Automate Firewall Rules in Linux

[@Tintak_hatpin]

I love these small and helpful videos, the knowledge will be helpful for years.

[@theurbanpenguin]

Glad you like them, thank you

[@othernicksweretaken]

That is exactly how I build up script blocks by fiddling with filters interactively in a shell until I get the matches that I require, and then loop over it or make the thus generated line noise a bit more tangible and comprehensible by my sysadmin colleagues by putting the stuff in functions or intermediary variables. However, if the pipes get too messy I might compact it by switching to awk, perl or python.

[@theurbanpenguin]

excellent

[@LVusaAPI]

Hey Andrew would love to see more of fw content

[@pbezunartea]

Wouldn't the "drop" zone be used rather than the "block" zone? I'd give the potential attackers a timeout in their connection rather than a clear rejection...

[@timmy.gunner]

*Hi Andrew is all this FW automation possible through Ansible / puppet /chief ?*

[@theurbanpenguin]

You can configure firewalls with Ansible but as it sets the desired state it is hard to specify the IPs you want to block. Using Fail2Ban you can install and configure with Ansible and Fail2Ban does all of the work for you

[@pokibali]

You could possibly run the command and register the output, then loop through it using the firewalld module, I wonder if that would make sense?

[@HumbleHuman-k7g]

Thanks for sharing your knowledges, I wonder why you stack on REL clones and don’t move on up to date distribution like Fedora Linux or OnenSuse Linux ?

[@kaliroot6756]

I do not know how familiar you are with linux distributions, but you do not choose Rhel or Rhel like oses (Alma, Rocky, Cloud) cause you want the newest and greatest software. You normaly choose it cause those distributions are very stable. - Fedora is like a Playground, before most features come to RHEL its in a "beta" like fedora release - OpenSUSE is something diffrent, it is like fedora but for SLES(SUSE Enterprise Linux Server)

[@othernicksweretaken]

Maybe he is working like me for a company or authority where your customers force you to e.g. run Oracle, SAP, JBoss, OpenShift etc. where you virtually end up on RHEL. On my private laptop I too prefer running Fedora. I am also glad that Rocky and Alma continue with a replacement for the discontinued (2024) CentOS (not CentOS Stream).

[@SpojlerSSJ]

That was very interesting. Good job...

[@theurbanpenguin]

Thank you

[@s.sje495]

Hi Andrew, create Video, is it possible to implement a if statement to prevent block my own access by typing a wrong password or any kinds of typo

[@theurbanpenguin]

you could add a simple grep -v as the final command in the pipleline

[@isoslimak]

Great, you will block yourself if you misspell your username while logging in.

[@theurbanpenguin]

I use keys

[@home-lab]

You could use an extra grep -v to make sure you are not locked out.

[@PlanetCypher_]

👍

[@djengines]

Who leaves ssh open 🤣

[@theurbanpenguin]

For public classes that use SSH

[@home-lab]

How else to manage your (remote) server?

[@djengines]

@@home-lab when I said open I meant open to the Internet.

[@othernicksweretaken]

Maybe one could open it on demand through some port knocking pattern.

[@timmy.gunner]

1st again 😊