How can I add two rules to firewalld in order to
- deny everyone and
- accept only set of several IP addresses?
In this here case I am talking about SSH port - 22.
I am using CentOS 7 and firewalld.
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
You can use
firewall-cmd --permanent --zone=public --add-rich-rule="rule family="ipv4" \ source address="188.8.131.52/32" \ port protocol="tcp" port="22" accept"
Just replace the IP with the one you want to allow for ssh
Check which zone is currently is active and used by default for your connection,
# firewall-cmd --get-active-zones work interfaces: work-vpn home interfaces: enp0s25
so for example in the output above I have 2 active zones, one for each interface.
Then you need to list the active service for the specific zone,
# firewall-cmd --list-services --zone=public dhcpv6-client mdns ssh
So in the above case the public zone have a rule to allow ssh in. And so if you like to allow access from a spesifc address, you first need to remove the ssh service, and and the rich rule from above which @noqqe mention.
# firewall-cmd --permanent # this will add the rule permanently, su make sure not to run it on a remote host, until you verified it! --zone=public # to which zone add the rule, make sure is the one you actively/currently using.