Zones and Sources (allow internal, deny external connections)

Thomas Woerner twoerner at redhat.com
Wed Jun 26 14:53:29 UTC 2013


On 06/20/2013 05:16 PM, Nathanael D. Noblet wrote:
> Hello,
>
>    So I've been following firewalld, and previously I was under the
> assumption that a particular feature wasn't yet there. Now it seems that
> it is.
>
>    I have a machine that is on a DMZ so we have an eternal router which
> hands out a private subnet ips, but forwards all traffic to one machine
> in that subnet. That machine runs Fedora 19 (firewalld-0.3.3-2).
>
>    I'm wondering if with the 'sources' option I can open particular
> services (lets say nfs for example) to the internal subnet, but not the
> external. Is that the correct understanding of what is meant by sources?
>
Yes it is.

>    If that is the case are there docs/examples of how to create a
> configuration where some services are allowed by all connections, and
> others are allowed based on source?
>
>

You have two choices:

1) You can bind a zone to the internal subnet (e.g. 192.168.2.1/24) and 
use another or the default zone for the external subnet.

2) You can use rich language rules and add the source for the rules. 
(See https://fedoraproject.org/wiki/Features/FirewalldRichLanguage for 
examples). The GUI (firewall-config) is not able to handle rich rules 
yet. But we are working on this.

Thomas


More information about the firewalld-users mailing list