To identify the specific Linux distribution version, inspect the release file:

cat /etc/redhat-release

CentOS 6 Firewall Configuration (iptables)

In legacy systems, iptables manages packet filtering. Rules can be applied via CLI or edited directly in the configuration file.

Method 1: Command-Line Interface

Apply rules to the INPUT chain. Use ACCEPT for open access or DROP/REJECT for blocking.

Enable a Port:

TARGET_PORT=8080
iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport $TARGET_PORT -j ACCEPT
service iptables save
service iptables restart

Disable a Port:

TARGET_PORT=8080
iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport $TARGET_PORT -j DROP
service iptables save
service iptables restart

Note: This method writes changes to memory first, requiring an explicit save command to persist across reboots.

Method 2: Editing Configuration Files

Directly modify the persistent ruleset located at /etc/sysconfig/iptables. This approach minimizes rule conflicts.

1. Open the editor:

   vim /etc/sysconfig/iptables
   

2. Add or remove lines corresponding to your port logic.
3. Apply changes by restarting the service:

   service iptables restart
   

CentOS 7 Firewall Configuration (firewalld)

The firewalld daemon provides dynamic management without manual rule compilation.

Service Status and Control

Check the operational state:

systemctl status firewalld
firewall-cmd --state

Manage lifecycle with standard systemd commands or legacy wrappers:

# Start
service firewalld start
# Restart
service firewalld restart
# Stop
service firewalld stop

Managing Ports and Zones

Use --permanent flags to ensure rules survive restarts. Always reload the configuration after modifications.

Query Port Status:

firewall-cmd --query-port=5000/tcp

Add or Remove Ports:

# Add port
firewall-cmd --permanent --add-port=5000/tcp
# Remove port
firewall-cmd --permanent --remove-port=5000/tcp

Reload Configuration:

firewall-cmd --reload

Advanced Rich Rules

Restrict traffic based on source IP ranges or protocols using rich rules:

Allow Specific Host:

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.10" port protocol="tcp" port="443" accept'

Allow Subnet Range:

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port protocol="tcp" port="443-450" accept'

Block Specific Host:

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.10" port protocol="tcp" port="443" reject'

To reverse these actions, replace --add-rich-rule with --remove-rich-rule.

Service Management

Some applications require predefined service definitions rather than port numbers.

List Available Services:

firewall-cmd --list-services

Enable FTP: FTP relies on specific service handling rather than just port 21 exposure.

firewall-cmd --permanent --add-service=ftp
firewall-cmd --reload

Advanced iptables Scenarios

For granular control beyond basic allow/deny, consider these configurations.

Restrict Access by Source IP

To permit only specific IPs on a sensitive port while blocking all others:

# Drop all initial traffic to port 9889
iptables -I INPUT -p tcp --dport 9889 -j DROP

# Whitelist approved clients
iptables -I INPUT -s 192.168.1.50 -p tcp --dport 9889 -j ACCEPT
iptables -I INPUT -s 192.168.1.51 -p tcp --dport 9889 -j ACCEPT

Multi-Port Targeting

Allow multiple ports simultaneously for a single source:

iptables -I INPUT -p tcp -m multiport --destination-ports 22,53,80 -s 192.168.2.100 -j ACCEPT

Time-Based Restrictions

Limit connectivity based on scheduled windows:

# Deny access during work hours
iptables -I OUTPUT -s 10.0.0.5 -m time --timestart 09:00 --timestop 17:00 --days Mon,Tue,Wed,Thu,Fri -j REJECT

# Allow access outside work hours
iptables -I OUTPUT -s 10.0.0.5 -m time --timestart 17:00 --timestop 09:00 --days Mon,Tue,Wed,Thu,Fri -j ACCEPT

Connectivity Testing Tools

Verify if remote services are reachable and listening.

Netstat (Linux)

Display active network connections:

# Show all TCP listeners with PID
netstat -tlnp | grep LISTEN
# UDP sockets
netstat -u

Telnet

Attempt a raw connection handshake:

telnet <target_ip> <port>

If the screen clears or hangs without error, the port is likely open.

SSH Debug Mode

Test connectivity to SSH-enabled hosts:

ssh -v -p <target_port> user@<target_ip>

The verbose flag (-v) displays connection attempt logs.

HTTP Tools

Use HTTP-specific utilities to check web endpoints:

Curl:

curl -v http://<ip>:<port>

Wget:

wget http://<ip>:<port>

Note: If the target does not support HTTP, wget may hang until timeout occurs.

System Time Synchronization

Incorrect system time can affect logging and certificate validation.

View Current Time

date

Set New Time Manually

Define the date/time string and sync hardawre clock:

date -s "2024-05-20 10:00:00"
hwclock --systohc

Combine both steps into a single line:

date -s "2024-05-20 10:00:00" && hwclock --systohc