Linux

48207 readers

871 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
No misinformation
No NSFW content
No hate speech, bigotry, etc

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago

MODERATORS

[email protected]

Can you help me with firewalld? (lemmy.world)

submitted 4 months ago by [email protected] to c/[email protected]

5 comments fedilink hide all child comments

Hello everyone,

I'm looking to increase the security of my computers a bit through firewalld (with the KDE settings). I have a desktop and a laptop, both running Fedora 40 with KDE plasma. I don't have access to the router's firewalls etc etc this is only for my machines.

The issue is I'm having a hard time navigating the zones and setting rules the way I want. I don't wanna deal with switching to UFW and while I generally like CLI stuff I'd prefer to generally stick with the GUI here even though I find it a bit confusing (I will use CLI if necessary tho).

Anyways, let's get to the point. Firstly the only difference between the laptop and desktop, in terms of use-case, is that on my desktop I'm always connected to my home's subnet via LAN while on my laptop I often connect to public wifis, so naturally the laptop is a little less secure.

For my use-case I care about 3 network interfaces:

tailscale: this is the one I use to ssh into my machines and stuff and I want this to be the only interface which allows me to ssh. This is because not only it allows me to ssh remotely but also I figure is also the most secure way to use ssh as the tailscales team is probably better at security than I am.
Proton VPN's: this I use for gaming, web browsing and seeding Linux ISOs so I'd like settings that block everything without affecting these usecases.
normal internet: I almost always have my VPN on but occasionally I don't for one reason or another and I only use this for web browsing and gaming via steam. Settings I'd like here are essentially the same as ProtonVPN's but stricter if it makes sense to be stricter, especially on the laptop where it's likely a public wifi I'm conencting to when I'm not home. If it's possible I'd also like this interface to be hidden from nmap scans.

I do some light pentesting to learn so there's also that.

I currently have every relevant connection set to FedoraWorkstation zone by default except I manually tell the laptop to switch to public zone for public wifis (I'd change the default to be public and specify other zones for non-public connections but rn I'm in a period of time when I'm only connecting it to my home network so I wanna figure out this out first).

My question is, which zones should I use and what rules should I implement to make this more secure?

Thanks in advance

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 5 points 4 months ago* (last edited 4 months ago) (1 children)

I can't provide specific advice for tailscale, but I can share my notes for my own use case, which is for PCs that are safely behind the home firewall. You'd want to adjust your ssh/smb settings accordingly. You shouldn't need any rules for ProtonVPN, as you're likely just trying to block incoming connections, not outbound.

It's my understanding that Fedora opens ports 1025-65535/tcp and 1025-65535/udp by default.

To lock down to sane defaults (--permanent saves the settings directly, avoiding the need to run firewall-cmd --runtime-to-permanent separately):

sudo firewall-cmd --permanent --remove-port=1025-65535/tcp
sudo firewall-cmd --permanent --remove-port=1025-65535/udp
sudo firewall-cmd --permanent --add-port=27031/udp  # steam remote play
sudo firewall-cmd --permanent --add-port=27036/udp  # steam remote play
sudo firewall-cmd --permanent --add-port=27036/tcp  # steam remote play
sudo firewall-cmd --permanent --add-port=27037/tcp  # steam remote play

Ensure that ssh and samba-client are listed as allowed services too (sudo firewall-cmd --list-all).

Firewalld must be reloaded before rule changes will take effect: firewall-cmd --reload
Changes will reset upon reboot unless made persistent by using --permanent or by committing all changes with --runtime-to-permanent

Common commands:

sudo systemctl enable --now firewalld   # enable and start firewalld service
sudo systemctl disable firewalld
sudo systemctl stop firewalld

sudo firewall-cmd --state               # show running state of firewalld
sudo firewall-cmd --get-active-zones    # list active zones
sudo firewall-cmd --get-zones           # list all zones
sudo firewall-cmd --get-default-zone    # list default zone
sudo firewall-cmd --list-ports          # list allowed ports in current zone
sudo firewall-cmd --list-all            # list all settings
sudo firewall-cmd --reload              # reload firewall rules to activate any rule modifications

Add/remove ports, services, IPs:

sudo firewall-cmd --add-port=port-number/port-type      # allow incoming port  (tcp,udp,sctp,dccp)
sudo firewall-cmd --remove-port=port-number/port-type   # block incoming port
sudo firewall-cmd --add-service=<service-name>          # allow incoming service (see /etc/services)
sudo firewall-cmd --remove-service=<service-name>       # block incoming service (see /etc/services)
sudo firewall-cmd --add-source=192.168.1.100 (or 192.168.1.0/24)    # whitelist incoming IP or IP range
sudo firewall-cmd --remove-source=192.168.1.100 (or 192.168.1.0/24) # remove whitelisted IP or IP range

Block an IP or IP range (rich rules):

sudo firewall-cmd --permanent --add-rich-rule="rule family='ipv4' source address='192.168.1.100' reject"
sudo firewall-cmd --permanent --add-rich-rule="rule family='ipv4' source address='192.168.1.0/24' reject"

Whitelist IP for specific port (rich rule):

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.100" port protocol="tcp" port="3306" accept'

Removing a Rich Rule

sudo firewall-cmd --permanent --remove-rich-rule='rule family="ipv4" source address="192.168.1.100" port protocol="tcp" port="3306" accept'

[–] [email protected] 2 points 4 months ago

This is great, thank you.