On Tue, Nov 10, 2020 at 09:53:46AM -0000, Robert Smuhar wrote:
G'day Eric,
Thank you for the feedback and the example. It is much appreciated.
This worked in my lab setup:
[root@firewall ~]# firewall-cmd --permanent --zone=FedoraServer --remove-interface=ens192 [root@firewall ~]# firewall-cmd --permanent --zone=FedoraServer --remove-interface=ens224 [root@firewall ~]# firewall-cmd --permanent --zone=dmz --add-interface=ens224 [root@firewall ~]# firewall-cmd --permanent --zone=internal --add-interface=ens192 [root@firewall ~]# firewall-cmd --permanent --new-policy InternalToDmz [root@firewall ~]# firewall-cmd --permanent --policy InternalToDmz --add-ingress-zone internal [root@firewall ~]# firewall-cmd --permanent --policy InternalToDmz --add-egress-zone dmz [root@firewall ~]# firewall-cmd --permanent --policy InternalToDmz --add-service ssh [root@firewall ~]# firewall-cmd --reload
So what is the "destination address=" parameter in the rich-rule for?
It matches the destination IP address.
Also, would you have any ideas when firewalld v0.9.x will make it into the CentOS build?
Probably not until CentOS 8.5 or later.