Re: To disable the internet and allow only SSH connection to this server running Red Hat Enterprise Linux release 8.9 (Ootpa)

--0000000000002bfc570617fd6ba0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Thu, 9 May 2024, 05:27 Rajiv Baxi, <[email protected]> wrote:

> You don't want to block DNS lookups and outbound ping. Also, NTP is prett=
y
> important as well and I would add a rule to allow outbound NTP traffic.
>
> So, you could deny everything except for inbound SSH and outbound DNS,
> ping, and NTP.
>
> Thanks,
>
> Rajiv Baxi
>


Thanks Rajiv for the detailed description.
Any example if you can share with us to understand it better.

Thanks in advance.

Best Regards,

Kaushal

>
>
>
> <http://www.avg.com/email-signature?utm_medium=3Demail&utm_source=3Dlink&=
utm_campaign=3Dsig-email&utm_content=3Dwebmail>
> Virus-free.www.avg.com
> <http://www.avg.com/email-signature?utm_medium=3Demail&utm_source=3Dlink&=
utm_campaign=3Dsig-email&utm_content=3Dwebmail>
> <#m_-4279245655106018107_DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>
>
> On Fri, Mar 8, 2024 at 4:17=E2=80=AFAM Kaushal Shriyan <kaushalshriyan@gm=
ail.com>
> wrote:
>
>> Hi,
>>
>> I am running Red Hat Enterprise Linux release 8.9 (Ootpa). Is there a wa=
y
>> to disable the internet and allow only SSH connection to this server? I
>> have followed the below steps to disable internet access and allow only =
SSH
>> connections to the remote server.
>>
>> #systemctl stop NetworkManager
>> #systemctl disable NetworkManager
>>
>> #vim /etc/sysconfig/network-scripts/ifcfg-enp1s0
>>
>> TYPE=3DEthernet
>> PROXY_METHOD=3Dnone
>> BROWSER_ONLY=3Dno
>> BOOTPROTO=3Dnone
>> DEFROUTE=3Dyes
>> IPV4_FAILURE_FATAL=3Dyes
>> IPV6INIT=3Dyes
>> IPV6_AUTOCONF=3Dyes
>> IPV6_DEFROUTE=3Dyes
>> IPV6_FAILURE_FATAL=3Dno
>> IPV6_ADDR_GEN_MODE=3Deui64
>> NAME=3Denp1s0
>> UUID=3D86cea6e1-ec03-49e7-9d6d-1d1b9d094cdc
>> DEVICE=3Denp1s0
>> ONBOOT=3Dyes
>> IPADDR=3D192.168.0.114
>> PREFIX=3D24
>> GATEWAY=3D192.168.0.10
>> DNS1=3D8.8.8.8
>> DNS2=3D8.8.4.4
>> ZONE=3Ddrop
>>
>> # systemctl restart network
>> Failed to restart network.service: Unit network.service not found.
>> #
>>
>> #firewall-cmd --permanent --zone=3Dpublic --add-service=3Dssh
>> #firewall-cmd --permanent --zone=3Dpublic --remove-service=3Ddhcpv6-clie=
nt
>> #firewall-cmd --reload
>>
>> #vim /etc/sysctl.conf
>> net.ipv6.conf.all.disable_ipv6 =3D 1
>> net.ipv6.conf.default.disable_ipv6 =3D 1
>>
>> #sysctl -p
>>
>> ssh [email protected]
>>
>> ping google.com
>>
>>
>> I am still able to reach out to google.com
>>
>> # ping google.com
>> PING google.com (142.250.193.142) 56(84) bytes of data.
>> 64 bytes from maa05s25-in-f14.1e100.net (142.250.193.142): icmp_seq=3D1
>> ttl=3D57 time=3D10.5 ms
>> 64 bytes from maa05s25-in-f14.1e100.net (142.250.193.142): icmp_seq=3D2
>> ttl=3D57 time=3D10.1 ms
>> 64 bytes from maa05s25-in-f14.1e100.net (142.250.193.142): icmp_seq=3D3
>> ttl=3D57 time=3D10.7 ms
>> ^C
>> --- google.com ping statistics ---
>> 3 packets transmitted, 3 received, 0% packet loss, time 2003ms
>> rtt min/avg/max/mdev =3D 10.147/10.452/10.701/0.258 ms
>>
>> Please guide me. Thanks in advance.
>>
>> Best Regards,
>>
>> Kaushal
>>
>> --
>> You received this message because you are subscribed to the Google Group=
s
>> "[email protected]" group.
>> To unsubscribe from this group and stop receiving emails from it, send a=
n
>> email to [email protected].
>>
>

To unsubscribe from this group and stop receiving emails from it, send an e=
mail to [email protected].

