So I'm rather new to firewalld however here's how I would go about doing
it.
Pick a zone for your interface (public,internal,dmz,whatever). Then look
at its default policy (ACCEPT,DROP,REJECT). I presume most of them have
a default policy of REJECT. Once you have your interface tied to a zone,
then look at the default services that are allowed. Suppose you pick
public, it has default policy of REJECT. Lets also assume it has enabled
the ssh service. This basically means that it rejects all but ssh.
If you take that zone, remove ssh from the default enabled service, add
your rich rules for the source addresses you want. It should now only
accept ssh connections from the rules you've provided.
--
Nathanael
On Sat, 2014-03-22 at 14:31 -0400, Michael C Cambria wrote:
On 03/22/14 12:07, Jorge Fábregas wrote:
> On 03/22/2014 11:39 AM, Michael C Cambria wrote:
>> But how does one reject the rest? source address="0.0.0.0/32"
isn't
>> allowed.
>
> Hi,
>
> You could do it by inverting your source address like this:
>
> # firewall-cmd --add-rich-rule='rule family="ipv4" source
> address="192.168.1.0/24" invert=true service name="ssh"
reject'
>
> The "invert" option is described in the firewalld.richlanguage man page.
But I have several addresses.
>
> Anyway, I don't think you need to explicitly reject it as that's the
> default target for the public zone (assuming that's what you're using)
> so, in a nutshell, any incoming traffic, for which there isn't an
> "ACCEPT" rule, is going to be REJECTed anyway. In my case, I go one
> step further: I change the public zone's default target from REJECT to
> DROP. You can easily do this with firewall-config by editing the zone's
> properties.
I'll look at setting the public zone default target to do what I want.
I must have changed this default somehow. I had to learn about, then
create a list of rich rules with accept for sshd because all ssh
connections were being dropped (or rejected).
Thanks,
MikeC
_______________________________________________
firewalld-users mailing list
firewalld-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/firewalld-users