Great it works!
 
Thank you Eric
 
 
08.10.2018, 12:29, "Eric Garver" <egarver@redhat.com>:

On Sat, Oct 06, 2018 at 06:14:22PM -0400, Igor Kapushkin wrote:

    Hello
     
    I want to create new zone to allow only SSH connections from IP address
    range and DROP everything else.
     
    <?xml version="1.0" encoding="utf-8"?>
    <zone target="DROP">
      <short>TEsting</short>
      <description>Testing</description>
      <service name="ssh"/>
      <source address="123.45.67.89/24" />
    </zone>
     
    That IP range is fake, of course. In the real one, I use my IP range,
    which is real.
     
    I place that inside /etc/firewalld/zones/testing.xml and the zone gets
    listed after reload. The prblem is that ssh is still open for everyone. If
    I run nmap from a computer outside that range ("123.45.67.89/24") it says
    "open" so firewalld is not blocking it.
     
    What am I doing wrong? Should I use "ACCEPT" instead of "DROP"?


It's because packets not from 123.45.67.89/24 belong to a different zone
(likely the default/public zone) which also has SSH opened.

https://firewalld.org/documentation/zone/default-zone.html

You can get the desired effect by changing the default zone to something
restrictive like the "block" zone. Then your custom "testing" zone will
handle SSH connections from 123.45.67.89/24.

  # firewall-cmd --set-default-zone=block
  # firewall-cmd --reload

Be careful doing this remotely as you can easily block yourself out from
SSH.
_______________________________________________
firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org
To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahosted.org