Re: To disable the internet and allow only SSH connection to this server running Red Hat Enterprise Linux release 8.9 (Ootpa)

--0000000000002d32630617fa108a
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

You don't want to block DNS lookups and outbound ping. Also, NTP is pretty
important as well and I would add a rule to allow outbound NTP traffic.

So, you could deny everything except for inbound SSH and outbound DNS,
ping, and NTP.

Thanks,

Rajiv Baxi


<http://www.avg.com/email-signature?utm_medium=3Demail&utm_source=3Dlink&ut=
m_campaign=3Dsig-email&utm_content=3Dwebmail>
Virus-free.www.avg.com
<http://www.avg.com/email-signature?utm_medium=3Demail&utm_source=3Dlink&ut=
m_campaign=3Dsig-email&utm_content=3Dwebmail>
<#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

On Fri, Mar 8, 2024 at 4:17=E2=80=AFAM Kaushal Shriyan <kaushalshriyan@gmai=
l.com>
wrote:

> Hi,
>
> I am running Red Hat Enterprise Linux release 8.9 (Ootpa). Is there a way
> to disable the internet and allow only SSH connection to this server? I
> have followed the below steps to disable internet access and allow only S=
SH
> connections to the remote server.
>
> #systemctl stop NetworkManager
> #systemctl disable NetworkManager
>
> #vim /etc/sysconfig/network-scripts/ifcfg-enp1s0
>
> TYPE=3DEthernet
> PROXY_METHOD=3Dnone
> BROWSER_ONLY=3Dno
> BOOTPROTO=3Dnone
> DEFROUTE=3Dyes
> IPV4_FAILURE_FATAL=3Dyes
> IPV6INIT=3Dyes
> IPV6_AUTOCONF=3Dyes
> IPV6_DEFROUTE=3Dyes
> IPV6_FAILURE_FATAL=3Dno
> IPV6_ADDR_GEN_MODE=3Deui64
> NAME=3Denp1s0
> UUID=3D86cea6e1-ec03-49e7-9d6d-1d1b9d094cdc
> DEVICE=3Denp1s0
> ONBOOT=3Dyes
> IPADDR=3D192.168.0.114
> PREFIX=3D24
> GATEWAY=3D192.168.0.10
> DNS1=3D8.8.8.8
> DNS2=3D8.8.4.4
> ZONE=3Ddrop
>
> # systemctl restart network
> Failed to restart network.service: Unit network.service not found.
> #
>
> #firewall-cmd --permanent --zone=3Dpublic --add-service=3Dssh
> #firewall-cmd --permanent --zone=3Dpublic --remove-service=3Ddhcpv6-clien=
t
> #firewall-cmd --reload
>
> #vim /etc/sysctl.conf
> net.ipv6.conf.all.disable_ipv6 =3D 1
> net.ipv6.conf.default.disable_ipv6 =3D 1
>
> #sysctl -p
>
> ssh [email protected]
>
> ping google.com
>
>
> I am still able to reach out to google.com
>
> # ping google.com
> PING google.com (142.250.193.142) 56(84) bytes of data.
> 64 bytes from maa05s25-in-f14.1e100.net (142.250.193.142): icmp_seq=3D1
> ttl=3D57 time=3D10.5 ms
> 64 bytes from maa05s25-in-f14.1e100.net (142.250.193.142): icmp_seq=3D2
> ttl=3D57 time=3D10.1 ms
> 64 bytes from maa05s25-in-f14.1e100.net (142.250.193.142): icmp_seq=3D3
> ttl=3D57 time=3D10.7 ms
> ^C
> --- google.com ping statistics ---
> 3 packets transmitted, 3 received, 0% packet loss, time 2003ms
> rtt min/avg/max/mdev =3D 10.147/10.452/10.701/0.258 ms
>
> Please guide me. Thanks in advance.
>
> Best Regards,
>
> Kaushal
>
> --
> You received this message because you are subscribed to the Google Groups=
 "
> [email protected]" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [email protected].
>

To unsubscribe from this group and stop receiving emails from it, send an e=
mail to [email protected].

