Advanced Linux Security Hardening: firewalld Rules & SELinux Contexts

Linux Security Hardening: firewalld Advanced Rules & SELinux Context Management

Preface: As a veteran sysadmin who has endured midnight security alerts, I share a production‑validated hardening plan to make your Linux systems rock‑solid.

Why Your Linux Server Might Still Be Exposed

Over 80% of incidents stem from misconfiguration. Many assume simple iptables rules suffice until a night‑time breach occurs.

Lesson Learned: A firewalld misconfiguration once allowed unauthorized Redis access, costing a company over $5 million.

firewalld Advanced Rules: From Basics to Mastery

Core Concept Re‑imagined

firewalld is not just a wrapper for iptables; it is a dynamic firewall manager based on zones.

# View active zones
firewall-cmd --get-active-zones

# View default zone
firewall-cmd --get-default-zone

Scenario 1: Web Server Hardening

Scenario: Expose HTTPS publicly, restrict management ports to specific IPs.

# Create custom zones
firewall-cmd --permanent --new-zone=webserver
firewall-cmd --permanent --new-zone=management

# Configure web zone
firewall-cmd --permanent --zone=webserver --add-service=https
firewall-cmd --permanent --zone=webserver --add-port=80/tcp

# Management zone allows only a subnet
firewall-cmd --permanent --zone=management --add-source=192.168.1.0/24
firewall-cmd --permanent --zone=management --add-port=22/tcp
firewall-cmd --permanent --zone=management --add-port=3306/tcp

# Apply changes
firewall-cmd --reload

Scenario 2: Power of Rich Rules

When simple rules fall short, rich rules step in.

# Limit SSH connection rate to mitigate brute‑force
firewall-cmd --permanent --add-rich-rule='\
rule service name="ssh" \
accept limit value="3/m"'

# Open a port only for a specific IP range during certain hours
firewall-cmd --permanent --add-rich-rule='\
rule family="ipv4" \
source address="10.0.0.0/8" \
port protocol="tcp" port="8080" \
accept'

# Log rejected FTP connections
firewall-cmd --permanent --add-rich-rule='\
rule service name="ftp" \
log prefix="FTP-REJECT: " level="warning" \
reject'

Advanced Tip: Managing Large IP Sets with IPSET

IPSET simplifies handling thousands of addresses.

# Create an IP set
firewall-cmd --permanent --new-ipset=blacklist --type=hash:ip

# Add malicious IPs
firewall-cmd --permanent --ipset=blacklist --add-entry=1.2.3.4
firewall-cmd --permanent --ipset=blacklist --add-entry=5.6.7.8

# Use the set in a rule
firewall-cmd --permanent --add-rich-rule='\
rule source ipset="blacklist" drop'

SELinux Context Management: Deep Defense

SELinux Mechanics Unveiled

SELinux enforces MAC; every process and file carries a security context label.

# Show file context
ls -Z /etc/passwd
# Example output: -rw-r--r--. root root system_u:object_r:passwd_file_t:s0 /etc/passwd

# Show process contexts
ps -eZ | grep httpd

Scenario 3: Web Service SELinux Configuration

Common Issue: Apache cannot read user‑home web files.

# Check SELinux status
sestatus

# List SELinux booleans for httpd
getsebool -a | grep httpd

# Allow Apache to access home directories
setsebool -P httpd_enable_homedirs on

# Set correct file context
semanage fcontext -a -t httpd_exec_t "/var/www/html/myapp(/.*)?"
restorecon -Rv /var/www/html/myapp/

Scenario 4: Custom Application SELinux Policy

Create a dedicated policy for a self‑developed binary.

# Generate a policy template
sepolicy generate --init /usr/local/bin/myapp

# Compile and install the policy
make -f /usr/share/selinux/devel/Makefile myapp.pp
semodule -i myapp.pp

# Assign file context
semanage fcontext -a -t myapp_exec_t "/usr/local/bin/myapp"
restorecon /usr/local/bin/myapp

SELinux Troubleshooting Tricks

# View SELinux denial logs
ausearch -m AVC -ts recent

# Analyze reasons with audit2why
ausearch -m AVC -ts recent | audit2why

# Generate an allow rule (use cautiously)
ausearch -m AVC -ts recent | audit2allow -M mypolicy
semodule -i mypolicy.pp

Production‑Grade Best Practices

1. Layered Defense Strategy

# Network layer – drop everything by default
firewall-cmd --set-default-zone=drop
firewall-cmd --permanent --zone=public --add-service=ssh
firewall-cmd --permanent --zone=public --add-rich-rule='\
rule family="ipv4" \
source address="!192.168.0.0/16" \
service name="ssh" \
limit value="2/m" \
accept'

# Application layer – tighten SELinux booleans
setsebool -P httpd_can_network_connect off
setsebool -P httpd_can_network_connect_db on

2. Automated Deployment Script

#!/bin/bash
configure_firewall() {
    systemctl enable firewalld
    systemctl start firewalld
    firewall-cmd --set-default-zone=drop
    firewall-cmd --permanent --zone=public --add-service=ssh
    firewall-cmd --reload
    echo "✅ Firewalld configuration complete"
}

configure_selinux() {
    setenforce 1
    sed -i 's/SELINUX=disabled/SELINUX=enforcing/' /etc/selinux/config
    setsebool -P allow_execheap off
    setsebool -P allow_execstack off
    echo "✅ SELinux configuration complete"
}

configure_firewall
configure_selinux

3. Monitoring & Alerting

# Create monitoring script
cat > /usr/local/bin/security_monitor.sh <<'EOF'
#!/bin/bash
# Check SELinux denials
DENIALS=$(ausearch -m AVC -ts today | wc -l)
if [ $DENIALS -gt 10 ]; then
    echo "⚠️  SELinux denials exceed threshold: $DENIALS"
    ausearch -m AVC -ts today | tail -5
fi
# Check firewalld status
if ! systemctl is-active firewalld >/dev/null; then
    echo "🚨 firewalld service is not running!"
fi
EOF
chmod +x /usr/local/bin/security_monitor.sh
# Add to cron (every 2 hours)
echo "0 */2 * * * /usr/local/bin/security_monitor.sh" | crontab -

Common Pitfalls & How to Avoid Them

Zone Mis‑binding

# Wrong: may affect wrong interface
firewall-cmd --zone=public --add-service=http

# Correct: verify active zones first
firewall-cmd --get-active-zones
firewall-cmd --zone=public --change-interface=eth0
firewall-cmd --zone=public --add-service=http

SELinux Context Reset

# Wrong: temporary change
chcon -t httpd_exec_t /var/www/myapp

# Correct: permanent policy
semanage fcontext -a -t httpd_exec_t /var/www/myapp
restorecon /var/www/myapp

Performance Optimization Tips

Rule Order Optimization: Place frequently matched rules first.

Use IPSET: Improves performance when handling large IP lists.

SELinux Caching: Persist boolean settings with setsebool -P.

Effect Verification

After deployment, run security scans to confirm the hardening.

# Nmap scan
nmap -sS -O target_ip

# Lynis audit
lynis audit system

Conclusion

By combining firewalld's advanced rule set with fine‑grained SELinux context management, we achieve a multi‑layered defense that has proven effective in production, mitigating the vast majority of common attacks.

Remember: Security hardening is an ongoing process; regular reviews and updates are essential.