On 03/22/2014 11:05 PM, Michael C Cambria wrote:
On 03/22/14 16:51, Michael C Cambria wrote:
> On 03/22/14 16:36, Jorge Fábregas wrote:
[deleted]
>>
>> /etc/firewalld/zones/public.xml
>>
>> ..and change :
>>
>> <zone target="REJECT">
>> to
>> <zone target="DROP">
>>
>
> None of my zone's seem to have existing xml for "zone target":
>
Firewalld has a separation between built-in zones and customized zones.
The built-in zones are located in /usr/lib/firewalld/zones, the
customized are located in /etc/firewalld/zones.
If there is no customized zone file in /etc/firewalld/zones, the
built-in is used. You can also revert to the built-in zone settings
easily for example with the configuration tool or by removing the
matching file in /etc/firewalld/zones.
Everything that is not explicitely accepted or dropped with a setting in
a zone or by a zone binding by incoming interface or source address is
rejected in the end. Within a trusted zone (target=ACCEPT) all things
are accepted that are not explicitely dropped or rejected. Within a drop
zone (target=DROP) all things are dropped that are not explicitely
accepted or rejected. Within a reject zone (target=%%REJECT%%) all
things are rejected that are not explicitely accepted or dropped. Within
a zone without the target setting or with the default target setting the
final REJECT rule in the firewall will apply for all things that are not
configured differently in the zone.
I hope this helps a bit more to understand the concept of zones within
firewalld.
>
> [root@node zones]# pwd
> /etc/firewalld/zones
> [root@node zones]# grep target *.xml
> [root@node zones]#
>
>
> I might add it and play around.
This seems to work. I needed to remove the ssh service as well. Having
the ssh service might have been the problem in the first place.
Regardless, it seems to negate my rich rules. The clue was that the
rules would disappear (guessing optimized out) from one
"firewall-cmd --zone=public --list-all" to the next.
I have (since removed) the --add-port protocol="tcp" port="80" for
Apache, and added it as a service.
Time for a pint.
Thanks everyone
MikeC
Regards,
Thomas
_______________________________________________
firewalld-users mailing list
firewalld-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/firewalld-users