2

Disclaimer: It's the first time I use firewalld, be gentle :) .


I have a CentOS machine and I want to implement the following requirements using firewalld:

  • Allow connections from anywhere to ports 1, 2, 3, 4.
  • Allow connections to port 5 only from IP addresses IP1, IP2 and IP3
  • Completely block connections to port 6, from anywhere.

So I did this:

  • added the ports 1, 2, 3 and 4 to the public zone
  • added port 5 and IP addresses IP1, IP2 and IP3 to zone trusted

Now the zones look like this:

public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eno12345
  sources:
  services: ssh dhcpv6-client
  ports: 1/tcp 2/tcp 3/tcp 4/tcp
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

trusted (active)
  target: ACCEPT
  icmp-block-inversion: no
  interfaces:
  sources: IP1 IP2 IP3
  services:
  ports: 5/tcp
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

Note: public is the default zone.

So the first 2 rules seem to be applied correctly.

However I got stuck with the final rule (completely block port 6). I tried multiple solutions and none seem to work.

1). What should I do to apply this?

2). How come I can connect through port 6 even though it's not explicitly listed as allowed in the firewalld configuration? No rule about it is added in iptables either.

2

Some generic command are below

firewall-cmd --list-ports
firewall-cmd --get-zones
firewall-cmd --zone=public --add-port=5000/tcp

For some more docs and more details, please check it. https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Configuring_firewalld.html

2

The way I solved it is I added a rich rule in the trusted zone:

rule family="ipv4" port port="6" protocol="tcp" drop

From what I know, rich rules are applied first. It seems to be working correctly in my case.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.