Questions tagged [firewall-cmd]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
49 views

Firewalld port forwarding fails

I'm trying to replace an existing tunnel with firewall rules: firewall-cmd --zone=public --add-forward-port=port=9999:proto=tcp:toport=9999:toaddr=100.1.1.1 This should forward all incoming TCP ...
user avatar
  • 243
0 votes
0 answers
37 views

How to close podman exposed port on public interface

I have running AdGuardHome instance on podman with WebUI port -p 8053:80. # podman port -a 1aeb8e800717 53/tcp -> 0.0.0.0:53 1aeb8e800717 853/tcp -> 0.0.0.0:853 1aeb8e800717 5443/tcp -&...
user avatar
1 vote
1 answer
48 views

How to block all outgoing connections from a particular user except localhost?

I wish to block all outgoing connections from a particular user user after they have ssh'd into my server (running RHEL 7.4), that is, user should not be able to ssh into/ping other servers on the ...
user avatar
  • 201
0 votes
1 answer
53 views

firewall-cmd - adding 0.0.0.0/0 as a source in one zone blocks more specific access in another zone

I have two firewalld zones configured as follows: zone: ssh-access source: 1.2.3.4 ports: 9999/tcp zone: other-access source: 5.6.7.8 ports: 8888/tcp We temporarily want to unrestrict access to the ...
user avatar
  • 101
0 votes
1 answer
85 views

CentOS firewall-cmd script to only allow access from IPs listed in sources

I use this script to set up my firewall. I expected to have ssh access from only one IP but that is not the case after testing. What is missing? #!/bin/bash # # Reset to initial install of firewalld # ...
user avatar
  • 121
1 vote
0 answers
159 views

Port forwarding while preserving the source IP address with firewalld

I signed up with a new ISP and they dont provide me with a external IPv4 address. Ive set up a virtual server (S) (that has an address) to relay all my stuff to my box at home (B) using a wireguard ...
user avatar
0 votes
0 answers
95 views

How do I block UPnP except for a select group of IP addresses?

I have researched on here and Googled a lot of stuff but I cannot get an answer to blocking UPnP. One of our security scan declares UPnP is a vulnerability and to restrict access. I have been trying ...
user avatar
0 votes
1 answer
140 views

How to allow an ip address to access a specific port on the server without blocking other traffic

First off, am using Firewalld and my configuration is as follows: All traffic is allowed (nothin fancy). Server has MySQL and Apache2 (Linux Debian) I need to allow MySQL remote connections to a ...
user avatar
  • 121
0 votes
0 answers
429 views

docker-proxy port 5000 not obeying firewall-cmd rules

I am running Red Hat Enterprise Linux 7.9, where I'm trying to block docker-proxy TCP port 5000 via firewall-cmd. I am using the default public zone as the only active zone and have tried the ...
user avatar
0 votes
2 answers
360 views

Firewalld insert rule before ESTABLISHED

I want to ban already established connections. Default iptables rules generated by firewalld -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -j ...
user avatar
  • 274
0 votes
1 answer
1k views

How to add a new zone in firewalld without blocking `port=80/tcp` in `zone=public` in Ubuntu 20.04

I'm not too familiar with firewalld, but I thought I'd try it out on Ubuntu20.04. The problem I'm having is that port=80/tcp in zone=public gets blocked every time I try to add a new zone. So my ...
user avatar
  • 7,073
1 vote
0 answers
79 views

Equivalent ipfw config for firewalld

On a system managed by firewalld it is possible to redirect incoming traffic on 443 to 8443 so the process listening doesn't have to run as root to bind to 443 which requires root. firewall-cmd --add-...
user avatar
  • 111
0 votes
0 answers
635 views

Firewalld will not start on CentOS

I have a CentOS server that I recently ran yum-update on and the only update was to centos-release. I applied the update and ever since FirewallD has been throwing errors. I uninstalled and ...
user avatar
  • 103
0 votes
1 answer
642 views

Stopping firewall on CentOS 7

I am having a problem with my CentOS 7 server By accident i run command # firewalld Then i found that the log file in /var/log/firewalld was updated with the following 2020-11-26 12:59:08 WARNING: ...
user avatar
0 votes
0 answers
53 views

Firewalld: how are rules of the same priority ordered?

