FirewallD Rule for Port and Interface
Thomas Woerner
twoerner at redhat.com
Wed Apr 4 13:15:48 UTC 2012
Hello Scott,
On 03/30/2012 02:40 AM, Scott Talbert wrote:
> Hi,
>
> I have been looking at firewalld in Fedora 17 in order to understand how
> to convert an iptables command that I use in a script into a firewalld
> one. The iptables command that I'm using is:
> iptables -I INPUT -p udp -i $INTERFACE --dport 67 -j ACCEPT
>
> With firewalld-cmd I can do:
> firewall-cmd --add --port=67/udp
>
> But there doesn't seem to be a way for me to specify an interface as
> well? As in, I only want to open UDP port 67 on a specific network
> interface, not all interfaces.
>
Are you setting up interfaces by hand or are you using NetworkManager or
the network service?
If you are using NetworkManager or the network service:
You can use a separate zone for the interface you want to enable the
bootps port. Just add "ZONE=<zone>" to the ifcfg- file for this
interface, then it will automatically be used. For example use the work
zone and enable the bootps port for this zone. Either temoprary with
firewall-cmd or by editing the zone file. The default zone is 'public'.
As root user:
1) Copy the work zone from the default zones to the customized zone
directory: cp /usr/lib/firewalld/zones/work.xml /etc/firewalld/zones/
2) Add the port line to the zone (between <zone..> and </zone>):
<port port="67" protocol="udp"/>
3) firewall-cmd --reload
You can verify if the port is open now: iptables -S | grep 67
To get the default zone (default: 'public'): firewall-cmd --get-default-zone
To get the active zones: firewall-cmd --get-active-zones
If you are setting up interfaces by hand:
Create a customized zone and use firewall-cmd to add th einterface to
the zone: firewall-cmd --zone=<zone> --add --interface=<interface>
> Thanks,
> Scott
> _______________________________________________
> firewalld-users mailing list
> firewalld-users at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/firewalld-users
Thanks,
Thomas
More information about the firewalld-users
mailing list