Questions tagged [firewall-cmd]
The firewall-cmd tag has no usage guidance.
45
questions
0
votes
1
answer
704
views
Networking issue with Fedora Server 38 as a firewall / gateway
This environment has twins of virtually everything, including two web server / firewall / gateway systems, and they were getting long-in-the-tooth version wise, so I decided to upgrade from Fedora ...
- 1,242
0
votes
1
answer
443
views
Debian 11 firewalld+nftables rules not taking effect
Update: after commenting out the line in /etc/hosts that is kinda like
#127.0.1.1 my-host.domain.edu my-host
and rebooting, the firewall does open the expected ports. I thought to do this because, ...
- 1
0
votes
0
answers
255
views
firewall-cmd block outgoing connection to an ip list
I have searched a lot about this, this is possible to have many of these commands one for each ip:
/usr/bin/firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -d ::FFFF:85.185.0.0/112 -j REJECT
/...
- 173
0
votes
1
answer
192
views
firewalld stopping for no reason
I have a Red Hat 8 server. On it, I have used firewall-cmd --permanent --zone=public --add-service=https to enable public traffic to the server. When I systemctl start firewalld, this works as ...
- 101
0
votes
0
answers
89
views
Remote IP Port Forwarding with SSH but with firewall.cmd or IPTables now
The context:
I'm working with Zabbix Server and need to monitor remote servers conected with VPN/SSL tunnel using OpenFortiVPN with Any-Any rule set by our external Datacenter Provider.
Local IP of ...
- 1
0
votes
1
answer
3k
views
Firewalld port forwarding fails
I'm trying to replace an existing tunnel with firewall rules:
firewall-cmd --zone=public --add-forward-port=port=9999:proto=tcp:toport=9999:toaddr=100.1.1.1
This should forward all incoming TCP ...
- 265
1
vote
1
answer
297
views
How to block all outgoing connections from a particular user except localhost?
I wish to block all outgoing connections from a particular user user after they have ssh'd into my server (running RHEL 7.4), that is, user should not be able to ssh into/ping other servers on the ...
- 211
0
votes
1
answer
409
views
firewall-cmd - adding 0.0.0.0/0 as a source in one zone blocks more specific access in another zone
I have two firewalld zones configured as follows:
zone: ssh-access
source: 1.2.3.4
ports: 9999/tcp
zone: other-access
source: 5.6.7.8
ports: 8888/tcp
We temporarily want to unrestrict access to the ...
- 101
0
votes
1
answer
679
views
CentOS firewall-cmd script to only allow access from IPs listed in sources
I use this script to set up my firewall. I expected to have ssh access from only one IP but that is not the case after testing. What is missing?
#!/bin/bash
#
# Reset to initial install of firewalld
#
...
- 121
1
vote
1
answer
771
views
Port forwarding while preserving the source IP address with firewalld
I signed up with a new ISP and they dont provide me with a external IPv4 address. Ive set up a virtual server (S) (that has an address) to relay all my stuff to my box at home (B) using a wireguard ...
- 11
0
votes
1
answer
503
views
How to allow an ip address to access a specific port on the server without blocking other traffic
First off, am using Firewalld and my configuration is as follows:
All traffic is allowed (nothin fancy).
Server has MySQL and Apache2 (Linux Debian)
I need to allow MySQL remote connections to a ...
- 121
0
votes
0
answers
977
views
docker-proxy port 5000 not obeying firewall-cmd rules
I am running Red Hat Enterprise Linux 7.9, where I'm trying to block docker-proxy TCP port 5000 via firewall-cmd. I am using the default public zone as the only active zone and have tried the ...
- 101
0
votes
2
answers
763
views
Firewalld insert rule before ESTABLISHED
I want to ban already established connections.
Default iptables rules generated by firewalld
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -j ...
- 294
0
votes
1
answer
3k
views
How to add a new zone in firewalld without blocking `port=80/tcp` in `zone=public` in Ubuntu 20.04
I'm not too familiar with firewalld, but I thought I'd try it out on Ubuntu20.04. The problem I'm having is that port=80/tcp in zone=public gets blocked every time I try to add a new zone.
So my ...
- 7,403
1
vote
0
answers
156
views
Equivalent ipfw config for firewalld
On a system managed by firewalld it is possible to redirect incoming traffic on 443 to 8443 so the process listening doesn't have to run as root to bind to 443 which requires root.
firewall-cmd --add-...
