RHCSA Practical Lab Series – Firewall Configuration & Security

CloudNetOps

28 Feb 2025 — 2 min read

🔍 Lab 3: Configuring Firewalld to Allow HTTP on Port 8080

📌 Objective

By default, firewalld blocks access to non-standard ports. In this lab, you will:

✔ Open port 8080 for Apache (httpd)
✔ Configure SELinux to allow HTTP traffic on port 8080
✔ Ensure firewall rules persist after reboot

📌 Step 1: Check Current Firewalld Rules

Before making changes, verify which ports are currently open:

[root@node1 ~]# firewall-cmd --list-all

🔹 Expected Output (partial):

public (active)
  target: default
  services: ssh dhcpv6-client http https
  ports:

📌 Tip: If port 8080 is not listed under ports:, it must be added.

📌 Step 2: Open Port 8080 in the Firewall

Allow HTTP traffic on port 8080 permanently:

[root@node1 ~]# firewall-cmd --permanent --add-port=8080/tcp

📌 Tip: The --permanent flag ensures the rule persists after a reboot.

📌 Step 3: Reload the Firewall Rules

Apply the changes:

[root@node1 ~]# firewall-cmd --reload

🔹 Verify the rule has been applied:

[root@node1 ~]# firewall-cmd --list-ports

🔹 Expected Output:

8080/tcp

✅ If port 8080 appears, the firewall is correctly configured.

📌 Step 4: Configure SELinux to Allow HTTP on Port 8080

🔹 Check current allowed HTTP ports:

[root@node1 ~]# semanage port -l | grep http

🔹 Expected Output (partial):

http_port_t                    tcp      80, 443, 488, 8008, 8009, 8443

📌 Port 8080 is not listed, so we need to add it.

📌 Step 5: Allow Apache to Use Port 8080 in SELinux

[root@node1 ~]# semanage port -a -t http_port_t -p tcp 8080

🔹 Verify that port 8080 has been added:

[root@node1 ~]# semanage port -l | grep 8080

🔹 Expected Output:

http_port_t                    tcp      80, 443, 488, 8008, 8009, 8080, 8443

✅ If port 8080 appears, SELinux has been updated correctly.

📌 Troubleshooting:

If the command fails, ensure SELinux is in enforcing mode:

getenforce

If semanage is not found, install the package:

yum -y install policycoreutils-python-utils

📌 Step 6: Restart Apache and Verify

🔹 Restart the Apache service to apply changes:

[root@node1 ~]# systemctl restart httpd

🔹 Enable Apache to start on boot:

[root@node1 ~]# systemctl enable httpd

📌 Step 7: Verify Web Server Accessibility

🔹 Check if Apache is listening on port 8080:

[root@node1 ~]# ss -tnlp | grep httpd

🔹 Expected Output:

LISTEN  0  128  *:8080  *:*  users:(("httpd",pid=1234,fd=5))

✅ If Apache is listening on port 8080, the configuration is correct.

📌 Step 8: Test Access to the Web Server

From node1, test HTTP access:

[root@node1 ~]# curl http://node1.cloudnetops.tech:8080/

🔹 Expected Output:

<html>
<head><title>Test Page</title></head>
<body><h1>Success! Apache is running on port 8080.</h1></body>
</html>

✅ If you receive the HTML response, the firewall and SELinux are correctly configured.

📌 Troubleshooting:

If the firewall rule was not applied, try restarting firewalld:

systemctl restart firewalld

If curl fails, check if httpd is running:

systemctl status httpd

✅ Final Summary

In this lab, you successfully:
✔ Opened port 8080 in firewalld
✔ Allowed Apache to serve content on port 8080
✔ Updated SELinux policy to allow HTTP on port 8080
✔ Restarted and enabled Apache
✔ Ensured the changes persist after reboot