Just as a firewall in a building attempts to prevent a fire from
spreading, a computer firewall attempts to prevent computer viruses from
spreading to your computer and to prevent unauthorized users from
accessing your computer. A firewall exists between your computer and the
network. It determines which services on your computer remote users on the
network can access. A properly configured firewall can greatly increase
the security of your system. It is recommended that you configure a
firewall for any Red Hat Enterprise Linux system with an Internet connection.
During the Firewall Configuration screen of the
Red Hat Enterprise Linux installation, you were given the option to enable a basic
firewall as well as to allow specific devices, incoming services, and
ports.
After installation, you can change this preference by using the
Security Level Configuration Tool.
To start the application, select (on
the Panel) => =>
or type the command
system-config-securitylevel from a shell prompt (for
example, in an XTerm or a
GNOME terminal).
 | Note |
|---|
| | The
Security Level Configuration Tool only configures a basic
firewall. If the system needs more complex rules, refer to the
Red Hat Enterprise Linux Reference Guide for details on configuring specific
iptables rules.
|
Select one of the following options:
Disable firewall — Disabling the
firewall provides complete access to your system and does no
security checking. Security checking is the disabling of access to
certain services. This should only be selected if you are running
on a trusted network (not the Internet) or plan to do more
firewall configuration later.
 | Warning |
|---|
| | If you have a firewall configured or any customized firewall
rules in the /etc/sysconfig/iptables file,
the file is deleted by selecting Disable
firewall and clicking OK to
save the changes.
|
Enable firewall — This option
configures the system to reject incoming connections that are not
in response to outbound requests, such as DNS replies or DHCP
requests. If access to services running on this machine is needed,
you can choose to allow specific services through the
firewall.
If you are connecting your system to the Internet, but do not
plan to run a server, this is the safest choice.
Enabling options in the Trusted services list
allows the specified service to pass through the firewall.
- WWW (HTTP)
The HTTP protocol is used by Apache (and by other Web
servers) to serve webpages. If you plan on making your Web
server publicly available, enable this option. This option is
not required for viewing pages locally or for developing
webpages. You must have the httpd package
installed to serve webpages.
Enabling WWW (HTTP) will not open a
port for HTTPS, the SSL version of HTTP.
- FTP
The FTP protocol is used to transfer files between machines
on a network. If you plan on making your FTP server publicly
available, enable this option. The vsftpd
package must be installed for this option to be useful.
- SSH
Secure Shell (SSH) is a suite of tools for logging into and
executing commands on a remote machine. To allow remote access
to the machine via ssh, enable this option. The
openssh-server package must be installed to
access your machine remotely using SSH tools.
- Telnet
Telnet is a protocol for logging into remote machines.
Telnet communications are unencrypted and provide no security
from network snooping. Allowing incoming Telnet access is not
recommended. To allow inbound Telnet access, you must have the
telnet-server package installed.
- Mail (SMTP)
To allow incoming mail delivery through your firewall so
that remote hosts can connect directly to your machine to
deliver mail, enable this option. You do not need to enable this
if you collect your mail from your ISP's server using POP3 or
IMAP, or if you use a tool such as fetchmail.
Note that an improperly configured SMTP server can allow remote
machines to use your server to send spam.
Selecting any of the Trusted devices allows
access to your system for all traffic from that device; it becomes
excluded from the firewall rules. For example, if you are running a
local network, but are connected to the Internet via a PPP dialup, you
can check eth0 and any traffic coming from your
local network is allowed. Selecting eth0 as
trusted means all traffic over the Ethernet is allowed, but the
ppp0 interface is still firewalled. To restrict
traffic on an interface, leave it unchecked.
You may have noticed a sit0 device in the
Trusted devices section. This device stands for
simple internet transition, which encapsulates IPv6 traffic into IPv4
traffic, and then is tunneled. For basic firewall rules, this device
can be ignored and left as an untrusted device.
 | Important |
|---|
| | It is not recommended that you make any device that is connected
to public networks, such as the Internet, a Trusted
device.
|
The Security Level Configuration Tool includes the
Other ports section for adding custom IP ports to
become trusted by iptables. For example, to allow
NFS, IRC, and Internet printing protocol (IPP) to be allowed to pass
through the firewall, the following would be inserted in the
Other ports section:
2049:tcp,194:tcp,631:tcp
Click OK to save the changes and enable or
disable the firewall. If Enable firewall was
selected, the options selected are translated to
iptables commands and written to the
/etc/sysconfig/iptables file. The
iptables service is also started so that the
firewall is activated immediately after saving the selected options.
If Disable firewall was selected, the
/etc/sysconfig/iptables file is removed and the
iptables service is stopped immediately.
The options selected are also written to the
/etc/sysconfig/system-config-securitylevel file
so that the settings can be restored the next time the application is
started. Do not edit this file by hand.
Even though the firewall is activated immediately, the
iptables service is not configured to start
automatically at boot time refer to Section 19.2 Activating the iptables Service for details.
