1

I have been seeing a lot of brute force attempts on a fedora box. How do I use firewalld to block all ssh traffic outside of a given range? I'm looking for something like the iptables:

iptables -A INPUT -p tcp --destination-port 22 -m iprange --src-range 192.168.1.100-192.168.1.200 -j ACCEPT  
1
  • To handle ssh brute force there is also fail2ban.
    – hlovdal
    Feb 16, 2016 at 19:51

2 Answers 2

2

Also just as an alternative to Iptables. You can control the ssh access as followed

Edit your /etc/ssh/sshd_config

AllowUsers [email protected] [email protected] testadmin

--OR--

AllowUsers *@192.168.1.100 *@192.168.1.200

Restart sshd services.

1
  • Ha! I forgot you could do this. Thanks for the reminder. This is working for me for now.
    – satori7
    Jul 28, 2014 at 16:04
1

You should be able to do this via the rich language interface of firewalld :

firewall-cmd --add-rich-rule='rule family="ipv4" source address="192.168.1.100/25" service name="ssh" reject'

This is just written by what I found and had in memory, not tested. But it might be a starting point for you to play.

2
  • 1
    You want to reject the traffic? Jul 28, 2014 at 15:30
  • I was able to use this before to block the offending IP, but about 10 minutes later they started again from another IP. I chased them around like this for a while.
    – satori7
    Jul 28, 2014 at 16:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .