Real Linux Troubleshooting Scenarios: Firewall Configuration and Management

Scenario 294: Firewall Service Not Running

Issue: The firewall service is not running, leading to insecure network access.

Troubleshooting Steps:

Check the status of the firewall service:

systemctl status firewalld

If the firewall service is not running, start it:

systemctl start firewalld

Enable the firewall service to start automatically on boot:

systemctl enable firewalld

Scenario 295: Incorrect Firewall Rules

Issue: Incorrect or missing firewall rules are causing network connectivity issues.

Troubleshooting Steps:

List the existing firewall rules:

firewall-cmd --list-all

Use the <span>firewall-cmd</span> command to add or modify rules:

firewall-cmd --add-port=80/tcp --permanent firewall-cmd --reload

Scenario 296: Necessary Ports Blocked

Issue: Necessary ports for services such as SSH or HTTP are blocked.

Troubleshooting Steps:

Check if the necessary ports are open:

firewall-cmd --list-ports

Open the required ports:

firewall-cmd --add-port=22/tcp --permanent  # Replace 22 with the required port firewall-cmd --reload

Scenario 297: Incorrect Zone Configuration

Issue: The system is in the wrong firewall zone, causing unexpected restrictions.

Troubleshooting Steps:

Identify the current zone:

firewall-cmd --get-active-zones

If necessary, change the zone:

firewall-cmd --set-default-zone=public

Scenario 298: Masquerade/NAT Issues

Issue: Network Address Translation (NAT) or masquerade is not functioning as expected.

Troubleshooting Steps:

Check if masquerade is enabled:

firewall-cmd --query-masquerade

If necessary, enable masquerade:

firewall-cmd --add-masquerade --permanent firewall-cmd --reload

Scenario 299: Invalid Service Configuration

Issue: Services are inaccessible due to incorrect or missing service configuration.

Troubleshooting Steps:

List the available services:

firewall-cmd --get-services

Add the service to the allowed list:

firewall-cmd --add-service=http --permanent firewall-cmd --reload

Scenario 300: Log Configuration

Issue: Insufficient firewall logging makes it difficult to track connection attempts.

Troubleshooting Steps:

Check the current log settings:

firewall-cmd --get-log-denied

If necessary, enable logging for denied packets:

firewall-cmd --set-log-denied=all firewall-cmd --reload

Scenario 301: IPv6 Firewall Issues

Issue: IPv6 connectivity issues due to incorrect firewall rule configuration.

Troubleshooting Steps:

Check the IPv6 firewall rules:

firewall-cmd --list-all --zone=public --ipv6

If necessary, adjust the IPv6 rules:

firewall-cmd --add-service=http --permanent --zone=public --ipv6 firewall-cmd --reload

Scenario 302: Complex Rule Configuration

Issue: Complex rules (rich rules) are not applied correctly.

Troubleshooting Steps:

Check the existing rich rules:

firewall-cmd --list-rich-rules

Add or modify rich rules as needed:

firewall-cmd --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" accept' --permanent firewall-cmd --reload

Scenario 303: Firewall Lockout

Issue: Misconfiguration leads to unexpected lockout from the server.

Troubleshooting Steps:

Access the server via console or other means.

Clear all firewall rules:

iptables -F ip6tables -F

Restart the firewall service:

systemctl restart firewalld