L
  ```
* **List rules with line numbers:**

  ```bash
  iptables -L -n --line-number
  ```
* **View input chain:**

  ```bash
  iptables -n -L INPUT
  ```
* **View output chain:**

  ```bash
  iptables -n -L OUTPUT
  ```
* **View forward chain:**

  ```bash
  iptables -n -L FORWARD
  ```

#### Temporary Configure

* **Allow TCP traffic on port 21 (FTP):**

  ```bash
  iptables -I INPUT 5 -p tcp --dport 21 -j ACCEPT
  ```
* **Allow TCP traffic on ports 80 to 90:**

  ```bash
  iptables -I INPUT 5 -p tcp --dport 80:90 -j ACCEPT
  ```
* **Allow TCP traffic for telnet:**

  ```bash
  iptables -I INPUT 1 -p tcp --dport telnet -j ACCEPT
  ```
* **Allow UDP traffic on port 53 (DNS):**

  ```bash
  iptables -I INPUT 5 -p udp --dport 53 -j ACCEPT
  ```
* **Allow UDP traffic on port 25 (SMTP):**

  ```bash
  iptables -I INPUT 5 -p udp --dport smtp -j ACCEPT
  ```
* **Drop TCP traffic from IP `192.168.1.1` to port 22 (SSH):**

  ```bash
  iptables -I INPUT 5 -p tcp -s 192.168.1.1 --dport 22 -j DROP
  ```
* **Reject TCP traffic from IP `192.168.1.12` to port 24:**

  ```bash
  iptables -I INPUT 4 -p tcp -s 192.168.1.12 --dport 24 -j REJECT
  ```
* **Allow TCP traffic to IP `192.168.43.100` on port 30:**

  ```bash
  iptables -I INPUT 5 -p tcp -d 192.168.43.100 --dport 30 -j ACCEPT
  ```
* **Reject TCP traffic on port 21 (FTP):**

  ```bash
  iptables -I INPUT 5 -p tcp --dport 21 -j REJECT
  ```
* **Reject TCP traffic on ports 80 to 90:**

  ```bash
  iptables -I INPUT 5 -p tcp --dport 80:90 -j REJECT
  ```
* **Reject TCP traffic for telnet:**

  ```bash
  iptables -I INPUT 1 -p tcp --dport telnet -j REJECT
  ```
* **Reject UDP traffic on port 53 (DNS):**

  ```bash
  iptables -I INPUT 5 -p udp --dport 53 -j REJECT
  ```
* **Reject UDP traffic on port 25 (SMTP):**

  ```bash
  iptables -I INPUT 5 -p udp --dport smtp -j REJECT
  ```
* **Drop TCP traffic on port 21 (FTP):**

  ```bash
  iptables -I INPUT 5 -p tcp --dport 21 -j DROP
  ```
* **Drop TCP traffic on ports 80 to 90:**

  ```bash
  iptables -I INPUT 5 -p tcp --dport 80:90 -j DROP
  ```
* **Drop TCP traffic for telnet:**

  ```bash
  iptables -I INPUT 1 -p tcp --dport telnet -j DROP
  ```
* **Drop UDP traffic on port 53 (DNS):**

  ```bash
  iptables -I INPUT 5 -p udp --dport 53 -j DROP
  ```
* **Drop UDP traffic on port 25 (SMTP):**

  ```bash
  iptables -I INPUT 5 -p udp --dport smtp -j DROP
  ```

#### Save Temporary iptables Changes Permanently

* **Save the changes:**

  ```bash
  service iptables save
  ```

#### Permanent Configuration

* **Edit the main iptables configuration file:**

  ```bash
  vim /etc/sysconfig/iptables
  ```
* **Restart the iptables service:**

  ```bash
  systemctl restart iptables.service
  ```