ssh only from known ip addresses

Nathanael d. Noblet nathanael at gnat.ca
Sat Mar 22 20:10:18 UTC 2014


So I'm rather new to firewalld however here's how I would go about doing
it.

Pick a zone for your interface (public,internal,dmz,whatever). Then look
at its default policy (ACCEPT,DROP,REJECT). I presume most of them have
a default policy of REJECT. Once you have your interface tied to a zone,
then look at the default services that are allowed. Suppose you pick
public, it has default policy of REJECT. Lets also assume it has enabled
the ssh service. This basically means that it rejects all but ssh.

If you take that zone, remove ssh from the default enabled service, add
your rich rules for the source addresses you want. It should now only
accept ssh connections from the rules you've provided.

-- 
Nathanael

On Sat, 2014-03-22 at 14:31 -0400, Michael C Cambria wrote:
> On 03/22/14 12:07, Jorge Fábregas wrote:
> > On 03/22/2014 11:39 AM, Michael C Cambria wrote:
> >> But how does one reject the rest?  source address="0.0.0.0/32" isn't
> >> allowed.
> >
> > Hi,
> >
> > You could do it by inverting your source address like this:
> >
> > # firewall-cmd --add-rich-rule='rule family="ipv4" source
> > address="192.168.1.0/24" invert=true service name="ssh" reject'
> >
> > The "invert" option is described in the firewalld.richlanguage man page.
> 
> But I have several addresses.
> 
> >
> > Anyway, I don't think you need to explicitly reject it as that's the
> > default target for the public zone (assuming that's what you're using)
> > so, in a nutshell, any incoming traffic, for which there isn't an
> > "ACCEPT" rule, is going to be REJECTed anyway.  In my case, I go one
> > step further:  I change the public zone's default target from REJECT to
> > DROP.  You can easily do this with firewall-config by editing the zone's
> > properties.
> 
> I'll look at setting the public zone default target to do what I want.
> 
> I must have changed this default somehow.  I had to learn about, then 
> create a list of rich rules with accept for sshd because all ssh 
> connections were being dropped (or rejected).
> 
> Thanks,
> MikeC
> 
> _______________________________________________
> firewalld-users mailing list
> firewalld-users at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/firewalld-users




More information about the firewalld-users mailing list