I've been playing with Firewalld and I was wondering about how it does to order rules with the same priority. According to the documentation, it says that there is no guarantee that rules with the ...
user avatar
0 votes
0 answers
173 views

Working Fedora Server 32 suffered power failure and afterward firewalld has lost its config; how can I fix this?

Doing my homework, this Server Fault Question speaks to an identical error message and it might have the same cause, but how I got there is likely different and may provide clues. In my case the ...
user avatar
  • 1,128
3 votes
1 answer
10k views

What's the difference between "firewall-cmd --reload" and "systemctl restart firewalld.service"?

What's the difference between "firewall-cmd --reload" and "systemctl restart firewalld"? Hope everyone who will answer this to have a great day!
user avatar
  • 31
0 votes
0 answers
235 views

Allow TCP traffic on port 3306 from ip range

I have problem with firewall-cmd on Centos 7. I have task: Allow TCP traffic on port 3306 from ip range 192.168.1.0/24, make sure to add this rule as second rule in the chain and second task Allow ...
user avatar
  • 119
0 votes
0 answers
126 views

How to get an IP address blocked with firewall-cmd with immediate effect?

I am having a problem, with dropping traffic using FirewallD. I start a continuous ping from host1.example.com (192.0.2.101) to host2.example.com (192.0.2.102), and when I execute either of the below ...
user avatar
  • 1
0 votes
1 answer
716 views

Firewalld still allowing traffic after removing port from zone

I have an issue with firewalld where I opened some ports and now want to close them for example I opened tcp/3000 in the public zone and now want to close it. So far I've tried this firewall-cmd --...
user avatar
1 vote
1 answer
400 views

Restrict all outbound connections to a specific interface, and block if unavailable

I'm running Centos 7 in a VM (I don't believe this should matter, but for context...) Inside the VM, I'm running software to establish a tunnel. I can already accept connections from the host okay, ...
user avatar
  • 426
1 vote
1 answer
3k views

Port Forward - KVM host forward port 23 to port 22 of a guest running an ssh service

I have a KVM server (host) with multiple virtual machines (guests). My goal is my host forward port 23 to port 22 of a guest running an ssh service. Command example... ssh root@[HOST_IP] -p 23 ...
user avatar
0 votes
1 answer
1k views

Disable ICMP reply on CentOS 7 firewall, except some IP blocks

I have a Centos 7 machine with FirewallD, and net.ipv4.conf.icmp_echo_ignore_all is set to 0. I'm seeking for some firewall configs to disable ping replies to external IP addresses, but allow some IP ...
user avatar
0 votes
1 answer
961 views

The Firewall-cmd direct rules will remain after deletion

When the firewall is running, I cannot access my website. When I turn it off, it works. I used these rules to redirect port 8443 to regular 443. firewall-cmd --zone=public --permanent --direct --...
user avatar
0 votes
1 answer
353 views

trying to close two ports with firewalld, leaving everything else open

I think I'm using the wrong technique, but not sure of the right one. Machine: Red Hat release 7.2 firewalld.noarch: 0.3.9-14.el7 I've been asked to close two ports but insure that all other ...
user avatar
0 votes
1 answer
98 views

Internal IP forwarding RHEL

Thank you in advance for your response, I've looked on the same question but nowhere to be found, so I'm gonna post here about my question, So I have a RHEL OS and I have 2 separate IP(See Image) ...
user avatar
  • 5
0 votes
0 answers
693 views

Centos7, firewall-cmd --reload, "COMMAND_FAILED --state requires an argument" How to give state an argument?

