Step-by-Step Guide to Configuring Linux Firewall, Web Server, and SSH Access

Experiment Environment

Four virtual machines are used: a firewall node with three NICs (ens33, ens36, ens37), an external network simulator (ens37), a web server (ens36), and an internal PC for testing (NAT mode).

Network Interface Configuration

Duplicate the existing NIC configuration files to set up the additional interfaces:

cd /etc/sysconfig/network-scripts/
cp -p ifcfg-ens33 ifcfg-ens36
cp -p ifcfg-ens33 ifcfg-ens37

Adjust ifcfg-ens33, ifcfg-ens36, and ifcfg-ens37 as needed for each machine’s IP addressing.

Enable IP Forwarding on the Firewall

vim /etc/sysctl.conf
# add or uncomment the line
net.ipv4.ip_forward = 1
sysctl -p

After reloading, the firewall can route traffic between zones.

Testing Basic Connectivity

Ping and traceroute commands confirm that the firewall routes packets correctly before any rules are applied.

Web Server Setup

Install Apache HTTPD and create a simple test page:

yum install -y httpd
echo testsmqnz > /var/www/html/index.html
curl 127.0.0.1

Configure the firewall’s DMZ zone to allow HTTP/HTTPS traffic:

firewall-cmd --zone=dmz --change-interface=ens33
firewall-cmd --zone=dmz --add-port=80/tcp --permanent
firewall-cmd --zone=dmz --add-port=443/tcp --permanent
firewall-cmd --reload

After reloading, internal PCs can reach the web server.

Blocking ICMP Ping to the Web Server

firewall-cmd --zone=dmz --add-icmp-block=echo-request --permanent
firewall-cmd --reload

Verification shows that ping requests are dropped while HTTP traffic still works.

SSH Port Remapping

First, disable the default SSH service in the DMZ zone and change the SSH daemon port to 12345 on the web server:

# Remove default SSH service
firewall-cmd --zone=dmz --remove-service=ssh --permanent
firewall-cmd --reload
# Edit SSH config
vim /etc/ssh/sshd_config
Port 12345
systemctl restart sshd
# Open the new port in the firewall
firewall-cmd --zone=dmz --add-port=12345/tcp --permanent
firewall-cmd --reload

Test the new SSH access from the internal PC:

ssh [email protected] -p 12345

External SSH Access to the Firewall

Modify the firewall’s own SSH daemon to listen on the same custom port and open it in the external zone:

vim /etc/ssh/sshd_config
Port 12345
systemctl restart sshd
firewall-cmd --zone=external --add-port=12345/tcp --permanent
firewall-cmd --reload

Confirm the service is listening: netstat -nultp | grep sshd External users can now connect:

ssh [email protected] -p 12345

Conclusion

The guide demonstrates how to build a multi‑zone Linux firewall, expose a web service securely, block unwanted ICMP traffic, and relocate SSH to a non‑standard port for both internal and external access, providing a solid foundation for network security hardening.