ssh only from known ip addresses

Thomas Woerner twoerner at redhat.com
Wed Mar 26 15:54:48 UTC 2014


On 03/22/2014 11:05 PM, Michael C Cambria wrote:
> On 03/22/14 16:51, Michael C Cambria wrote:
>> On 03/22/14 16:36, Jorge Fábregas wrote:
> [deleted]
>>>
>>> /etc/firewalld/zones/public.xml
>>>
>>> ..and change :
>>>
>>> <zone target="REJECT">
>>> to
>>> <zone target="DROP">
>>>
>>
>> None of my zone's seem to have existing xml for "zone target":
>>
Firewalld has a separation between built-in zones and customized zones. 
The built-in zones are located in /usr/lib/firewalld/zones, the 
customized are located in /etc/firewalld/zones.

If there is no customized zone file in /etc/firewalld/zones, the 
built-in is used. You can also revert to the built-in zone settings 
easily for example with the configuration tool or by removing the 
matching file in /etc/firewalld/zones.

Everything that is not explicitely accepted or dropped with a setting in 
a zone or by a zone binding by incoming interface or source address is 
rejected in the end. Within a trusted zone (target=ACCEPT) all things 
are accepted that are not explicitely dropped or rejected. Within a drop 
zone (target=DROP) all things are dropped that are not explicitely 
accepted or rejected. Within a reject zone (target=%%REJECT%%) all 
things are rejected that are not explicitely accepted or dropped. Within 
a zone without the target setting or with the default target setting the 
final REJECT rule in the firewall will apply for all things that are not 
configured differently in the zone.

I hope this helps a bit more to understand the concept of zones within 
firewalld.

>>
>> [root at node zones]# pwd
>> /etc/firewalld/zones
>> [root at node zones]# grep target *.xml
>> [root at node zones]#
>>
>>
>> I might add it and play around.
>
>
> This seems to work.  I needed to remove the ssh service as well.  Having
> the ssh service might have been the problem in the first place.
> Regardless, it seems to negate my rich rules.  The clue was that the
> rules would disappear (guessing optimized out) from one
>
> "firewall-cmd --zone=public --list-all" to the next.
>
> I have (since removed) the --add-port protocol="tcp" port="80" for
> Apache, and added it as a service.
>
> Time for a pint.
>
> Thanks everyone
> MikeC
>

Regards,
Thomas

>
>
> _______________________________________________
> firewalld-users mailing list
> firewalld-users at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/firewalld-users


More information about the firewalld-users mailing list