- 111
0
votes
0
answers
1k
views
Firewalld will not start on CentOS
I have a CentOS server that I recently ran yum-update on and the only update was to centos-release. I applied the update and ever since FirewallD has been throwing errors.
I uninstalled and ...
- 103
0
votes
1
answer
1k
views
Stopping firewall on CentOS 7
I am having a problem with my CentOS 7 server
By accident i run command
# firewalld
Then i found that the log file in /var/log/firewalld was updated with the following
2020-11-26 12:59:08 WARNING: ...
- 3
0
votes
0
answers
453
views
Firewalld: how are rules of the same priority ordered?
I've been playing with Firewalld and I was wondering about how it does to order rules with the same priority.
According to the documentation, it says that there is no guarantee that rules with the ...
0
votes
0
answers
256
views
Working Fedora Server 32 suffered power failure and afterward firewalld has lost its config; how can I fix this?
Doing my homework, this Server Fault Question speaks to an identical error message and it might have the same cause, but how I got there is likely different and may provide clues.
In my case the ...
- 1,242
5
votes
1
answer
25k
views
What's the difference between "firewall-cmd --reload" and "systemctl restart firewalld.service"?
What's the difference between firewall-cmd --reload and systemctl restart firewalld?
- 51
0
votes
0
answers
391
views
Allow TCP traffic on port 3306 from ip range
I have problem with firewall-cmd on Centos 7. I have task:
Allow TCP traffic on port 3306 from ip range 192.168.1.0/24, make sure to add this rule as second rule in the chain
and second task
Allow ...
- 159
0
votes
0
answers
381
views
How to get an IP address blocked with firewall-cmd with immediate effect?
I am having a problem, with dropping traffic using FirewallD.
I start a continuous ping from host1.example.com (192.0.2.101) to host2.example.com (192.0.2.102), and when I execute either of the below ...
- 1
0
votes
1
answer
1k
views
Firewalld still allowing traffic after removing port from zone
I have an issue with firewalld where I opened some ports and now want to close them for example I opened tcp/3000 in the public zone and now want to close it. So far I've tried this
firewall-cmd --...
- 1
1
vote
1
answer
960
views
Restrict all outbound connections to a specific interface, and block if unavailable
I'm running Centos 7 in a VM (I don't believe this should matter, but for context...)
Inside the VM, I'm running software to establish a tunnel. I can already accept connections from the host okay, ...
- 426
2
votes
1
answer
5k
views
Port Forward - KVM host forward port 23 to port 22 of a guest running an ssh service
I have a KVM server (host) with multiple virtual machines (guests).
My goal is my host forward port 23 to port 22 of a guest running an ssh service.
Command example...
ssh root@[HOST_IP] -p 23
...
- 269
0
votes
1
answer
2k
views
Disable ICMP reply on CentOS 7 firewall, except some IP blocks
I have a Centos 7 machine with FirewallD, and net.ipv4.conf.icmp_echo_ignore_all is set to 0.
I'm seeking for some firewall configs to disable ping replies to external IP addresses, but allow some IP ...
0
votes
1
answer
1k
views
The Firewall-cmd direct rules will remain after deletion
When the firewall is running, I cannot access my website. When I turn it off, it works.
I used these rules to redirect port 8443 to regular 443.
firewall-cmd --zone=public --permanent --direct --...
- 11
0
votes
1
answer
620
views
trying to close two ports with firewalld, leaving everything else open
I think I'm using the wrong technique, but not sure of the right one.
Machine: Red Hat release 7.2
firewalld.noarch: 0.3.9-14.el7
I've been asked to close two ports but insure that all other ...
0
votes
1
answer
112
views
Internal IP forwarding RHEL
Thank you in advance for your response,
I've looked on the same question but nowhere to be found, so I'm gonna post here about my question,
So I have a RHEL OS and I have 2 separate IP(See Image)
...
- 5
0
votes
0
answers
926
views
Centos7, firewall-cmd --reload, "COMMAND_FAILED --state requires an argument" How to give state an argument?
I am using Centos7 and have just made some changes to the firewall. I am trying to configure my firewall to filter my ssh connection. I am following the How To documentation on Centos7 How Tos, ...
