After some general good practice w/firewalld, as I have a set up which feels like it might a bit of a kludge.

Public zone - has interface assigned, set to 'drop'.

Internal zone - initially set up one service only, SSH, coming from a single source IP. (I know it's a class C, just to illustrate diff IPs)

Rich rules: ipv4, source SMTP, SMTPS and port 587/tcp (as submission service appears to not be installed by default with firewalld) all set to accept. can SSH fine. could not connect on port 25.

So I then deleted all those rich rules and set a new source in the internal zone of, and added in SMTP, SMTPS and port 587.

This worked - however, could also SSH, which wasn't required. Instead I put in an explicit rich rule to deny over SSH.

This got me to where I wanted to go, but is it a slightly clunky way of doing it? Could anyone shed any light on why the rich rules weren't working properly?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.