Difference between revisions of "RHEL Firewalld Notes"
Jump to navigation
Jump to search
Michael.mast (talk | contribs) |
Michael.mast (talk | contribs) |
||
| Line 2: | Line 2: | ||
General notes to self on firewalld configurations. Most of the time my servers are simple enough that I do not need to make changes to zones and what not. | General notes to self on firewalld configurations. Most of the time my servers are simple enough that I do not need to make changes to zones and what not. | ||
==Rich Rules== | ==Rich Rules== | ||
| − | From my notes working with Amazon Linux 2. The following will allow http/s from all, drop ssh from all, but allow ssh from a subnet and IP that I source from. | + | From my notes working with Amazon Linux 2. The following will allow http/s from all, drop ssh from all, but allow ssh from a subnet and IP that I source from.<ref>https://www.rootusers.com/how-to-use-firewalld-rich-rules-and-zones-for-filtering-and-nat/</ref> |
<pre> | <pre> | ||
sudo systemctl start firewalld | sudo systemctl start firewalld | ||
| Line 17: | Line 17: | ||
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 port port=2055 protocol=udp source address=xxx.xxx.xxx.xxx accept' | firewall-cmd --permanent --add-rich-rule='rule family=ipv4 port port=2055 protocol=udp source address=xxx.xxx.xxx.xxx accept' | ||
</pre> | </pre> | ||
| + | |||
==Zones== | ==Zones== | ||
<ref>https://www.digitalocean.com/community/tutorials/how-to-set-up-a-firewall-using-firewalld-on-centos-7</ref><ref>https://serverfault.com/questions/798051/firewalld-allow-connections-only-from-certain-ip-addresses</ref> | <ref>https://www.digitalocean.com/community/tutorials/how-to-set-up-a-firewall-using-firewalld-on-centos-7</ref><ref>https://serverfault.com/questions/798051/firewalld-allow-connections-only-from-certain-ip-addresses</ref> | ||
Revision as of 11:45, 10 July 2018
Purpose
General notes to self on firewalld configurations. Most of the time my servers are simple enough that I do not need to make changes to zones and what not.
Rich Rules
From my notes working with Amazon Linux 2. The following will allow http/s from all, drop ssh from all, but allow ssh from a subnet and IP that I source from.[1]
sudo systemctl start firewalld sudo systemctl enable firewalld sudo firewall-cmd --permanent --add-service=http sudo firewall-cmd --permanent --add-service=https sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=xxx.xxx.xxx.0/24 service name=ssh accept' sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=xxx.xxx.xxx.xxx service name=ssh accept' sudo firewall-cmd --permanent --remove-service=ssh sudo firewall-cmd --reload
Here is an example of allowing a specific port, in this case I wanted nxfilter to receive netflow data from a specific host.
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 port port=2055 protocol=udp source address=xxx.xxx.xxx.xxx accept'
Zones
firewall-cmd --permanent --zone=dmz --change-interface=eth0 firewall-cmd --permanent --zone=dmz --remove-service=ssh firewall-cmd --permanent --zone=dmz --add-service=http firewall-cmd --permanent --zone=dmz --add-source=xxx.xxx.xxx.xxx firewall-cmd --reload