I am using Centos7 and have just made some changes to the firewall. I am trying to configure my firewall to filter my ssh connection. I am following the How To documentation on Centos7 How Tos, ...
user avatar
0 votes
2 answers
112 views

Lockdown unsecure port with firewall-cmd

I have a RedHat 7 server where we allow a few ports but one of them is insecure I would like to use firewall-cmd to lock that port down to only allow 5 IPs to access it. Do I need to make a new zone ...
user avatar
  • 45
0 votes
1 answer
1k views

Issue with firewalld

I just came across this issue and it's late here so I can't really think straight anymore right now. Still this is something pretty simple so I'm not really seeing what I'm missing and just going nuts ...
user avatar
5 votes
1 answer
9k views

Why does firewall-cmd throws error "ALREADY_ENABLED" but is the port not listed when calling firewall-cmd --list-ports?

Using CentOS 7, I am trying to use firewall-cmd --zone=public --add-port=443/tcp --permanent to add 443 to my allowed ports. Unfortunately this throws error ALREADY_ENABLED: 443:tcp. But when I use ...
user avatar
  • 153
0 votes
1 answer
70 views

CentOS 7 iptables output does match output of firewall-cmd

Output of iptables -L -v -n does not match firewall-cmd --list-all-zones. Specifically, I'm looking for the forwarding rules I have in place for two virtual machines. They can be clearly seen with ...
user avatar
6 votes
2 answers
16k views

Remove --add-forward-port rule in firewall-cmd

Some time ago I added below rule for local port forwarding firewall-cmd --permanent --add-forward-port=port=80:proto=tcp:toport=3000 How can I remove this rule now?
user avatar
1 vote
1 answer
421 views

FirewallD not loading rule after reboot

I have FirewallD on Ubuntu Server 18.04. Got allowed services ssh http ipsec. But on reboot, firewall always allow ssh, ipsec but block http. To solve this, I have to run firewall-cmd --reload every ...
user avatar
1 vote
0 answers
36 views

Add firewall-cmd service permanently [duplicate]

On RHEL 7, I am trying to add service postgresql permanently. Without --permanent option, the command below runs well. [root@sample services]# firewall-cmd --list-services dhcpv6-client http https ...
user avatar
3 votes
4 answers
13k views

How to port forward only on a single host IP address

Short question: How do you enable port forwarding on only a single host ip address? Backstory: My Centos 7 server has 5 ip addresses. Previously I had apache listening on all of them and various ...
user avatar
0 votes
1 answer
188 views

How can I create a top priority firewall rule for a trusted mac address?

I want to accept all packets sent to my centos7 VPS from my device regardless of options defined on public zone. (I want to remove ssh service from public zone and just be able to connect from my mac ...
user avatar
0 votes
1 answer
520 views

centos 7 not allowing inbound tcp connection on port 80 when connected to two network interfaces

I connected two network interfaces to a server running centOS 7 and I configured the public zone to allow inbound tcp connections on port 80 & 443, I then set one of the network interfaces to the ...
user avatar
  • 101
1 vote
0 answers
6k views

Block outgoing connections on Centos 7 with firewalld

I'm having following rules : public (default, active) interfaces: eth0 sources: services: dhcpv6-client http https ssh ports: masquerade: no forward-ports: icmp-blocks: rich rules:...
user avatar
  • 11
1 vote
1 answer
1k views

Centos 7 firewall-cmd settings not persisting

I have decided to do a bit of spring cleaning, and am doing a refresh of some of my underlying infrastructure. One of the critical components I am overhauling is the Network Gateway server. I updated ...
user avatar
  • 151
6 votes
1 answer
13k views

is there a way to flush a whole zone's rich rules on firewalld?

I have added many rich rule with something like this: firewall-cmd --permanent --zone="thezone" --add-rich-rule='rule family=ipv4 source address=1.2.3.4 reject' And now I would like to clear/remove ...
user avatar
  • 83
3 votes
1 answer
2k views

Fail2ban redirect

I've just finished setting up fail2ban on my Centos reverse proxy server. I was able to get it to block all requests if a certain criteria was met (pretty straight forward). However, I'd now like ...
user avatar
  • 85
4 votes
2 answers
4k views

Fedora 21: Firewalld (firewall-cmd) won't PERMANENTLY assign interfaces to zones?

I installed Fedora on this one machine which is EXCLUSIVELY a gateway / firewall system. Following installation, I ran 'yum upgrade', and so it should be up to the very latest Fedora 21 - I'm a ...
user avatar
  • 1,128