I would appreciate some assistance with configuring firewalld please. Here's a bit of background. All I want to do is prevent all access- except whitelisted IP addresses to a web application running on https.

I have done much googling. learnt a number of things but none has worked yet. Here's what I have done:

  1. I can tell firewalld is running

    # systemctl status firewalld
    firewalld.service - firewalld - dynamic     firewall daemon    Loaded: loaded
    (/usr/lib/systemd/system/firewalld.service; enabled)    Active: active

also with

    # firewall-cmd –state
  1. I have the default zones

    # firewall-cmd --get-zones
    block dmz drop external home internal public trusted work
  2. My active zones include:

    # firewall-cmd --get-active-zones
  3. My default zone is public:

    # firewall-cmd --get-default-zone
  4. The details of public are:

    public (default)   
    services: http https ssh   
    masquerade: no   
    rich rules:

My understanding is that the configuration for public zone above will restrict only grant to requests from any of the specified IP addresses. However, when I try accessing https://www.example.com from an IP outside the listed, it allows it.


1 Answer 1


one option is to remove the service: https from the zone

firewall-cmd --zone=public --remove-service=https

and then use what is known as rich rules to specify what sources [IP addresses] may access what service [such as http and https] like so:

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="x.x.x.0/24" service name="https" log prefix="https" level="info" accept'

might need to reload though

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.