How can I add two rules to firewalld in order to

  1. deny everyone and
  2. accept only set of several IP addresses?

In this here case I am talking about SSH port - 22.
I am using CentOS 7 and firewalld.


You can use

firewall-cmd --permanent --zone=public --add-rich-rule="rule family="ipv4" \
source address="" \
port protocol="tcp" port="22" accept"

Just replace the IP with the one you want to allow for ssh

  • Thank you and how about the rest ips. Will they automatically be denied without any more rules? – Shane Kowalsky Mar 13 '16 at 9:56
  • This depend on your current active zone, and services, see my answer. – Rabin Mar 13 '16 at 10:28

Check which zone is currently is active and used by default for your connection,

# firewall-cmd --get-active-zones 
  interfaces: work-vpn
  interfaces: enp0s25

so for example in the output above I have 2 active zones, one for each interface.

Then you need to list the active service for the specific zone,

# firewall-cmd --list-services --zone=public
dhcpv6-client mdns ssh

So in the above case the public zone have a rule to allow ssh in. And so if you like to allow access from a spesifc address, you first need to remove the ssh service, and and the rich rule from above which @noqqe mention.

# firewall-cmd 
     --permanent        # this will add the rule permanently, su make sure not to run it on a remote host, until you verified it!
     --zone=public      # to which zone add the rule, make sure is the one you actively/currently using.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.