ssh only from known ip addresses

Michael C Cambria mcc at fid4.com
Sat Mar 22 18:31:44 UTC 2014


On 03/22/14 12:07, Jorge Fábregas wrote:
> On 03/22/2014 11:39 AM, Michael C Cambria wrote:
>> But how does one reject the rest?  source address="0.0.0.0/32" isn't
>> allowed.
>
> Hi,
>
> You could do it by inverting your source address like this:
>
> # firewall-cmd --add-rich-rule='rule family="ipv4" source
> address="192.168.1.0/24" invert=true service name="ssh" reject'
>
> The "invert" option is described in the firewalld.richlanguage man page.

But I have several addresses.

>
> Anyway, I don't think you need to explicitly reject it as that's the
> default target for the public zone (assuming that's what you're using)
> so, in a nutshell, any incoming traffic, for which there isn't an
> "ACCEPT" rule, is going to be REJECTed anyway.  In my case, I go one
> step further:  I change the public zone's default target from REJECT to
> DROP.  You can easily do this with firewall-config by editing the zone's
> properties.

I'll look at setting the public zone default target to do what I want.

I must have changed this default somehow.  I had to learn about, then 
create a list of rich rules with accept for sshd because all ssh 
connections were being dropped (or rejected).

Thanks,
MikeC



More information about the firewalld-users mailing list