4.2. Firewalls and Network Security
A firewall is the network-level checkpoint in Linux's defense-in-depth model. Even if an attacker finds a vulnerability in a service, the firewall can limit which services are reachable and from where. The XK0-006 exam tests three firewall tools — firewalld, nftables/iptables — plus authentication services that control who can authenticate to the system.
💡 First Principle: Linux packet filtering happens in the kernel's Netfilter framework. All firewall tools — firewalld, nftables, iptables — are front-ends that write rules to Netfilter. They are mutually exclusive: running both firewalld and raw iptables rules on the same system causes conflicts because firewalld manages its own iptables chains.
⚠️ Common Misconception (M6): firewall-cmd changes without --permanent are runtime-only — they survive until the next firewall-cmd --reload or system reboot. Permanent changes require --permanent and take effect only after a reload. To apply immediately AND persist: run the command twice (once without --permanent for immediate effect, once with --permanent for persistence) — or use --permanent plus firewall-cmd --reload.
