On 03/22/2014 11:39 AM, Michael C Cambria wrote:
But how does one reject the rest? source
address="0.0.0.0/32" isn't
allowed.
Hi,
You could do it by inverting your source address like this:
# firewall-cmd --add-rich-rule='rule family="ipv4" source
address="192.168.1.0/24" invert=true service name="ssh" reject'
The "invert" option is described in the firewalld.richlanguage man page.
Anyway, I don't think you need to explicitly reject it as that's the
default target for the public zone (assuming that's what you're using)
so, in a nutshell, any incoming traffic, for which there isn't an
"ACCEPT" rule, is going to be REJECTed anyway. In my case, I go one
step further: I change the public zone's default target from REJECT to
DROP. You can easily do this with firewall-config by editing the zone's
properties.
HTH,
Jorge