Skip to main content
RunBook Academy

← All checklists in Linux

Before deploymentlinux-firewall

Checklist: Firewall readiness pre-deploy

23 items ·16 critical ·7 warn ·0 info

Use this checklist before promoting any host firewall change to production. Any critical failure must be resolved before deploy.

How to use this checklist

Run each command twice: once on the target host, and once from a known-good source outside it. The distinction matters more here than anywhere else in this course. A firewall check run locally reads the ruleset; only a check run from off the host proves what that ruleset actually does to arriving traffic.

Several commands are written so that no output is the pass condition - they print only the rules that are wrong. Any line they emit is a finding, and the line names the chain and rule handle you need to fix.

Record the output of each command against the change ticket. The ruleset you are promoting and the evidence that it behaves as intended belong in the same place, because the revert plan is only credible if someone can see what the previous state was.

A warn item does not block the deploy, but an unresolved warn is a decision someone has to own in writing.

Cluster nodes

Pacemaker clusters need more than the 5405/UDP that every guide names. Scope all of these to the ring subnet:

PortProtoServiceSymptom when blocked
5404-5412UDPCorosync / knet (one port per link)Membership loss; a single-port rule breaks the second ring only, so the cluster looks healthy until the first ring fails
2224TCPpcsdpcs status works on every node, but pcs host auth and pcs cluster start <node> time out
3121TCPpacemaker_remoteRemote and guest nodes report offline
21064TCPDLMGFS2/OCFS2 mounts hang rather than fail
112IP protoVRRP (keepalived)Split-brain VIP: both peers become MASTER
# nftables, ring subnet only
sudo nft add rule inet filter input ip saddr 10.0.0.0/24 udp dport 5404-5412 accept
sudo nft add rule inet filter input ip saddr 10.0.0.0/24 tcp dport 2224 accept
sudo nft add rule inet filter input ip saddr 10.0.0.0/24 tcp dport 3121 accept
sudo nft add rule inet filter input ip saddr 10.0.0.0/24 tcp dport 21064 accept
sudo nft add rule inet filter input ip saddr 10.0.0.0/24 ip protocol 112 accept

# firewalld ships the common set as one service
sudo firewall-cmd --permanent --add-service=high-availability

Confirm the real mcastport with corosync-cmapctl | grep mcastport rather than assuming 5405, and verify the result from a peer node. ss -lntup on the node shows the daemons listening whether or not the filter in front of them permits anything.

Sign-off

  • Operator: _________________ Date: ___________
  • Reviewer: ________________ Date: ___________

Critical16 items

  1. which nft iptables firewall-cmd ufw; ls /etc/nftables* /etc/firewalld/ /etc/ufw/
  2. nft list ruleset | grep -E 'hook input|policy (drop|accept)'; iptables -S INPUT | head -1; firewall-cmd --get-default-zone 2>/dev/null
  3. systemctl is-enabled nftables; grep -q '^flush ruleset' /etc/nftables.conf && nft -c -f /etc/nftables.conf && echo "nftables.conf: parses, flushes first"; ls /etc/iptables/rules.v4 2>/dev/null; firewall-cmd --state 2>/dev/null
  4. nft list ruleset | grep -A2 'dport 22'; iptables -L INPUT -n -v | grep 'dpt:22'
  5. sudo nft -j list ruleset | jq -r '.nftables[] | select(has("rule")) | .rule | select(any(.expr[]; has("accept"))) | select(any(.expr[]; (.match.left.payload.field? // "") == "dport")) | select(any(.expr[]; (.match.left.payload.field? // "") == "saddr") | not) | "chain=\(.chain) handle=\(.handle) comment=\(.comment // "-")"'
  6. pgrep -x keepalived >/dev/null && { sudo nft list ruleset | grep -qE '(ip protocol|meta l4proto) (112|vrrp)' || echo "FINDING: keepalived is running but no VRRP (protocol 112) accept rule exists"; }
  7. nft list ruleset | grep 'ct state established'; iptables -L INPUT -n -v | grep 'ESTABLISHED'
  8. nft list ruleset | grep -E 'iif(name)? "?lo"? .*accept'; iptables -S INPUT | grep -E '^-A INPUT -i lo'
  9. sudo nft -j list ruleset | jq -r '.nftables[] | select(has("rule")) | .rule | select(any(.expr[]; has("accept"))) | select(any(.expr[]; has("match")) | not) | "chain=\(.chain) handle=\(.handle) comment=\(.comment // "-")"'
  10. nmap -p- <host>
  11. ss -tlnp; nft list ruleset | grep dport
  12. nft list ruleset | grep -E '5404|5405'; sudo corosync-cmapctl | grep mcastport
  13. ss -lntp | grep 2224; nft list ruleset | grep 2224
  14. nft list ruleset | grep -E '5404|2224|3121|21064' | grep -c saddr
  15. ssh <peer> 'nc -zv -w3 <this-node> 2224; corosync-cfgtool -s; pcs cluster status'

Warning7 items

  1. sudo nft list ruleset | grep -qE 'icmp( type)? echo-request' || echo "FINDING: no ICMP echo-request accept - monitoring ping checks will report this host down"
  2. nft list ruleset | grep log
  3. sysctl net.netfilter.nf_conntrack_max; conntrack -C
  5. nft list ruleset | grep -E '^table (inet|ip6)'; nft list ruleset | grep -E 'ipv6-icmp|icmpv6' || echo "WARN: no ICMPv6 accept found - NDP and PMTUD will break"; ip6tables -S INPUT 2>/dev/null | head -1
  6. ls /var/backups/nftables.* /etc/nftables.conf.* 2>/dev/null
  7. ss -lntp | grep -E '3121|21064'; nft list ruleset | grep -E '3121|21064'