How to Install and Setup FireWall on Amazon Linux 2

Mohammad Abu MattarPublished: 24 Oct, 202202 Mins read03 Mins listen

Markdown for AI

Introduction

This tutorial covers installing and configuring firewalld on Amazon Linux 2, including setting the default zone and managing services and ports.

Prerequisites

To follow along with this tutorial, you will need:

An Amazon Linux 2 EC2 instance with a public IP address.
A user with sudo privileges.

Install and set up firewalld on Amazon Linux 2

Step 1: install firewalld

Before we can install firewalld, we must first update the system.

1
# Update the system
2
sudo yum update -y

Now that the system has been updated, we can install firewalld.

1
# Install FireWall
2
sudo yum install firewalld -y

Next, after installing firewalld, it’s time to verify whether the iptables service is running.

1
# Check if the iptables service is running
2
sudo systemctl status iptables

If the iptables service is running, we need to stop it.

1
# Stop the iptables service
2
sudo systemctl stop iptables

Now that the iptables service is stopped, we can start the firewalld service.

1
# Start the FireWall service
2
sudo systemctl start firewalld

To verify that the firewalld service is running, we can use the following command.

1
# Check if the FireWall service is running
2
sudo systemctl status firewalld

A newly installed firewalld service is not enabled at boot by default. To enable it, we can use the following command.

1
# Enable the FireWall service
2
sudo systemctl enable firewalld

Step 2: configure firewalld

Now that the firewalld service is running, we can configure it. Allow HTTP, HTTPS, and SSH in the public zone, then reload.

1
# Configure the FireWall service
2
sudo firewall-cmd --permanent --zone=public --add-service=http
3
sudo firewall-cmd --permanent --zone=public --add-service=https
4
sudo firewall-cmd --permanent --zone=public --add-service=ssh
5
sudo firewall-cmd --reload

To list the zones firewalld ships with:

1
# List Firewalld Zones
2
sudo firewall-cmd --get-zones

To list the predefined services firewalld knows about:

1
# List Services Default Zone
2
sudo firewall-cmd --get-services

To verify that the default zone is configured the way we expect, we can use the following command.

1
# Check the FireWall service configuration
2
sudo firewall-cmd --list-all

To dump the full configuration of every zone at once:

1
# List All Firewalld Zones
2
sudo firewall-cmd --list-all-zones

Step 3: set the default firewalld zone

To set the default firewalld zone, we can use the following command.

1
# Set up the default Firewalld zone
2
sudo firewall-cmd --set-default-zone=public

Step 4: check the firewall status

To check the firewalld status, we can use the following command.

1
# Check the FireWall status
2
sudo firewall-cmd --state

Step 5: assigning services to firewalld zones

Before we assign services to a zone, let’s check that firewalld is running and see which zones are currently active.

1
# Assign services to Firewalld zones
2
firewall-cmd --state
3
firewall-cmd --get-active-zones

Step 6: adding services to firewalld zones

To add and remove services and ports on a zone, we can use the following commands.

1
# Add services to Firewalld zones
2
firewall-cmd --add-service=rtmp
3

4
# Remove services from Firewalld zones
5
firewall-cmd --zone=public --remove-service=rtmp
6

7
# add port to zone
8
firewall-cmd --zone=public --add-port=80/tcp --permanent
9

10
# remove port from zone
11
firewall-cmd --zone=public --remove-port=80/tcp --permanent