Questions tagged [firewalld-zone]
The firewalld-zone tag has no usage guidance.
25
questions
0
votes
0
answers
35
views
How to DROP traffic whose source IP is on a blocklist ipset unless the source is on an allowlist ipset in firewalld?
I have 2 ipsets: friends (allow-list) and enemies (block-list).
My default zone (public) DROPs all traffic, except certain services (e.g. http).
I have edited the block zone that comes shipped with ...
- 2,969
0
votes
1
answer
32
views
How to create trap with Firewalld
I'd like to set up the following logic using firewalld
When a host attempts to access the server from the internet on port 22:
DROP and
add their IP to an ipset called "trap" (with 24 hour ...
- 2,969
0
votes
1
answer
37
views
Difficulty with Firewalld Blocking Traffic in Absence of IPTABLES Data
I have noticed that Firewalld is actively blocking incoming and outgoing connections, which is causing disruptions in my network communication. However, upon checking the system, I discovered that no ...
- 111
0
votes
0
answers
21
views
exclude a subnet from a firewalld zone?
We have a, historically grown, rather complicated network layout, forcing me to build complex and hard-to-manage firewalld zones. One thing that would really help me is if there was a way to exclude ...
- 898
0
votes
1
answer
194
views
firewalld apply interface zone after ipset zone match
I have a firewalld setup with two zones.
One zone, some-ips-allowed, is used to permit traffic from specific IP networks on some ports:
some-ips-allowed (active)
target: default
icmp-block-...
- 101
0
votes
0
answers
34
views
firewalld in RHEL9 -do I have to whitelist sources on public zone now?
we've just built our first webserver on RHEL9 (alma linux 9.1) being used to RHEL 7 (centos 7) mostly.
the firewalld config all seems the same, but when setting up our usual security setup of:
https (...
0
votes
1
answer
420
views
Firewalld without interfaces on public zone
On my Oracle Cloud server, the public zone has no interfaces attached, neither does any of the other zones.
But still if I allow a port in the public zone, it does allow the traffic through.
So why is ...
- 265
0
votes
1
answer
374
views
firewall-cmd - adding 0.0.0.0/0 as a source in one zone blocks more specific access in another zone
I have two firewalld zones configured as follows:
zone: ssh-access
source: 1.2.3.4
ports: 9999/tcp
zone: other-access
source: 5.6.7.8
ports: 8888/tcp
We temporarily want to unrestrict access to the ...
- 101
0
votes
1
answer
3k
views
How to add a new zone in firewalld without blocking `port=80/tcp` in `zone=public` in Ubuntu 20.04
I'm not too familiar with firewalld, but I thought I'd try it out on Ubuntu20.04. The problem I'm having is that port=80/tcp in zone=public gets blocked every time I try to add a new zone.
So my ...
- 7,363
0
votes
2
answers
280
views
Templating firewalld zones with ansible - issue with xml or vars
Templating firewalld zones with ansible - issue with xml manipulation
I am running into a small bit of confusion for the rule family.
whats in my CORRECTED vars file:
firewalld_zones:
- name: ...
- 1
2
votes
0
answers
921
views
using Firewalld , trying to allow all ports that come in on an internal ip
I am building a new server and i am using Firewalld for the first time.
I have a loadbalancer that takes public ip requests and routes them to one of my servers with internal IPs
These servers have ...
- 151
0
votes
0
answers
3k
views
firewalld allow ssh only from one predefined IP host or AS number net
I am using CentOS Linux release 7.9.2009 in minimal installation and firewalld .
[root@centosmin firewalld]# uname -a
Linux centosmin 3.10.0-1160.6.1.el7.x86_64 #1 SMP Tue Nov 17 13:59:11 UTC 2020 ...
- 143
0
votes
0
answers
347
views
How to get an IP address blocked with firewall-cmd with immediate effect?
I am having a problem, with dropping traffic using FirewallD.
I start a continuous ping from host1.example.com (192.0.2.101) to host2.example.com (192.0.2.102), and when I execute either of the below ...
- 1
4
votes
0
answers
4k
views
IPsets in FirewallD with Nftables backend
I upgraded my server to Fedora 32. Firewalld has switched the backend to Nftables.
My setup is pretty simple. Just HTTP, HTTPS, SSH, SMTP ports open and multiple IPsets (IPv4, IPv6) to block a preset ...
user213598
2
votes
0
answers
1k
views
firewalld: two NICs, two zones. Zone is ignored
I have a server running CentOS/RHEL 7.7 with two network interfaces. These interfaces are configured and work properly. The first interface, ens33, is part of the firewalld "public" zone. All the ...
- 21
0
votes
1
answer
428
views
block ping 8.8.8.8 in firewalld
Working from my Arch Console (having not yet installed Openbox), I've installed firewalld, sudo pacman -S firewalld, then, to check that it's overall working, firewall-cmd --panic-on correctly blocks ...
- 103
0
votes
1
answer
2k
views
Issue with firewalld
I just came across this issue and it's late here so I can't really think straight anymore right now. Still this is something pretty simple so I'm not really seeing what I'm missing and just going nuts ...
- 149
2
votes
1
answer
4k
views
Firewalld block http traffic even if activated
I'm trying to configure a simple test environment with 3 machines :
One Kali to simulate internet : IP = 10.99.0.2
One CentOS that acts as a firewall using firewalld : IPs = 10.99.0.1,
10.4.1.1
One ...
1
vote
1
answer
442
views
firewalld puppet module unable to add multiple sources error: INVALID ZONE on second source
We have a puppet module (v3.6.2 as we're using it for Satellite 6)
The module works as expected, except when adding multiple sources to a zone. It will add the zone and then add one souce, then error ...
- 11
5
votes
2
answers
70k
views
FirewallD : Allow connections only from certain IP addresses [duplicate]
I am trying to use FirewallD to restrict access to a CentOS server from other machines on the network. It has a single network interface and it is operating in the public zone. Lets say that the ip ...
- 151
1
vote
1
answer
191
views
How to configure firewalld for source-specific rules?
I have a server in a datacenter that serves as an IPA master and VPN server. For simplicity, assume I need to enable the "ipsec" service for VPN, and the "kerberos" service for IPA.
I would like to:
...
- 119
13
votes
3
answers
28k
views
firewalld not listing any active zones?
When running
[root@host ~]# firewall-cmd --get-active-zones
[root@host ~]#
[root@host ~]# firewall-cmd --get-default-zone
public
I am not getting any active zones. How can I activate a zone?
- 1,837
1
vote
0
answers
1k
views
Firewalld: Sources in Drop and Block zones
I can't get the services attaches to the block zone working for sources attached to those zones. I was wondering what the inteded purpose of source->zone<-service was..!
I was trying to use the ...
- 121
2
votes
1
answer
422
views
Firewalld management
As I asked it on this topic's comments: block all but a few ips with firewalld
I'm looking for a way to deny all public IPs except for mine on the public zone of firewalld.
For now, my public zone ...
- 955
4
votes
2
answers
5k
views
Fedora 21: Firewalld (firewall-cmd) won't PERMANENTLY assign interfaces to zones?
I installed Fedora on this one machine which is EXCLUSIVELY a gateway / firewall system.
Following installation, I ran 'yum upgrade', and so it should be up to the very latest Fedora 21 - I'm a ...
- 1,226