--0000000000002bfc570617fd6ba0
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto"><div><br><br><div class=3D"gmail_quote"><div dir=3D"ltr" =
class=3D"gmail_attr">On Thu, 9 May 2024, 05:27 Rajiv Baxi, &lt;<a href=3D"m=
ailto:[email protected]">[email protected]</a>&gt; wrote:<br></di=
v><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:=
1px #ccc solid;padding-left:1ex"><div dir=3D"ltr">You don&#39;t want to blo=
ck DNS lookups and outbound ping. Also, NTP is pretty important as well and=
 I would add a rule to allow outbound NTP traffic.<div><br></div><div>So, y=
ou could deny everything except for inbound SSH and outbound DNS, ping, and=
 NTP.<br><div><br clear=3D"all"><div><div dir=3D"ltr" class=3D"gmail_signat=
ure" data-smartmail=3D"gmail_signature">Thanks,<div><br></div><div>Rajiv Ba=
xi</div></div></div></div></div></div></blockquote></div></div><div dir=3D"=
auto"><br></div><div dir=3D"auto"><br></div><div dir=3D"auto">Thanks Rajiv =
for the detailed description.</div><div dir=3D"auto">Any example if you can=
 share with us to understand it better.</div><div dir=3D"auto"><br></div><d=
iv dir=3D"auto">Thanks in advance.</div><div dir=3D"auto"><br></div><div di=
r=3D"auto">Best Regards,</div><div dir=3D"auto"><br></div><div dir=3D"auto"=
>Kaushal=C2=A0</div><div dir=3D"auto"><div class=3D"gmail_quote"><blockquot=
e class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc sol=
id;padding-left:1ex"><div dir=3D"ltr"><div><div><br></div></div></div><div =
id=3D"m_-4279245655106018107DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2"><br><tabl=
e style=3D"border-top:1px solid #d3d4de"><tbody><tr><td style=3D"width:55px=
;padding-top:13px"><a href=3D"http://www.avg.com/email-signature?utm_medium=
=3Demail&amp;utm_source=3Dlink&amp;utm_campaign=3Dsig-email&amp;utm_content=
=3Dwebmail" target=3D"_blank" rel=3D"noreferrer"><img src=3D"https://s-inst=
all.avcdn.net/ipm/preview/icons/icon-envelope-tick-green-avg-v1.png" alt=3D=
"" width=3D"46" height=3D"29" style=3D"width:46px;height:29px"></a></td><td=
 style=3D"width:470px;padding-top:12px;color:#41424e;font-size:13px;font-fa=
mily:Arial,Helvetica,sans-serif;line-height:18px">Virus-free.<a href=3D"htt=
p://www.avg.com/email-signature?utm_medium=3Demail&amp;utm_source=3Dlink&am=
p;utm_campaign=3Dsig-email&amp;utm_content=3Dwebmail" style=3D"color:#4453e=
a" target=3D"_blank" rel=3D"noreferrer">www.avg.com</a></td></tr></tbody></=
table><a href=3D"#m_-4279245655106018107_DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FD=
F2" width=3D"1" height=3D"1" rel=3D"noreferrer"></a></div><br><div class=3D=
"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Fri, Mar 8, 2024 at =
4:17=E2=80=AFAM Kaushal Shriyan &lt;<a href=3D"mailto:kaushalshriyan@gmail.=
com" target=3D"_blank" rel=3D"noreferrer">[email protected]</a>&gt; =
wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0=
px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir=
=3D"ltr">Hi,<br><div><br></div><div>I am running Red Hat Enterprise Linux r=
elease 8.9 (Ootpa). Is there a way to disable the internet and allow only=
=C2=A0SSH connection to this server? I have followed the below steps to dis=
