Learning AlmaLinux - Networking & Firewalld

#Introduction

In the previous episode, Episode 8, we set up storage and filesystems. Now we deal with a server's lifeline: networking. A server that can't be reached over the network is as good as useless — and a server with a loose firewall is an invitation to attackers.

This episode covers two sides of the same coin: NetworkManager as the manager of network configuration, and firewalld as its perimeter defense. You'll learn to set up IPs, DNS, bonding, and VLANs, then build correct firewall zones.

#NetworkManager and nmcli

NetworkManager is AlmaLinux's default network manager. Configuration is handled through connection profiles — files that store all settings for a connection, such as IP addresses and DNS.

#Basic nmcli Commands

nmcli device status
nmcli connection show

nmcli device status shows physical devices, while nmcli connection show shows connection profiles. Together they give you a map of your system's network.

#Setting a Static IP

Most servers need a static IP, not DHCP. Create a new profile or modify an existing one:

sudo nmcli connection modify ens192 ipv4.method manual ipv4.addresses 192.168.1.10/24 ipv4.gateway 192.168.1.1 ipv4.dns 1.1.1.1
sudo nmcli connection up ens192

#Hostname

sudo hostnamectl set-hostname app1.lab.local
hostnamectl

hostnamectl also shows the operating system, kernel, and hardware information — one of the first diagnostic commands you should master.

#Bonding, VLANs, and Bridges

#Bonding

Bonding combines multiple physical NICs into one logical link — for redundancy (failover) and throughput:

sudo nmcli connection add type bond con-name bond0 ifname bond0 bond.options mode=active-backup
sudo nmcli connection add type ethernet con-name ens192 ifname ens192 master bond0
sudo nmcli connection add type ethernet con-name ens224 ifname ens224 master bond0

The active-backup mode uses one active NIC with the rest on standby — when the primary NIC fails, traffic moves over automatically.

#VLANs

VLANs separate traffic logically over a single physical link:

sudo nmcli connection add type vlan con-name bond0.100 ifname bond0.100 vlan.id 100 vlan.parent bond0

#Bridges

A bridge combines several interfaces into one network — the standard for virtualization:

sudo nmcli connection add type bridge con-name br0 ifname br0
sudo nmcli connection add type ethernet con-name ens192 ifname ens192 master br0

#Firewalld and the Zone Concept

firewalld is a dynamic firewall based on zones. A zone is a set of rules that determines a network's trust level. The concept: network devices (not just interfaces) are grouped into zones, and each zone has its own open/close rules.

firewall-cmd --get-default-zone
firewall-cmd --get-active-zones

#Service vs Port

The cleanest way to open a service is using a service — a named definition containing a set of ports:

sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

sudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --reload

#Runtime vs Permanent

Firewalld distinguishes two states:

• Runtime — applies immediately, lost on reload/reboot.
• Permanent — saved in the configuration files, applies after a reload.

The recommended safe pattern: add rules with --permanent, then --reload to apply them to the runtime.

#Rich Rules, Masquerade, and NAT

#Rich Rules

For granular control, use rich rules — expressive rules that can filter by source address:

sudo firewall-cmd --permanent --zone=internal --add-rich-rule='rule family=ipv4 source address=192.168.1.0/24 port port=22 protocol=tcp accept'
sudo firewall-cmd --reload

#Masquerade / NAT

Masquerade is a form of NAT (Network Address Translation) that hides an internal network behind one public IP — the standard pattern for gateways/routers:

sudo firewall-cmd --permanent --zone=external --add-masquerade
sudo firewall-cmd --reload

#Common Pitfalls

1. Forgetting --permanent. Rules that are runtime-only are lost on reload — always add --permanent.
2. Opening ports without filtering the source. On public servers, restrict administrative access with rich rules.
3. Disabling firewalld entirely. A server without a firewall is like a house without a door. Configure it properly instead of turning it off.
4. Editing network configuration with ifconfig. Use nmcli so changes are saved as NetworkManager profiles.
5. Not checking the active zones. An interface can end up in a zone you didn't expect — check with --get-active-zones.

#Conclusion

In this episode 9 you've mastered AlmaLinux networking and firewall: connection configuration with NetworkManager and nmcli, static IP and DNS, hostname, bonding, VLANs, and bridges, plus building a zone-based firewall with firewall-cmd, rich rules, and masquerade for NAT.

Key takeaways:

• Configure networking via nmcli and NetworkManager profiles, not ifconfig.
• Static IPs are set with ipv4.method manual; test with nmcli connection up.
• Bonding (failover), VLANs (segmentation), and bridges (virtualization) are advanced network tools.
• Firewalld works on a zone basis; know the difference between public, internal, and trusted.
• Use services for standard ports, rich rules for source control, and --permanent + --reload for persistent changes.
• Masquerade enables NAT for gateways.

Well-organized networking and firewalls let your services be accessed securely. In the next episode, Episode 10, we'll cover Kernel, Boot & Kernel Modules — the boot process from firmware to systemd, GRUB2 and initramfs management, kernel version management with grubby, sysctl tuning, and kernel module management with modprobe. See you there!