In this chapter, you learned:
The netfilter subsystem allows kernel modules to inspect every packet traversing the system.
All incoming, outgoing or forwarded network packets are inspected.
The use of firewalld has simplified management by classifying all network traffic into zones.
Each zone has its own list of ports and services.
The public zone is set as the default zone.
The firewalld service ships with a number of pre-defined services.
They can be listed using the firewall-cmd --get-services command.
Network traffic is tightly controlled by the SELinux policy.
Network ports are labeled.
For example, port 22/TCP has the label ssh_port_t associated with it.
When a process wants to listen on a port, SELinux checks to see whether the label associated with it is allowed to bind that port label.
The semanage command is used to add, delete, and modify labels.
Click CREATE to build all of the virtual machines needed for the classroom lab environment. This may take several minutes to complete. Once created the environment can then be stopped and restarted to pause your experience.
If you DELETE your lab, you will remove all of the virtual machines in your classroom and lose all of your progress.