0

The particular server in question is running CentOS 7 and provides services on the following ports, Port 22 (SSH) and Port Range 11224-12224 (Mostly reverse ssh tunnel). The server is reachable from public IP, SSH is allowed only thru cert login and fail2ban is in place.

  1. Port 22: To be kept open for public access. (As remote servers connects to this and bind port in the below range for access)

  2. Port Range 11224-12224 - To be kept open for access only from private IP ranges (10.0.0.0 – 10.255.255.255, 172.16.0.0 – 172.31.255.255, 192.168.0.0 – 192.168.255.255)

  3. ICMP : To be kept open for access only from private IP ranges (10.0.0.0 – 10.255.255.255, 172.16.0.0 – 172.31.255.255, 192.168.0.0 – 192.168.255.255)

I am comfortable with iptables but firewalld is new to me and I am myself connected remotely thru ssh, hence looking for an authoritative answer than trial and error and locking myself out. Firewalld is in stock condition with no modification.

2
  • RedHat's RHEL documentation is usually quite thorough and task-oriented. You'll be happy to find that firewall-cmd has a --timeout option that can undo changes after a few seconds or minutes, in the unlikely case you lock yourself out. Dec 20, 2017 at 6:37
  • @Ulrich SchwarzI had have gone tru RHEL documentation, but I was am not confident enough to go for a trail. --timeout option is nice, I was planning for an hourly reboot will I get the rules right. Thank you for the pointers. Dec 20, 2017 at 7:06

1 Answer 1

2

Port 22:

firewall-cmd --permanent --zone=public --add-service=ssh # persistent setting
firewall-cmd --reload

Port Range 11224-12224:

firewall-cmd --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="11224-12224" protocol="tcp" accept'
firewall-cmd --add-rich-rule='rule family="ipv4" source address="172.16.0.0/12" port port="11224-12224" protocol="tcp" accept'
firewall-cmd --add-rich-rule='rule family="ipv4" source address="192.168.0.0/16" port port="11224-12224" protocol="tcp" accept'
firewall-cmd --reload

See: https://fedoraproject.org/wiki/Features/FirewalldRichLanguage

ICMP:

Don't blindly block all ICMP. You'll break Path MTU Discovery, causing any connection that transfers maximum-size packets through a VPN, IPv6 gateway, several types of cloud services, etc. to not work unless you reduce your MTU value for all connections. The operating system already considers sending of ICMP responses a low-priority task which can be ignored if it would cause an excessive workload.

When someone attempts to ping a host that does not exist, the router upstream of the missing host will send an ICMP "Host Unreachable" message back to the pinger. If you block ping responses, the pinger can still determine your host's existence like this:

  • ping response received = host exists
  • no ping response but ICMP "Host Unreachable" from the router closest to the target host = host does not exist
  • no ping response and no ICMP = host very probably exists and is blocking pings.

This is fairly trivial to do.

2
  • Thanks for the rules. Regarding ICMP, just want to prevent the server discovery thru pings. Dec 20, 2017 at 20:11
  • Edited my answer to add some bad news regarding server discovery prevention.
    – telcoM
    Dec 21, 2017 at 7:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .