RHCE Exam Preparation Guide<\/p>\n<\/div>\n This\u00a0RHCE<\/strong>\u00a0(Red Hat Certified Engineer<\/strong>) is a performance-based exam (codename\u00a0EX300<\/strong>), who possesses the additional skills, knowledge, and abilities required of a senior system administrator responsible for Red Hat Enterprise Linux (RHEL) systems.<\/p>\n Important<\/strong>:\u00a0Red Hat Certified System Administrator<\/a>\u00a0(RHCSA) certification is required to earn\u00a0RHCE<\/strong>\u00a0certification.<\/p>\n Following are the exam objectives based on the\u00a0Red Hat Enterprise Linux 7<\/strong>\u00a0version of the exam, which will going to cover in this RHCE series:<\/p>\n To view fees and register for an exam in your country, check the\u00a0RHCE Certification<\/a>\u00a0page.<\/p>\n In this\u00a0Part 1<\/strong>\u00a0of the\u00a0RHCE<\/strong>\u00a0series and the next, we will present basic, yet typical, cases where the principles of static routing, packet filtering, and network address translation come into play.<\/p>\n RHCE: Setup and Test Network Static Routing \u2013 Part 1<\/p>\n<\/div>\n Please note that we will not cover them in depth, but rather organize these contents in such a way that will be helpful to take the first steps and build from there.<\/p>\n One of the wonders of modern networking is the vast availability of devices that can connect groups of computers, whether in relatively small numbers and confined to a single room or several machines in the same building, city, country, or across continents.<\/p>\n However, in order to effectively accomplish this in any situation, network packets need to be routed, or in other words, the path they follow from source to destination must be ruled somehow.<\/p>\n Static routing is the process of specifying a route for network packets other than the default, which is provided by a network device known as the default gateway. Unless specified otherwise through static routing, network packets are directed to the default gateway; with static routing, other paths are defined based on predefined criteria, such as the packet destination.<\/p>\n Let us define the following scenario for this tutorial. We have a Red Hat Enterprise Linux 7 box connecting to router\u00a0#1 [192.168.0.1]<\/strong>\u00a0to access the Internet and machines in\u00a0192.168.0.0\/24<\/strong>.<\/p>\n A second router\u00a0(router #2)<\/strong>\u00a0has two network interface cards:\u00a0enp0s3<\/strong>\u00a0is also connected to\u00a0router #1<\/strong>\u00a0to access the Internet and to communicate with the RHEL 7 box and other machines in the same network, whereas the other (enp0s8<\/strong>) is used to grant access to the\u00a010.0.0.0\/24<\/strong>\u00a0network where internal services reside, such as a web and \/ or database server.<\/p>\n This scenario is illustrated in the diagram below:<\/p>\n Static Routing Network Diagram<\/p>\n<\/div>\n In this article we will focus exclusively on setting up the routing table on our\u00a0RHEL 7<\/strong>\u00a0box to make sure that it can both access the Internet through\u00a0router #1<\/strong>\u00a0and the internal network via\u00a0router #2<\/strong>.<\/p>\n In\u00a0RHEL 7<\/strong>, you will use the\u00a0ip command<\/a>\u00a0to configure and show devices and routing using the command line. These changes can take effect immediately on a running system but since they are not persistent across reboots, we will use\u00a0ifcfg-enp0sX<\/strong>\u00a0and\u00a0route-enp0sX<\/strong>\u00a0files inside\u00a0\/etc\/sysconfig\/network-scripts<\/strong>\u00a0to save our configuration permanently.<\/p>\n To begin, let\u2019s print our current routing table:<\/p>\n Check Current Routing Table<\/p>\n<\/div>\n From the output above, we can see the following facts:<\/p>\n These are the typical tasks that you would have to perform in such a setting. Unless specified otherwise, the following tasks should be performed in\u00a0router #2<\/strong>:<\/p>\n Make sure all NICs have been properly installed:<\/p>\n If one of them is down, bring it up:<\/p>\n and assign an IP address in the\u00a010.0.0.0\/24<\/strong>\u00a0network to it:<\/p>\n Oops! We made a mistake in the IP address. We will have to remove the one we assigned earlier and then add the right one (10.0.0.18<\/strong>):<\/p>\n Now, please note that you can only add a route to a destination network through a gateway that is itself already reachable. For that reason, we need to assign an IP address within the\u00a0192.168.0.0\/24<\/strong>\u00a0range to\u00a0enp0s3<\/strong>\u00a0so that our RHEL 7 box can communicate with it:<\/p>\n Finally, we will need to enable packet forwarding:<\/p>\n and stop \/ disable (just for the time being \u2013 until we cover packet filtering in the next article) the firewall:<\/p>\n Back in our\u00a0RHEL 7<\/strong>\u00a0box (192.168.0.18<\/strong>), let\u2019s configure a route to\u00a010.0.0.0\/24<\/strong>\u00a0through\u00a0192.168.0.19<\/strong>\u00a0(enp0s3<\/strong>\u00a0in\u00a0router #2<\/strong>):<\/p>\n After that, the routing table looks as follows:<\/p>\n Confirm Network Routing Table<\/p>\n<\/div>\n Likewise, add the corresponding route in the machine(s) you\u2019re trying to reach in\u00a010.0.0.0\/24<\/strong>:<\/p>\n You can test for basic connectivity using\u00a0ping<\/strong>:<\/p>\n In the\u00a0RHEL 7<\/strong>\u00a0box, run<\/p>\n where\u00a010.0.0.20<\/strong>\u00a0is the IP address of a web server in the\u00a010.0.0.0\/24<\/strong>\u00a0network.<\/p>\n In the web server (10.0.0.20<\/strong>), run<\/p>\n where\u00a0192.168.0.18<\/strong>\u00a0is, as you will recall, the IP address of our RHEL 7 machine.<\/p>\n Alternatively, we can use\u00a0tcpdump<\/a>\u00a0(you may need to install it with\u00a0yum install tcpdump<\/strong>) to check the 2-way communication over TCP between our RHEL 7 box and the web server at\u00a010.0.0.20<\/strong>.<\/p>\n To do so, let\u2019s start the logging in the first machine with:<\/p>\n and from another terminal in the same system let\u2019s\u00a0telnet<\/strong>\u00a0to port\u00a080<\/strong>\u00a0in the web server (assuming\u00a0Apache<\/strong>\u00a0is listening on that port; otherwise, indicate the right port in the following command):<\/p>\n The\u00a0tcpdump<\/strong>\u00a0log should look as follows:<\/p>\n Check Network Communication between Servers<\/p>\n<\/div>\n Where the connection has been properly initialized, as we can tell by looking at the 2-way communication between our\u00a0RHEL 7<\/strong>\u00a0box (192.168.0.18<\/strong>) and the web server (10.0.0.20<\/strong>).<\/p>\n Please remember that these changes will go away when you restart the system. If you want to make them persistent, you will need to edit (or create, if they don\u2019t already exist) the following files, in the same systems where we performed the above commands.<\/p>\n Though not strictly necessary for our test case, you should know that\u00a0\/etc\/sysconfig\/network<\/strong>\u00a0contains system-wide network parameters. A typical\u00a0\/etc\/sysconfig\/network<\/strong>\u00a0looks as follows:<\/p>\n When it comes to setting specific variables and values for each NIC (as we did for router #2), you will have to edit\u00a0\/etc\/sysconfig\/network-scripts\/ifcfg-enp0s3<\/strong>\u00a0and\u00a0\/etc\/sysconfig\/network-scripts\/ifcfg-enp0s8<\/strong>.<\/p>\n Following our case,<\/p>\n and<\/p>\n for\u00a0enp0s3<\/strong>\u00a0and\u00a0enp0s8<\/strong>, respectively.<\/p>\n As for routing in our client machine (192.168.0.18), we will need to edit\u00a0\/etc\/sysconfig\/network-scripts\/route-enp0s3:<\/strong><\/p>\n Now\u00a0reboot<\/strong>\u00a0your system and you should see that route in your table.<\/p>\n In this article we have covered the essentials of static routing in\u00a0Red Hat Enterprise Linux 7<\/strong>. Although scenarios may vary, the case presented here illustrates the required principles and the procedures to perform this task. Before wrapping up, I would like to suggest you to take a look at\u00a0Chapter 4<\/a>\u00a0of the\u00a0Securing and Optimizing Linux<\/strong>section in The Linux Documentation Project site for further details on the topics covered here.<\/p>\n Free ebook on\u00a0Securing & Optimizing Linux: The Hacking Solution (v.3.0)<\/strong>\u00a0\u2013 This\u00a0800+<\/strong>\u00a0eBook contains comprehensive collection of Linux security tips and how to use them safely and easily to configure Linux-based applications and services.<\/p>\n Linux Security and Optimization Book<\/p>\n<\/div>\n Download Now<\/a><\/p>\n In the next article we will talk about packet filtering and network address translation to sum up the networking basic skills needed for the RHCE certification.<\/p>\n As always, we look forward to hearing from you, so feel free to leave your questions, comments, and suggestions using the form below.<\/p>\n As promised in\u00a0Part 1<\/strong>\u00a0(\u201cSetup Static Network Routing<\/a>\u201d), in this article (Part 2<\/strong>\u00a0of\u00a0RHCE<\/strong>\u00a0series) we will begin by introducing the principles of packet filtering and network address translation (NAT) in\u00a0Red Hat Enterprise Linux 7<\/strong>, before diving into setting runtime kernel parameters to modify the behavior of a running kernel if certain conditions change or needs arise.<\/p>\n RHCE: Network Packet Filtering \u2013 Part 2<\/p>\n<\/div>\n When we talk about packet filtering, we refer to a process performed by a firewall in which it reads the header of each data packet that attempts to pass through it. Then, it filters the packet by taking the required action based on rules that have been previously defined by the system administrator.<\/p>\n As you probably know, beginning with\u00a0RHEL 7<\/strong>, the default service that manages firewall rules is\u00a0firewalld<\/a>. Like iptables, it talks to the netfilter module in the Linux kernel in order to examine and manipulate network packets. Unlike iptables, updates can take effect immediately without interrupting active connections \u2013 you don\u2019t even have to restart the service.<\/p>\n Another advantage of\u00a0firewalld<\/strong>\u00a0is that it allows us to define rules based on pre-configured service names (more on that in a minute).<\/p>\n In\u00a0Part 1<\/strong>, we used the following scenario:<\/p>\n Static Routing Network Diagram<\/p>\n<\/div>\n However, you will recall that we disabled the firewall on\u00a0router #2<\/strong>\u00a0to simplify the example since we had not covered packet filtering yet. Let\u2019s see now how we can enable incoming packets destined for a specific service or port in the destination.<\/p>\n First, let\u2019s add a permanent rule to allow inbound traffic in\u00a0enp0s3<\/strong>\u00a0(192.168.0.19<\/strong>) to\u00a0enp0s8<\/strong>\u00a0(10.0.0.18<\/strong>):<\/p>\n The above command will save the rule to\u00a0\/etc\/firewalld\/direct.xml<\/strong>:<\/p>\n Check Firewalld Saved Rules<\/p>\n<\/div>\n Then enable the rule for it to take effect immediately:<\/p>\n![\"RHCE](\"https:\/\/www.tecmint.com\/wp-content\/uploads\/2015\/07\/RHCE-Exam-Series-by-TecMint.jpg\")
<\/a><\/p>\n<\/a><\/p>\nStatic Routing in Red Hat Enterprise Linux 7<\/h3>\n
<\/a><\/p>\n# ip route show\r\n<\/pre>\n
<\/a><\/p>\n\n
# ip link show\r\n<\/pre>\n
# ip link set dev enp0s8 up\r\n<\/pre>\n
# ip addr add 10.0.0.17 dev enp0s8\r\n<\/pre>\n
# ip addr del 10.0.0.17 dev enp0s8\r\n# ip addr add 10.0.0.18 dev enp0s8\r\n<\/pre>\n
# ip addr add 192.168.0.19 dev enp0s3\r\n<\/pre>\n
# echo \"1\" > \/proc\/sys\/net\/ipv4\/ip_forward\r\n<\/pre>\n
# systemctl stop firewalld\r\n# systemctl disable firewalld\r\n<\/pre>\n
# ip route add 10.0.0.0\/24 via 192.168.0.19\r\n<\/pre>\n
# ip route show\r\n<\/pre>\n
<\/a><\/p>\n# ip route add 192.168.0.0\/24 via 10.0.0.18\r\n<\/pre>\n
# ping -c 4 10.0.0.20\r\n<\/pre>\n
# ping -c 192.168.0.18\r\n<\/pre>\n
# tcpdump -qnnvvv -i enp0s3 host 10.0.0.20\r\n<\/pre>\n
# telnet 10.0.0.20 80\r\n<\/pre>\n
<\/a><\/p>\n# Enable networking on this system?\r\nNETWORKING=yes\r\n# Hostname. Should match the value in \/etc\/hostname\r\nHOSTNAME=yourhostnamehere\r\n# Default gateway\r\nGATEWAY=XXX.XXX.XXX.XXX\r\n# Device used to connect to default gateway. Replace X with the appropriate number.\r\nGATEWAYDEV=enp0sX\r\n<\/pre>\n
TYPE=Ethernet\r\nBOOTPROTO=static\r\nIPADDR=192.168.0.19\r\nNETMASK=255.255.255.0\r\nGATEWAY=192.168.0.1\r\nNAME=enp0s3\r\nONBOOT=yes\r\n<\/pre>\n
TYPE=Ethernet\r\nBOOTPROTO=static\r\nIPADDR=10.0.0.18\r\nNETMASK=255.255.255.0\r\nGATEWAY=10.0.0.1\r\nNAME=enp0s8\r\nONBOOT=yes\r\n<\/pre>\n
10.0.0.0\/24 via 192.168.0.19 dev enp0s3\r\n<\/pre>\n
Summary<\/h3>\n
<\/a><\/p>\nHow to Perform Packet Filtering, Network Address Translation and Set Kernel Runtime Parameters \u2013 Part 2<\/h1>\n
<\/a><\/p>\nNetwork Packet Filtering in RHEL 7<\/h3>\n
<\/a><\/p>\n# firewall-cmd --permanent --direct --add-rule ipv4 filter FORWARD 0 -i enp0s3 -o enp0s8 -j ACCEPT\r\n<\/pre>\n
# cat \/etc\/firewalld\/direct.xml\r\n<\/pre>\n
<\/a><\/p>\n# firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i enp0s3 -o enp0s8 -j ACCEPT\r\n<\/pre>\n