Same here, I didn't monkey with the firewall since the days of iptables,
where I had my rules in a file that I'd load up in iptables. I would drop
everything by default and only poke holes for things that I needed. Now we
have zones and policies and stuff and I have to read an entire treatise on
firewall just to add a simple drop rule. In fact I did add the rule, it
just doesn't do anything.
I'm intrigued by the fact that the GUI won't let me add the rule (but the
command line does). Maybe there's something wrong with my rule and the GUI
detects that, but then I would expect the command line to error out too.
On Thu, 22 Jun 2023 02:23:18 +0930, Tim via users wrote:
On Wed, 2023-06-21 at 16:26 +0000, Amadeus WM via users wrote:
> I tried to add the rule in the running firewalld, i.e. without the --
> permanent option and I can still connect to the darn thing. I wonder if
> it has something to do with the order in which the rules or the tables
> are being processed.
>
> firewall-cmd --add-rich-rule="rule family='ipv4' protocol
value="tcp"
> destination address='a.b.0.0/16' reject"
I would imagine rule order would be important, it always used to be with
iptables, unless firewalld has some in-built prioritising. But for your
above example, can double-quotes around tcp be inside double quotes for
the whole thing?
It's many years since I did personal firewall rules. Back then it was
iptables, I'd made a script with all the rules I wanted. Going from
memory, it started off with an isolation command (didn't want things
sneaking it while it's pants were down), cleared all the existing rules,
put in my rules, and then the network was allowed to pass traffic.
When needed, I did any needed changes in my script, and ran it. It was
the best way I could think of to always get consistent results.