1

This question already has an answer here:

Setting up a new zone, with a port that has restricted access to an IP address. How does one apply this to more than one IP?

$ firewall-cmd --new-zone=special
$ firewall-cmd --permanent --zone=special --add-rich-rule='
  rule family="ipv4"
  source address=”123.1.1.1"
  port protocol="tcp" port="10050" accept'

Is source address allowed an array of CSV? Is it defined like this?

source address="123.1.1.1","234.1.1.1"

marked as duplicate by Michael Hampton Dec 7 '16 at 1:47

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • The second solution in your linked question seems to be more appropriate for this case. – Gerald Schneider Dec 6 '16 at 13:42
  • I see what you mean, I can just call the single cmd line and it will add it to the existing zone. firewall-cmd --zone=special --add-source=231.1.1.1 – mcv Dec 6 '16 at 13:48
  • @GeraldSchneider if i define multiple IPs to a zone do I have to set the server to that zone for it to take effect? Or is firewall-cmd --reload perfectly acceptable? – mcv Dec 7 '16 at 0:22
  • @GeraldSchneider - I found the answer in the solution that I linked. – mcv Dec 7 '16 at 0:34
  • Unfortunately the accepted answer in the question you linked is... rather wrong. Check the other answer instead. See also the question I've marked as a duplicate, for the thorough explanation. – Michael Hampton Dec 7 '16 at 1:48
1

You don't need a rich rule for this. It's unnecessary and too complicated for what you want to do.

Just add the source IP addresses and desired ports to the zone directly.

For example:

firewall-cmd --zone=special --add-source=192.0.2.123
firewall-cmd --zone=special --add-source=198.51.100.7
firewall-cmd --zone=special --add-source=203.0.113.81

firewall-cmd --zone=special --add-port=10050/tcp

firewall-cmd --runtime-to-permanent
  • What does the last action firewall-cmd --runtime-to-permanent do? This is the second solution in the link. :) I eventually implemented it this way. I did try the first method though and I encountered an issue. Which is why I posted this question, but I was advised to use option 2. Which I did. :) I will accept your response though as the correct one. For it is the correct solution. – mcv Dec 7 '16 at 12:16
  • @mcv It saves the running configuration and makes it permanent... – Michael Hampton Dec 7 '16 at 16:13
  • so i placed the --permanent inside each statement, is that also okay? If I restart the firewall will this configuration load automatically? – mcv Dec 7 '16 at 16:39
  • Did you not see the other comment I left on your other question? – Michael Hampton Dec 7 '16 at 16:51
  • Thanks looking at it now. this is all new to me and the documents I have read do not discuss this --runtime-to-permenant. – mcv Dec 7 '16 at 17:00

Not the answer you're looking for? Browse other questions tagged or ask your own question.