Thorsten Schubert writes:
On Thu, May 7, 2020 at 12:12 AM Sam Varshavchik
<mrsam(a)courier-mta.com>
wrote:
> Is there a way with firewall-cmd to /really/ block an IP address, new or
> established connections, or is manually adding an iptables rule my only
> option?
You can bypass connection tracking for dropping existing connections
by adding a rule in the *raw* or *mangle* table when using the
iptables backend. The fastest way I know of, is to add a direct rule:
A more efficient way would be to use ipsets:
firewall-cmd --permanent --zone=drop --add-source=ipset:blacklist
firewall-cmd --permanent --ipset=blacklist --add-entry=1.2.3.4
firewall-cmd --permanent --ipset=blacklist --add-entry=4.3.2.1
This should terminate any existing connection and prevent new ones.
I haven't done much testing, but this does not seem to be quite right. After
creating and adding the ipset, iptables -n -L still shows me:
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all – 0.0.0.0/0 0.0.0.0/0 ctstate
RELATED,ESTABLISHED,DNAT
and
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all – 0.0.0.0/0 0.0.0.0/0 ctstate
RELATED,ESTABLISHED,DNAT
So, if the packet is already for an established connection, looks like it
will be accepted or forwarded right off the bat.
Now, after those, existing rules, rules follow that pull in other chains,
such as INPUT_ZONES, and FORWARD_IN_ZONES, where I see a rule referencing
the blacklist ipset. So, this will reject new connections, for sure, but
looks like packets for existing, established connections will still be
forwarded. Or maybe I am misinterpreting what an ACCEPT for
"RELATED,ESTABLISHED,DNAT" does.