ssh only from known ip addresses
Michael C Cambria
mcc at fid4.com
Sat Mar 22 18:31:44 UTC 2014
On 03/22/14 12:07, Jorge Fábregas wrote:
> On 03/22/2014 11:39 AM, Michael C Cambria wrote:
>> But how does one reject the rest? source address="0.0.0.0/32" isn't
>> allowed.
>
> Hi,
>
> You could do it by inverting your source address like this:
>
> # firewall-cmd --add-rich-rule='rule family="ipv4" source
> address="192.168.1.0/24" invert=true service name="ssh" reject'
>
> The "invert" option is described in the firewalld.richlanguage man page.
But I have several addresses.
>
> Anyway, I don't think you need to explicitly reject it as that's the
> default target for the public zone (assuming that's what you're using)
> so, in a nutshell, any incoming traffic, for which there isn't an
> "ACCEPT" rule, is going to be REJECTed anyway. In my case, I go one
> step further: I change the public zone's default target from REJECT to
> DROP. You can easily do this with firewall-config by editing the zone's
> properties.
I'll look at setting the public zone default target to do what I want.
I must have changed this default somehow. I had to learn about, then
create a list of rich rules with accept for sshd because all ssh
connections were being dropped (or rejected).
Thanks,
MikeC
More information about the firewalld-users
mailing list