LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 06-06-2016, 01:45 PM   #1
vmxes
LQ Newbie
 
Registered: Jun 2016
Posts: 5

Rep: Reputation: Disabled
Question Firewalld not blocking incoming requests


Hello,

I use CentOS and just changed my firewalld settings to use drop zone and allow incoming traffic only from some IP ranges.
I think my setup is not correct as I can still access my server from anywhere.
What did I wrong?

My setup:
Code:
firewall-cmd --get-active-zones                                                                    drop
  interfaces: enp1s0
Code:
firewall-cmd --state
running
Code:
firewall-cmd --zone=drop --list-all
drop (default, active)
  interfaces: enp1s0
  sources:
  services:
  ports: 8080/tcp 80/tcp 8888/tcp 22/tcp
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules:
        rule family="ipv4" source address="180.76.0.0/16" accept
        rule family="ipv4" source address="46.107.0.0/16" accept
        rule family="ipv4" source address="188.6.0.0/16" accept
        rule family="ipv4" source address="178.48.0.0/16" accept
        rule family="ipv4" source address="84.0.0.0/16" accept
        rule family="ipv4" source address="84.2.0.0/16" accept
 
Old 06-06-2016, 04:15 PM   #2
custangro
Senior Member
 
Registered: Nov 2006
Location: California
Distribution: Fedora , CentOS , RHEL
Posts: 1,978
Blog Entries: 1

Rep: Reputation: 209Reputation: 209Reputation: 209
Try adding a rich rule to drop all other traffic
 
Old 06-06-2016, 04:29 PM   #3
vmxes
LQ Newbie
 
Registered: Jun 2016
Posts: 5

Original Poster
Rep: Reputation: Disabled
Do you mean adding the rule below at the end?

Code:
firewall-cmd --zone=drop --permanent --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" reject'
 
Old 06-06-2016, 04:31 PM   #4
custangro
Senior Member
 
Registered: Nov 2006
Location: California
Distribution: Fedora , CentOS , RHEL
Posts: 1,978
Blog Entries: 1

Rep: Reputation: 209Reputation: 209Reputation: 209
Yes, test that out and see if that's the behavior you want.
 
Old 06-06-2016, 04:50 PM   #5
vmxes
LQ Newbie
 
Registered: Jun 2016
Posts: 5

Original Poster
Rep: Reputation: Disabled
Unfortunately if I add the reject rule it kills my accept rules and I can not connect to the server
 
Old 06-07-2016, 03:24 AM   #6
vmxes
LQ Newbie
 
Registered: Jun 2016
Posts: 5

Original Poster
Rep: Reputation: Disabled
Now it seems I have found the solution. I removed all port entries and add only specific rich rules.
Now my config looks like this:

Code:
firewall-cmd --list-all
drop (default, active)
  interfaces: enp1s0
  sources:
  services:
  ports:
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules:
        rule family="ipv4" source address="192.168.0.0/16" port port="22" protocol="tcp" accept
        ...
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Block incoming IPv6 access to LAN clients with firewalld? n0xlf Linux - Networking 2 09-12-2014 08:23 PM
UFW blocking certain incoming requests and not sure why smells_of_elderberries Linux - Security 10 04-02-2013 06:19 PM
Routing incoming requests to different IP anthill Linux - Networking 1 09-18-2007 11:37 PM
Forward incoming requests to another server ajaimes Linux - Networking 4 06-04-2007 01:43 PM
HELP with incoming requests guild Linux - Networking 2 09-19-2003 11:46 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 05:42 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration