Close the door, then try the handle
Your test found an open door: a desk can reach the telnet service on the management server. You close it with a firewall (a tool that blocks some messages) rule.
But how do you know the door is really shut, and that you did not lock the front door at the same time? You try the handle, and you try the front door too.
By the end of this lesson
Note
I can block a service with a firewall rule and prove with tests that the fix works and breaks nothing.
Key words
| Word | What it means |
|---|---|
| Firewall | a device or program that blocks some messages and lets others through |
| Rule | one line that says what the firewall does with a kind of message |
| Allow | let a message through |
| Drop | throw a message away without telling the sender |
| Default deny | block everything unless a rule allows it |
| Port | a numbered door on a device where one service listens |
| Network | computers and devices joined together so they can share data |
| Router | a device that passes messages from one network to another |
The cells students fill in are left blank in this preview.
Starter
Have a go
Starter
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
This is practice
Important
The real task gives you its own devices and settings screens. Here you use real commands in a lab. The method is the same: choose the smallest fix, give a reason, then test the fix and everything near it.
If nft is not found
Tip
These commands use nft, the Linux firewall tool. If your lab says the command is not found, install it with sudo apt-get install -y nftables, or ask your teacher to use the nat-gateway lab for this lesson.
Set up: routes out and back, part one
sudo ip netns exec r1 ip route replace 10.0.99.0/24 via 10.0.12.2; sudo ip netns exec r1 ip route replace 10.0.3.0/24 via 10.0.12.2A command for the lesson’s lab terminal. It is shown here and not run.
Set up: routes out and back, part two
sudo ip netns exec r2 ip route replace 10.0.1.0/24 via 10.0.12.1A command for the lesson’s lab terminal. It is shown here and not run.
Set up: start two services on the server
sudo ip netns exec mgmt bash -c "nc -l -p 23 -k >/dev/null 2>&1 & nc -l -p 80 -k >/dev/null 2>&1 &"A command for the lesson’s lab terminal. It is shown here and not run.