1

Has anyone tried or know if it is possible to also setup FirewallD for CentOS 7 when Google provides a default VPC Firewall for Compute Instances/VM's?

Or would this cause problems?

The reason I ask is it is much easier to manage IP blocking via a continually updated list of IP's through FirewallD versus having to add a new rule for every IP address to block with Googles default VPC Firewall.

To simplify and give context to what I'd like to do is I use Docker to host multiple websites on a single CentOS VM and these websites (mainly Drupal CMS sites) use a module called autoban where I have sets of rules to block malicious users from accessing the sites I host (for the most part mainly to keep users trying to break into non-existent WordPress paths and security vulnerabilities - as some of the sites I host get bombarded daily with a ridiculous amount of these requests).

The IP's are automatically blocked per each site, but it would be relatively easy to get those IP's merged into a single document on the host/CentOS from each websites container which could be used easier in FirewallD versus having to create complicated scripts (which would need more steps to generate new Google VPC Firewall rules or update existing ones) as the merged list of IP's gets updated.

I feel this would be a simpler solution and provide greater security across all the websites being hosted on the instance/VM.

However I don't just want to try and add FirewallD to CentOS if it will break things being Google already provides a firewall.

So any information anyone can provide here would be greatly appreciated, including any DO's and Don't do's!

I have not attempted this myself yet, I'm just curious if anyone has and any suggestions there may be to make this work.

Thank You...

sidgrafix
  • 21
  • 2

1 Answers1

0

The guest firewall is open to everything as it is on all default images for all Operating systems.

The GCP firewall takes precedence when VM security is involved.

For example: If user wants to block port 22 connections to the VPC network or to the specific target instance, can use GCP firewall rule applicable to the target resource, that way even if port 22 is open on the GCE instance, any connection on port 22 will not get through to reach the target VM instance.

Of course, users can also configure firewall rules/iptables at the instance level and change the default firewalld zone as well, depending upon the requirements.

Siegfred V.
  • 1,143
  • 3
  • 12
  • OK that makes sense, I think some experimentation is in order based on your "Of course" as I fully understand how the default VPC firewall for GCP instances/VM's works and am quite familiar with configuring those rules per project. I think I'll need to do a little more research on using firewallD for CentOS but it sounds like what I'd like to achieve is definitely possible. – sidgrafix Jan 02 '23 at 21:29