Did you test Hping3? It cause your CPU usage increased.

On Monday, October 12, 2020, 04:51:28 PM GMT+3:30, Eric Garver <egarver@redhat.com> wrote:


On Sat, Oct 10, 2020 at 09:41:46AM +0000, Jason Long wrote:
> Thank you.
> When, SSH listed in the services sections then all of these protections applied to it automatically?

No. If it's listed in "services" then all new SSH connection are
allowed. They are not rate limited. You said you wanted rate limiting.
That's why you need the rich rule.

>
>
>
>
>
>
> On Monday, October 5, 2020, 07:25:27 PM GMT+3:30, Eric Garver <egarver@redhat.com> wrote:
>
>
>
>
>
> On Mon, Oct 05, 2020 at 03:33:36PM +0000, Jason Long wrote:
> > Should I remove it from Service?
>
> Yes.
>
> > On Monday, October 5, 2020, 04:39:32 PM GMT+3:30, Eric Garver <egarver@redhat.com> wrote:
> >
> >
> >
> >
> >
> > On Sun, Oct 04, 2020 at 11:25:14AM -0000, Jason Long wrote:
> > > After it, my rules are:
> > >
> > > public (active)
> > >  target: default
> > >  icmp-block-inversion: no
> > >  interfaces: ens192
> > >  sources:
> > >  services: http https ssh
> > >  ports: 990/tcp 40000-50000/tcp
> > >  protocols:
> > >  masquerade: no
> > >  forward-ports:
> > >  source-ports:
> > >  icmp-blocks:
> > >  rich rules:
> > >     rule service name="ssh" accept limit value="1/m"

>
> >
> > As I said in my other email, this rich is not having the desired effect
> > because "ssh" is still listed in services.

> >
> _______________________________________________
> firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org
> To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahosted.org