- 41
0
votes
2
answers
145
views
Lockdown unsecure port with firewall-cmd
I have a RedHat 7 server where we allow a few ports but one of them is insecure I would like to use firewall-cmd to lock that port down to only allow 5 IPs to access it. Do I need to make a new zone ...
- 45
0
votes
1
answer
2k
views
Issue with firewalld
I just came across this issue and it's late here so I can't really think straight anymore right now. Still this is something pretty simple so I'm not really seeing what I'm missing and just going nuts ...
- 149
5
votes
1
answer
14k
views
Why does firewall-cmd throws error "ALREADY_ENABLED" but is the port not listed when calling firewall-cmd --list-ports?
Using CentOS 7, I am trying to use firewall-cmd --zone=public --add-port=443/tcp --permanent to add 443 to my allowed ports. Unfortunately this throws error ALREADY_ENABLED: 443:tcp. But when I use ...
- 153
0
votes
1
answer
193
views
CentOS 7 iptables output does match output of firewall-cmd
Output of iptables -L -v -n does not match firewall-cmd --list-all-zones.
Specifically, I'm looking for the forwarding rules I have in place for two virtual machines. They can be clearly seen with ...
6
votes
2
answers
21k
views
Remove --add-forward-port rule in firewall-cmd
Some time ago I added below rule for local port forwarding
firewall-cmd --permanent --add-forward-port=port=80:proto=tcp:toport=3000
How can I remove this rule now?
- 209
2
votes
1
answer
732
views
FirewallD not loading rule after reboot
I have FirewallD on Ubuntu Server 18.04. Got allowed services ssh http ipsec.
But on reboot, firewall always allow ssh, ipsec but block http.
To solve this, I have to run firewall-cmd --reload every ...
- 21
1
vote
0
answers
37
views
Add firewall-cmd service permanently [duplicate]
On RHEL 7, I am trying to add service postgresql permanently.
Without --permanent option, the command below runs well.
[root@sample services]# firewall-cmd --list-services
dhcpv6-client http https ...
- 209
3
votes
4
answers
15k
views
How to port forward only on a single host IP address
Short question:
How do you enable port forwarding on only a single host ip address?
Backstory:
My Centos 7 server has 5 ip addresses. Previously I had apache listening on all of them and various ...
- 363
0
votes
1
answer
312
views
How can I create a top priority firewall rule for a trusted mac address?
I want to accept all packets sent to my centos7 VPS from my device regardless of options defined on public zone. (I want to remove ssh service from public zone and just be able to connect from my mac ...
- 461
0
votes
1
answer
689
views
centos 7 not allowing inbound tcp connection on port 80 when connected to two network interfaces
I connected two network interfaces to a server running centOS 7 and I configured the public zone to allow inbound tcp connections on port 80 & 443, I then set one of the network interfaces to the ...
- 101
1
vote
0
answers
6k
views
Block outgoing connections on Centos 7 with firewalld
I'm having following rules :
public (default, active)
interfaces: eth0
sources:
services: dhcpv6-client http https ssh
ports:
masquerade: no
forward-ports:
icmp-blocks:
rich rules:...
- 11
1
vote
1
answer
1k
views
Centos 7 firewall-cmd settings not persisting
I have decided to do a bit of spring cleaning, and am doing a refresh of some of my underlying infrastructure.
One of the critical components I am overhauling is the Network Gateway server. I updated ...
- 171
6
votes
1
answer
15k
views
is there a way to flush a whole zone's rich rules on firewalld?
I have added many rich rule with something like this:
firewall-cmd --permanent --zone="thezone" --add-rich-rule='rule family=ipv4 source address=1.2.3.4 reject'
And now I would like to clear/remove ...
- 83
3
votes
1
answer
2k
views
Fail2ban redirect
I've just finished setting up fail2ban on my Centos reverse proxy server. I was able to get it to block all requests if a certain criteria was met (pretty straight forward).
However, I'd now like ...
- 95
4
votes
2
answers
5k
views
Fedora 21: Firewalld (firewall-cmd) won't PERMANENTLY assign interfaces to zones?
I installed Fedora on this one machine which is EXCLUSIVELY a gateway / firewall system.
Following installation, I ran 'yum upgrade', and so it should be up to the very latest Fedora 21 - I'm a ...
- 1,242