able internet access and allow only SSH connections to the remote server.</=
div><div><br>#systemctl stop NetworkManager<br>#systemctl disable NetworkMa=
nager<br><br>#vim /etc/sysconfig/network-scripts/ifcfg-enp1s0<br><br>TYPE=
=3DEthernet<br>PROXY_METHOD=3Dnone<br>BROWSER_ONLY=3Dno<br>BOOTPROTO=3Dnone=
<br>DEFROUTE=3Dyes<br>IPV4_FAILURE_FATAL=3Dyes<br>IPV6INIT=3Dyes<br>IPV6_AU=
TOCONF=3Dyes<br>IPV6_DEFROUTE=3Dyes<br>IPV6_FAILURE_FATAL=3Dno<br>IPV6_ADDR=
_GEN_MODE=3Deui64<br>NAME=3Denp1s0<br>UUID=3D86cea6e1-ec03-49e7-9d6d-1d1b9d=
094cdc<br>DEVICE=3Denp1s0<br>ONBOOT=3Dyes<br>IPADDR=3D192.168.0.114<br>PREF=
IX=3D24<br>GATEWAY=3D192.168.0.10<br>DNS1=3D8.8.8.8<br>DNS2=3D8.8.4.4<br>ZO=
NE=3Ddrop<br><br># systemctl restart network<br>Failed to restart network.s=
ervice: Unit network.service not found.<br>#<br><br>#firewall-cmd --permane=
nt --zone=3Dpublic --add-service=3Dssh<br>#firewall-cmd --permanent --zone=
=3Dpublic --remove-service=3Ddhcpv6-client<br>#firewall-cmd --reload<br><br=
>#vim /etc/sysctl.conf<br>net.ipv6.conf.all.disable_ipv6 =3D 1<br>net.ipv6.=
conf.default.disable_ipv6 =3D 1<br><br>#sysctl -p<br><br>ssh <a href=3D"mai=
lto:[email protected]" target=3D"_blank" rel=3D"noreferrer">[email protected]=
.114</a><br><br>ping <a href=3D"http://google.com" target=3D"_blank" rel=3D=
"noreferrer">google.com</a><br><br><br>I am still able to reach out to <a h=
ref=3D"http://google.com" target=3D"_blank" rel=3D"noreferrer">google.com</=
a><br><br># ping <a href=3D"http://google.com" target=3D"_blank" rel=3D"nor=
eferrer">google.com</a><br>PING <a href=3D"http://google.com" target=3D"_bl=
ank" rel=3D"noreferrer">google.com</a> (142.250.193.142) 56(84) bytes of da=
ta.<br>64 bytes from <a href=3D"http://maa05s25-in-f14.1e100.net" target=3D=
"_blank" rel=3D"noreferrer">maa05s25-in-f14.1e100.net</a> (142.250.193.142)=
: icmp_seq=3D1 ttl=3D57 time=3D10.5 ms<br>64 bytes from <a href=3D"http://m=
aa05s25-in-f14.1e100.net" target=3D"_blank" rel=3D"noreferrer">maa05s25-in-=
f14.1e100.net</a> (142.250.193.142): icmp_seq=3D2 ttl=3D57 time=3D10.1 ms<b=
r>64 bytes from <a href=3D"http://maa05s25-in-f14.1e100.net" target=3D"_bla=
nk" rel=3D"noreferrer">maa05s25-in-f14.1e100.net</a> (142.250.193.142): icm=
p_seq=3D3 ttl=3D57 time=3D10.7 ms<br>^C<br>--- <a href=3D"http://google.com=
" target=3D"_blank" rel=3D"noreferrer">google.com</a> ping statistics ---<b=
r>3 packets transmitted, 3 received, 0% packet loss, time 2003ms<br>rtt min=
/avg/max/mdev =3D 10.147/10.452/10.701/0.258 ms<br><br>Please guide me. Tha=
nks in advance.=C2=A0<br><br>Best Regards,<br><br>Kaushal<br></div></div>

<p></p>

-- <br>
You received this message because you are subscribed to the Google Groups &=
quot;<a href=3D"mailto:[email protected]" target=3D"_blank" rel=3D"nor=
eferrer">[email protected]</a>&quot; group.<br>
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:[email protected]" target=3D"_bl=
ank" rel=3D"noreferrer">[email protected]</a>.<br>
</blockquote></div>
</blockquote></div></div></div>

<p></p>

To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:[email protected]">redhat-list+u=
[email protected]</a>.<br />

--0000000000002bfc570617fd6ba0--