Difference between revisions of "RHEL Firewalld Notes"
Jump to navigation
Jump to search
Michael.mast (talk | contribs) (Created page with "==Purpose== General notes to self on firewalld configurations. Most of the time my servers are simple enough that I do not need to make changes to zones and what not. ==Zones=...") |
Michael.mast (talk | contribs) |
||
| Line 1: | Line 1: | ||
==Purpose== | ==Purpose== | ||
General notes to self on firewalld configurations. Most of the time my servers are simple enough that I do not need to make changes to zones and what not. | General notes to self on firewalld configurations. Most of the time my servers are simple enough that I do not need to make changes to zones and what not. | ||
| + | ==Rich Rules== | ||
| + | From my notes working with Amazon Linux 2. The following will allow http/s from all, drop ssh from all, but allow ssh from a subnet and IP that I source from. | ||
| + | <pre> | ||
| + | sudo systemctl start firewalld | ||
| + | sudo systemctl enable firewalld | ||
| + | sudo firewall-cmd --permanent --add-service=http | ||
| + | sudo firewall-cmd --permanent --add-service=https | ||
| + | sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=xxx.xxx.xxx.0/24 service name=ssh accept' | ||
| + | sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=xxx.xxx.xxx.xxx service name=ssh accept' | ||
| + | sudo firewall-cmd --permanent --remove-service=ssh | ||
| + | sudo firewall-cmd --reload | ||
| + | </pre> | ||
| + | Here is an example of allowing a specific port, in this case I wanted nxfilter to receive netflow data from a specific host. | ||
| + | <pre> | ||
| + | firewall-cmd --permanent --add-rich-rule='rule family=ipv4 port port=2055 protocol=udp source address=xxx.xxx.xxx.xxx accept' | ||
| + | </pre> | ||
==Zones== | ==Zones== | ||
<ref>https://www.digitalocean.com/community/tutorials/how-to-set-up-a-firewall-using-firewalld-on-centos-7</ref><ref>https://serverfault.com/questions/798051/firewalld-allow-connections-only-from-certain-ip-addresses</ref> | <ref>https://www.digitalocean.com/community/tutorials/how-to-set-up-a-firewall-using-firewalld-on-centos-7</ref><ref>https://serverfault.com/questions/798051/firewalld-allow-connections-only-from-certain-ip-addresses</ref> | ||
Revision as of 11:45, 10 July 2018
Purpose
General notes to self on firewalld configurations. Most of the time my servers are simple enough that I do not need to make changes to zones and what not.
Rich Rules
From my notes working with Amazon Linux 2. The following will allow http/s from all, drop ssh from all, but allow ssh from a subnet and IP that I source from.
sudo systemctl start firewalld sudo systemctl enable firewalld sudo firewall-cmd --permanent --add-service=http sudo firewall-cmd --permanent --add-service=https sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=xxx.xxx.xxx.0/24 service name=ssh accept' sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=xxx.xxx.xxx.xxx service name=ssh accept' sudo firewall-cmd --permanent --remove-service=ssh sudo firewall-cmd --reload
Here is an example of allowing a specific port, in this case I wanted nxfilter to receive netflow data from a specific host.
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 port port=2055 protocol=udp source address=xxx.xxx.xxx.xxx accept'
Zones
firewall-cmd --permanent --zone=dmz --change-interface=eth0 firewall-cmd --permanent --zone=dmz --remove-service=ssh firewall-cmd --permanent --zone=dmz --add-service=http firewall-cmd --permanent --zone=dmz --add-source=xxx.xxx.xxx.xxx firewall-cmd --reload