--0000000000002d32630617fa108a
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">You don&#39;t want to block DNS lookups and outbound ping.=
 Also, NTP is pretty important as well and I would add a rule to allow outb=
ound NTP traffic.<div><br></div><div>So, you could deny everything except f=
or inbound SSH and outbound DNS, ping, and NTP.<br><div><br clear=3D"all"><=
div><div dir=3D"ltr" class=3D"gmail_signature" data-smartmail=3D"gmail_sign=
ature">Thanks,<div><br></div><div>Rajiv Baxi</div></div></div><br></div></d=
iv></div><div id=3D"DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2"><br><table style=
=3D"border-top:1px solid #d3d4de"><tr><td style=3D"width:55px;padding-top:1=
3px"><a href=3D"http://www.avg.com/email-signature?utm_medium=3Demail&amp;u=
tm_source=3Dlink&amp;utm_campaign=3Dsig-email&amp;utm_content=3Dwebmail" ta=
rget=3D"_blank"><img src=3D"https://s-install.avcdn.net/ipm/preview/icons/i=
con-envelope-tick-green-avg-v1.png" alt=3D"" width=3D"46" height=3D"29" sty=
le=3D"width: 46px; height: 29px;"></a></td><td style=3D"width:470px;padding=
-top:12px;color:#41424e;font-size:13px;font-family:Arial,Helvetica,sans-ser=
if;line-height:18px">Virus-free.<a href=3D"http://www.avg.com/email-signatu=
re?utm_medium=3Demail&amp;utm_source=3Dlink&amp;utm_campaign=3Dsig-email&am=
p;utm_content=3Dwebmail" target=3D"_blank" style=3D"color:#4453ea">www.avg.=
com</a></td></tr></table><a href=3D"#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2" =
width=3D"1" height=3D"1"></a></div><br><div class=3D"gmail_quote"><div dir=
=3D"ltr" class=3D"gmail_attr">On Fri, Mar 8, 2024 at 4:17=E2=80=AFAM Kausha=
l Shriyan &lt;<a href=3D"mailto:[email protected]">kaushalshriyan@gm=
ail.com</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"=
margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-lef=
t:1ex"><div dir=3D"ltr">Hi,<br><div><br></div><div>I am running Red Hat Ent=
erprise Linux release 8.9 (Ootpa). Is there a way to disable the internet a=
nd allow only=C2=A0SSH connection to this server? I have followed the below=
 steps to disable internet access and allow only SSH connections to the rem=
ote server.</div><div><br>#systemctl stop NetworkManager<br>#systemctl disa=
ble NetworkManager<br><br>#vim /etc/sysconfig/network-scripts/ifcfg-enp1s0<=
br><br>TYPE=3DEthernet<br>PROXY_METHOD=3Dnone<br>BROWSER_ONLY=3Dno<br>BOOTP=
ROTO=3Dnone<br>DEFROUTE=3Dyes<br>IPV4_FAILURE_FATAL=3Dyes<br>IPV6INIT=3Dyes=
<br>IPV6_AUTOCONF=3Dyes<br>IPV6_DEFROUTE=3Dyes<br>IPV6_FAILURE_FATAL=3Dno<b=
r>IPV6_ADDR_GEN_MODE=3Deui64<br>NAME=3Denp1s0<br>UUID=3D86cea6e1-ec03-49e7-=
9d6d-1d1b9d094cdc<br>DEVICE=3Denp1s0<br>ONBOOT=3Dyes<br>IPADDR=3D192.168.0.=
114<br>PREFIX=3D24<br>GATEWAY=3D192.168.0.10<br>DNS1=3D8.8.8.8<br>DNS2=3D8.=
8.4.4<br>ZONE=3Ddrop<br><br># systemctl restart network<br>Failed to restar=
t network.service: Unit network.service not found.<br>#<br><br>#firewall-cm=
d --permanent --zone=3Dpublic --add-service=3Dssh<br>#firewall-cmd --perman=
ent --zone=3Dpublic --remove-service=3Ddhcpv6-client<br>#firewall-cmd --rel=
oad<br><br>#vim /etc/sysctl.conf<br>net.ipv6.conf.all.disable_ipv6 =3D 1<br=
>net.ipv6.conf.default.disable_ipv6 =3D 1<br><br>#sysctl -p<br><br>ssh <a h=
ref=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a><=
br><br>ping <a href=3D"http://google.com" target=3D"_blank">google.com</a><=
br><br><br>I am still able to reach out to <a href=3D"http://google.com" ta=
rget=3D"_blank">google.com</a><br><br># ping <a href=3D"http://google.com" =
target=3D"_blank">google.com</a><br>PING <a href=3D"http://google.com" targ=
et=3D"_blank">google.com</a> (142.250.193.142) 56(84) bytes of data.<br>64 =
bytes from <a href=3D"http://maa05s25-in-f14.1e100.net" target=3D"_blank">m=
aa05s25-in-f14.1e100.net</a> (142.250.193.142): icmp_seq=3D1 ttl=3D57 time=
=3D10.5 ms<br>64 bytes from <a href=3D"http://maa05s25-in-f14.1e100.net" ta=
rget=3D"_blank">maa05s25-in-f14.1e100.net</a> (142.250.193.142): icmp_seq=
=3D2 ttl=3D57 time=3D10.1 ms<br>64 bytes from <a href=3D"http://maa05s25-in=
-f14.1e100.net" target=3D"_blank">maa05s25-in-f14.1e100.net</a> (142.250.19=
3.142): icmp_seq=3D3 ttl=3D57 time=3D10.7 ms<br>^C<br>--- <a href=3D"http:/=
/google.com" target=3D"_blank">google.com</a> ping statistics ---<br>3 pack=
ets transmitted, 3 received, 0% packet loss, time 2003ms<br>rtt min/avg/max=
/mdev =3D 10.147/10.452/10.701/0.258 ms<br><br>Please guide me. Thanks in a=
dvance.=C2=A0<br><br>Best Regards,<br><br>Kaushal<br></div></div>

<p></p>

-- <br>
You received this message because you are subscribed to the Google Groups &=
quot;<a href=3D"mailto:[email protected]" target=3D"_blank">redhat-lis=
[email protected]</a>&quot; group.<br>
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:[email protected]" target=3D"_bl=
ank">[email protected]</a>.<br>
</blockquote></div>

<p></p>

To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:[email protected]">redhat-list+u=
[email protected]</a>.<br />

--0000000000002d32630617fa108a--