Secure server with Firewalld

Recently we have issue reported by development team that there one of the backend cache server went to production without firewall. Although server was not expose to internet but it can be accessible from every IP in intranet.

We decided to use firewalld for this. Main problem was once we start service it stop all access other than ssh which can be impact service accessing to our server. Also we can't run firewall-cmd command to apply rule before staring service.

Fortunately firewalld provide option to apply rules by updating config xml files.  Its makes our task easy.  Steps to be perform task

1. Generate xml rules in test machine.
2. Copy xml rules file in target host
3.  update rules in XML file then start service.

## Login to any test VM
$ ssh  

## Verify there is no custom added rule exist
$ cat /etc/firewalld/zones/public.xml
<?xml version="1.0" encoding="utf-8"?>
<zone>
  <short>Public</short>
  <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
  <service name="ssh"/>
  <service name="dhcpv6-client"/>
</zone>
## start firewalld service
$ systemctl restart firewalld
## Add rules to allow mysql port 3301
$ firewall-cmd --zone=public --add-rich-rule "rule family="ipv4" source address="192.168.1.2" port port=3301 protocol=tcp accept"
$ firewall-cmd --runtime-to-permanent

## Verify if rules added
cat /etc/firewalld/zones/public.xml

## Copy rules to target host
$ scp /etc/firewalld/zones/public.xml root@192.168.1.1:/etc/firewalld/zones/public.xml

# Login to targer host
$ ssh root@192.168.1.1
# Verify XML file
$ /etc/firewalld/zones/public.xml
# start service
$ systemctl start firewalld