Advertisement
Help Keep Boards Alive. Support us by going ad free today. See here: https://subscriptions.boards.ie/.
If we do not hit our goal we will be forced to close the site.

Current status: https://keepboardsalive.com/

Annual subs are best for most impact. If you are still undecided on going Ad Free - you can also donate using the Paypal Donate option. All contribution helps. Thank you.
https://www.boards.ie/group/1878-subscribers-forum

Private Group for paid up members of Boards.ie. Join the club.

firewalld driving me barmy.

  • 06-08-2014 04:10PM
    #1
    Sebzy
    Registered Users, Registered Users 2 Posts: 1,775 ✭✭✭


    Just setting up new RHEL7 box and trying to get my head around firewalld.

    Been using iptables for all my rules now for years and was quite happy.

    Typically I would setup a rule like this in /etc/sysconfig/iptables and restart the firewall.

    -A INPUT -s 10.10.1.0/24 -p tcp -m tcp --dport 22-j ACCEPT -m comment --comment "private ssh for admin"

    Now with firewalld I have two choices

    1. Use a zone and a service
    firewall-cmd --permanent --add-service=ssh
    Looks good but how do I customize the service definition to specify a source network??

    2. Use a direct rule such as this.
    firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -p tcp --dport 22 -s 10.10.1.0/24 -j ACCEPT -m comment --comment "private ssh for admin"
    but when restarting firewalld I loose my rule. I'm unable to use --permanent in conjunction with --direct

    If anyone has any advice on the best way to configure this it would be very welcome.


Comments

  • #2
    ressem
    Registered Users, Registered Users 2, Paid Member Posts: 2,427 ✭✭✭ressem 


    firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.10.1.0/24" service name="ssh" accept'

    which will add the rich rule into your default zone (/etc/firewalld/zones/) probably public.xml.


  • #3
    Sebzy
    Registered Users, Registered Users 2 Posts: 1,775 ✭✭✭Sebzy


    ressem wrote: »
    firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.10.1.0/24" service name="ssh" accept'

    which will add the rich rule into your default zone (/etc/firewalld/zones/) probably public.xml.

    Thanks for that. Now if there was some way to embed comments my life would be so much simpler.


Advertisement