1

In firewalld, I can assign a zone to an network interface. A zone contains some firewall rules.

Now I have a network interface with different levels of trust (172.16.1.1/32 should have special access in the 172.16.1.0/24 network). For example SSH access for an admin host.

The only way I found to realize that, is to use a rich rule. But I am not happy with this approach, because it's basically an iptables rule without the possibility to give a description. Is there a way to create a separate zone or subzone for the admin host?

The advantage would be, that the configuration is more readable. I could create a ManagmentZone with special permissions. And when another Admin-PC comes to life, I can simply add its address to this zone.

  • You could just add these IP addresses to the trusted zone, or a new zone. – Michael Hampton Nov 11 '15 at 14:34
  • Thanks! I did not understand that I can add ip ranges to zones: firewall-cmd --permanent --zone=trusted --add-source=192.168.2.0/24 – Mathias Vetsch Nov 11 '15 at 14:48
1

Is there a way to create a separate zone?

Yes, you can create new zones:

https://fedoraproject.org/wiki/FirewallD#How_to_configure_or_add_zones.3F

How to configure or add zones?

To configure or add zones you can either use one of the firewalld interfaces to handle and change the configuration. These are the graphical configuration tool firewall-config, the command line tool firewall-cmd or the D-BUS interface. Or you can create or copy a zone file in one of the configuration directories. @PREFIX@/lib/firewalld/zones is used for default and fallback configurations and /etc/firewalld/zones is used for user created and customized configuration files.

From http://www.certdepot.net/rhel7-get-started-firewalld/

# firewall-cmd --permanent --new-zone=test
success
# firewall-cmd --reload
success

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.