Hands-on Lab·LPIC-2
Firewall zones, and what a scan reveals
Topic 212 is weight 14, the largest on the 202 paper, and packet filtering is most of it. This guide reads the nftables ruleset firewalld actually writes, works through zones and a rich rule that restricts by source address, and then scans both servers from the client - where the same ports report differently depending on whether anything filtered them.
202: System Security Guide 13 of 29 Intermediate
- PlatformsUbuntu 26.04 LTS + AlmaLinux 10.2
- Block devicesone 50 GB disk
- TimeAbout 22 min
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| LPIC2-A01 | 192.168.0.78 | Ubuntu 26.04 LTS | Primary service host - BIND, Apache, Samba, Postfix. Topic 204 RAID runs on loop devices; this machine has no spare disk | 2 Core | 4 GB | 50 GB |
| LPIC2-B01 | 192.168.0.79 | AlmaLinux 10.2 | Second service host - nginx, NFS, DNS secondary, and the other family's spelling of each service | 2 Core | 4 GB | 50 GB |
| LPIC2-C01 | 192.168.0.80 | Ubuntu 26.04 LTS | Client - resolves, mounts and connects, so every service is proven from a machine that is not running it | 2 Core | 4 GB | 50 GB |
This guide includes
Use this for the largest topic on the 202 paper. This matters because zones apply policy by source rather than only by port - the idea that separates firewalld from a plain list of rules.
- reading what firewalld is actually writing, one layer below the tool you type at
- applying policy by source, with zones
- adding and removing a rich rule
- telling closed from filtered, on the same scan against two servers
Before you start
- what-stands-between-a-service-and-its-client
-
What firewalld is actually writing
-
Zones apply policy by source, not only by port
-
A rich rule, which restricts by source
-
Closed and filtered are not the same word