I have a quick question with regards to the Linux Firewalld Setup task after having spent some time working on it yesterday. I’m pretty sure that the steps that I have taken are correct and that I arrived at the correct end result…but…I did not hit submit because I’m not clear on a couple of things after having run - firewall-cmd --list-all. Here is a screenshot of the results:
Even though the task does not explicitly mention to add http & https to the services section, I have done so anyway. Will I end up with a failed status because of this?
Also, I was wondering if the overall output is correct &/or missing anything. This is my first time configuring Firewalld for a reverse proxy server for Apache.
Thank you for responding @amuthan1983 and thank you for the tips. I did run these commands after installing, starting, and enabling Firewalld:
firewall-cmd --zone=public --add-port=6816/tcp --permanent
# Is this ok..ie., even though this wan't mentioned in the task?
firewall-cmd --permanent --zone=public --add-service=https
# Is this ok..ie., even though this wan't mentioned in the task?
firewall-cmd --permanent --zone=public --add-service=http
# add the rich rule
firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="172.16.238.14" port protocol=tcp port=3004 accept'
# add the interface
firewall-cmd --permanent --zone=public --change-interface=eth0
firewall-cmd --reload; firewall-cmd --list-all
firewall-cmd --get-active-zones
firewall-cmd --zone=public --list-all
I kind of assumed that firewall-cmd --reload; achieved the same result as running systemctl restart firewalld (note the absence of sudo because I am running these commands as the root user), but maybe I am wrong and I need to run both…or one or the other.
I do see that I missed running this command: sudo firewall-cmd --zone=public --list-ports.
Thank you for responding. I’m a bit confused now because I can see the nginx port 6816 in the output, along with the apache port 3004 in the rich rule. Maybe I missed a step from the ones that I have posted above in my response to @amuthan1983 ?
Yes, I already done this task. you can check if the port is accessible with telnet. you run telnet {host} {port}, and it will report Connected to {host} if the port is accesible or will stuck on Trying {host} if it’s not. Run this on jump host (the three app servers nginx should be accessible but the apache should not) and on lb host (the two services should be accessible). As long this requirements are attended I don’t think another modifications will fail the task
I could post all of the steps that I have taken here…if that’s OK…not sure if it is. I’ve spent a LOT of time stuck on this one and I would love to actually understand what I am missing.
Also one more thing:
Does it matter that I am running all of these commands (on all App servers) as root user? I was unable to install/start/enable firewalld without first switching to root user.
Does it matter that I am running all of these commands (on all App servers) as root user? I was unable to install/start/enable firewalld without first switching to root user.
Does the network interface that I choose affect the overall outcome of this task? For my last attempt I went with WAN.
Also, it appears that I am getting closer to the finish line (thank you @francilio & @amuthan1983), but I am getting an access forbidden error when trying to curl nginx. I’m not sure why this is happening. The telnet commands appear to be working as expected now, as in Jump host is connecting to nginx , but not to Apache & the LB Server is connecting to NGINX and to Apache.
…feels like I’m really close, but not sure.
Apologies for all of the questions, but for some reason this task is really tripping me up.
. I’m still feeling a bit reluctant to hit that 
