CertGrid CertGrid
Hands-on Lab·LPIC-2

Firewall zones, and what a scan reveals

Topic 212 is weight 14, the largest on the 202 paper, and packet filtering is most of it. This guide reads the nftables ruleset firewalld actually writes, works through zones and a rich rule that restricts by source address, and then scans both servers from the client - where the same ports report differently depending on whether anything filtered them.

202: System Security Guide 13 of 29 Intermediate

Both servers and the client. Firewall state is read on the servers; the scan runs from the client, which is the only place it means anything.
Server NameIP AddressOSRolesCPURAMHDD
LPIC2-A01192.168.0.78Ubuntu 26.04 LTSPrimary service host - BIND, Apache, Samba, Postfix. Topic 204 RAID runs on loop devices; this machine has no spare disk2 Core4 GB50 GB
LPIC2-B01192.168.0.79AlmaLinux 10.2Second service host - nginx, NFS, DNS secondary, and the other family's spelling of each service2 Core4 GB50 GB
LPIC2-C01192.168.0.80Ubuntu 26.04 LTSClient - resolves, mounts and connects, so every service is proven from a machine that is not running it2 Core4 GB50 GB

This guide includes

Use this for the largest topic on the 202 paper. This matters because zones apply policy by source rather than only by port - the idea that separates firewalld from a plain list of rules.

Before you start

  1. What firewalld is actually writing

  2. Zones apply policy by source, not only by port

  3. A rich rule, which restricts by source

  4. Closed and filtered are not the same word

Official sources