In this video we will look at how to set up instance level network security on an Oracle
Linux instance on Oracle Cloud Infrastructure.
Instance level network security is ensured with the instance firewall in conjunction
with the Oracle Cloud Infrastructure VCN, or Virtual Cloud Network, Security List.
Security lists are customizable and each network can be more or less restricted depending on
the needs and scope of the network.
Changes in security list rules may cause connection problems which might not show up in instance
log files.
So, you'll have to make sure you consider the security list if you are troubleshooting
connection problems.
If the instance administrator is not be the same person who manages the VCN security list,
then coordination is required between the various administrators to enable connections.
In this video we will use the example of enabling HTTP communication between client and server
instances built on Oracle Cloud Infrastructure.
We are currently looking at terminal windows to these two instances.
In the left terminal, we have set up an ssh session to a Linux client looking to access
a HTTP server.
In the right terminal, an ssh session to the HTTP server.
For convenience, the client and server are both connected to the same private subnet
of our VCN.
On the client, using curl, the server's IP address, and port 80, we run the command curl
-v http://10.0.0.4:80/index.html, to request the index.html file on the HTTP server.
After a few minutes, the request fails because the connection times out.
The timeout occurs because there is no rule in the VCN Security List that allows for ingress
network traffic on port 80 for any instances using the VCN.
Switching to our cloud web console, lets look at the current security list for the VCN.
Using the menu, Networking, and Virtual Cloud Networks, we navigate to our VCN list.
The VCN we are working with is VCN-10.
Clicking on its name we see its details.
Under Resources, Subnets is selected, so we are shown the two subnets provisioned for
this VCN.
There is a default security list created for a VCN, but separate security lists can be
created for individual subnets to control traffic just for the VNICs attached to the
subnet.
We will work with the default security list for the VCN, so we can get to it by selecting
any subnet in the list here.
We select the name of the subnet that our HTTP server is connected to, in our case,
VCN-10-01.
We see the default security list for the VCN present, and if we wanted a security list
just for this subnet, we could click the Add Security List button to create a new one.
For this demonstration we click on the default security list name.
And scrolling down we are shown all the rules being implemented in this security list.
Be aware there might be multiple pages of rules in this list.
Our client instance failed to get the index file using HTTP because there is no rule for
this in the subnet allowing ingress traffic for port 80.
To add the rule for this to the security list, we click on the Add Ingress Rules button.
For this demonstration we are only interested in serving instances on the same VCN, so we
input the VCN CIDR block range 10.0.0.0/16.
To control ingress HTTP traffic, we leave the protocol as TCP and enter 80 for the destination
port.
If we wanted to create multiple rules in the same dialog we can click Another Ingress Rule
to add more, but for us this one is enough.
We click Add Ingress Rules.
Any new rule gets added to the bottom of the list, so to see our new rule, we scroll down
and click to view the second page of the rules list.
We can see the new rule created.
You can find more information about Security Lists at this documentation page.
We return to the client and server terminals.
On the client we run the command curl -v http://10.0.0.4:80/index.html again.
This time the security list rule allowed the attempted connection to the server, but the
connection failed with a different failure message stating no route to host.
To fix this, we have to work with firewalld on the server instance.
The firewall daemon on Linux is a dynamic firewall manager.
For firewalld on a Linux instance, you can create different network zones.
In this demonstration, we will work with the default, public zone.
Changes to the configuration can have immediate effect, but are not persistent.
However, we can make configuration changes permanent so they persist over a reboot.
To work with firewalld we change to privileged mode by running the command sudo bash.
To see the default public zone settings, we run the command firewall-cmd --info-zone=public.
The firewalld service uses a combination of standard ports, protocols, and/or addresses.
We see the current supported services configured for this zone, ssh and dhcpv6-client.
But HTTP is not included in the list.
The HTTP service specifies tcp protocol and destination port 80.
This service, along with others, is defined in the /usr/lib/firewalld/services directory
of the instance.
So on our HTTP server instance, we modify the firewalld configuration to allow HTTP
by allowing the TCP protocol and port 80.
We run the command firewall-cmd --add-service http.
Without a specific zone included in the command, the change is made to the public zone.
We run the command firewall-cmd --info-zone=public to display the public zone information again.
This time the list of configured services includes HTTP.
Returning to our client terminal, we run the command curl -v http://10.0.0.4:80/index.html
again.
This time the command succeeds.
In the response, we see the http server IP address, the HTTP status 200, and the content
of the index.html file.
The client connection to the server is now working after modifying the security list
of the VCN and the server instance firewall.
Oracle provides an extensive number of resources which you can use to learn about this subject
and others.
Use the links here to find more content about this video, as well as Oracle Linux and using
Linux on Oracle Cloud Infrastructure.
Thats the end of the video.
Thanks for watching.