RHCSA Rapid Track

The netfilter framework enables kernel modules to inspect every packet that traverses the system, including all incoming, outgoing, or forwarded network packets.

The firewalld service simplifies management by classifying all network traffic into zones. Each zone has its own list of ports and services. The public zone is set as the default zone.

The firewalld service ships with predefined services. You can list these services by using the firewall-cmd --get-services command.

SELinux policy controls network traffic by labeling the network ports. For example, the ssh_port_t label is associated with the 22/TCP port. When a process wants to listen on a port, SELinux verifies whether the port's associated label is allowed to bind that port label.

Use the semanage command to add, delete, and modify labels.