Exercise: Runtime, permanent and temporary rules

Watch the two stores part company: a runtime rule that a reload erases, a permanent rule that does nothing until it is loaded, a temporary rule that expires, and a test rule that gets saved by accident.

Runtime, permanent and temporary rules

Show that a runtime rule is lost on reload.
Use --timeout for a temporary rule.
Explain what --runtime-to-permanent saves.

Start the exercise

On workstation, start the exercise. It installs httpd on servera with the page hello from servera and starts it.

[student@workstation ~]$ lab start sa-fw-stores

Later tasks assume that you are logged in to the server they name: ssh student@servera from workstation, then sudo -i for a root shell.

A runtime rule

Allow http without --permanent. Compare the runtime and permanent lists, test from serverb, then reload and test again.

[root@servera ~]# firewall-cmd --add-service=http
success
[root@servera ~]# firewall-cmd --list-services; firewall-cmd --permanent --list-services
cockpit dhcpv6-client http ssh
cockpit dhcpv6-client ssh
[student@serverb ~]$ curl -s -m 3 http://servera/
hello from servera
[root@servera ~]# firewall-cmd --reload
success
[student@serverb ~]$ curl -sS -m 3 http://servera/
curl: (7) Failed to connect to servera port 80: No route to host

The reload replaced the runtime state with the saved one, where http was never written.

A permanent rule that is not loaded yet

Add http with --permanent only. Is port 80 open now? Then reload and check again.

[root@servera ~]# firewall-cmd --permanent --add-service=http
success
[root@servera ~]# firewall-cmd --query-service=http; firewall-cmd --permanent --query-service=http
no
yes
[root@servera ~]# firewall-cmd --reload
success
[root@servera ~]# firewall-cmd --query-service=http
yes

A temporary rule

Open 8080/tcp for 30 seconds with --timeout, list the ports, wait, and list again. (httpd does not listen on 8080 yet; you are only watching the rule.)

[root@servera ~]# firewall-cmd --add-port=8080/tcp --timeout=30
success
[root@servera ~]# firewall-cmd --list-ports
8080/tcp
[root@servera ~]# sleep 32; firewall-cmd --list-ports
[root@servera ~]#

The runtime-to-permanent trap

Open 8080/tcp for 300 seconds, then run --runtime-to-permanent. Look at the saved ports. Remove the port from both stores again.

[root@servera ~]# firewall-cmd --add-port=8080/tcp --timeout=300
success
[root@servera ~]# firewall-cmd --runtime-to-permanent
success
[root@servera ~]# firewall-cmd --permanent --list-ports
8080/tcp
[root@servera ~]# firewall-cmd --permanent --remove-port=8080/tcp; firewall-cmd --reload
success
success

The "temporary" test port became permanent. That is why you read --list-all first.

Survive a reboot

Reboot servera. After it comes back, is http still allowed and does serverb still get the page?

[root@servera ~]# systemctl reboot
[student@workstation ~]$ ssh student@servera
[student@servera ~]$ sudo firewall-cmd --list-services
cockpit dhcpv6-client http ssh
[student@serverb ~]$ curl -s -m 3 http://servera/
hello from servera

Grade and finish

Check your work with lab grade sa-fw-stores, then put the exercise away with lab finish sa-fw-stores.