ssh only from known ip addresses
Thomas Woerner
twoerner at redhat.com
Wed Mar 26 15:54:48 UTC 2014
On 03/22/2014 11:05 PM, Michael C Cambria wrote:
> On 03/22/14 16:51, Michael C Cambria wrote:
>> On 03/22/14 16:36, Jorge Fábregas wrote:
> [deleted]
>>>
>>> /etc/firewalld/zones/public.xml
>>>
>>> ..and change :
>>>
>>> <zone target="REJECT">
>>> to
>>> <zone target="DROP">
>>>
>>
>> None of my zone's seem to have existing xml for "zone target":
>>
Firewalld has a separation between built-in zones and customized zones.
The built-in zones are located in /usr/lib/firewalld/zones, the
customized are located in /etc/firewalld/zones.
If there is no customized zone file in /etc/firewalld/zones, the
built-in is used. You can also revert to the built-in zone settings
easily for example with the configuration tool or by removing the
matching file in /etc/firewalld/zones.
Everything that is not explicitely accepted or dropped with a setting in
a zone or by a zone binding by incoming interface or source address is
rejected in the end. Within a trusted zone (target=ACCEPT) all things
are accepted that are not explicitely dropped or rejected. Within a drop
zone (target=DROP) all things are dropped that are not explicitely
accepted or rejected. Within a reject zone (target=%%REJECT%%) all
things are rejected that are not explicitely accepted or dropped. Within
a zone without the target setting or with the default target setting the
final REJECT rule in the firewall will apply for all things that are not
configured differently in the zone.
I hope this helps a bit more to understand the concept of zones within
firewalld.
>>
>> [root at node zones]# pwd
>> /etc/firewalld/zones
>> [root at node zones]# grep target *.xml
>> [root at node zones]#
>>
>>
>> I might add it and play around.
>
>
> This seems to work. I needed to remove the ssh service as well. Having
> the ssh service might have been the problem in the first place.
> Regardless, it seems to negate my rich rules. The clue was that the
> rules would disappear (guessing optimized out) from one
>
> "firewall-cmd --zone=public --list-all" to the next.
>
> I have (since removed) the --add-port protocol="tcp" port="80" for
> Apache, and added it as a service.
>
> Time for a pint.
>
> Thanks everyone
> MikeC
>
Regards,
Thomas
>
>
> _______________________________________________
> firewalld-users mailing list
> firewalld-users at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/firewalld-users
More information about the firewalld-users
mailing list