Bookmark this page

Summary

In this chapter, you learned:

  • The netfilter subsystem allows kernel modules to inspect every packet traversing the system. All incoming, outgoing or forwarded network packets are inspected.

  • The use of firewalld has simplified management by classifying all network traffic into zones. Each zone has its own list of ports and services. The public zone is set as the default zone.

  • The firewalld service ships with a number of pre-defined services. They can be listed using the firewall-cmd --get-services command.

  • Network traffic is tightly controlled by the SELinux policy. Network ports are labeled. For example, port 22/TCP has the label ssh_port_t associated with it. When a process wants to listen on a port, SELinux checks to see whether the label associated with it is allowed to bind that port label.

  • The semanage command is used to add, delete, and modify labels.

Revision: rh134-8.2-f0a9756