On 03/22/14 12:07, Jorge Fábregas wrote:
On 03/22/2014 11:39 AM, Michael C Cambria wrote:
> But how does one reject the rest? source address="0.0.0.0/32" isn't
> allowed.
Hi,
You could do it by inverting your source address like this:
# firewall-cmd --add-rich-rule='rule family="ipv4" source
address="192.168.1.0/24" invert=true service name="ssh" reject'
The "invert" option is described in the firewalld.richlanguage man page.
But I have several addresses.
Anyway, I don't think you need to explicitly reject it as that's the
default target for the public zone (assuming that's what you're using)
so, in a nutshell, any incoming traffic, for which there isn't an
"ACCEPT" rule, is going to be REJECTed anyway. In my case, I go one
step further: I change the public zone's default target from REJECT to
DROP. You can easily do this with firewall-config by editing the zone's
properties.
I'll look at setting the public zone default target to do what I want.
I must have changed this default somehow. I had to learn about, then
create a list of rich rules with accept for sshd because all ssh
connections were being dropped (or rejected).
Thanks,
MikeC