1

CentOS 7

I have two zones (home and public). I'd like to allow SSH from my home but not from public.

[root@foobox ~]# firewall-cmd --list-all --zone=home
home (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources: 1.2.3.4
  services: ssh https
  ports: 12345/tcp
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

[root@foobox~]# firewall-cmd --list-all --zone=public
public
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: https
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks: echo-reply
  rich rules:

Since there's no interface or source associated with the public zone, I suspect that everything is matching home and using that.

I only have one interface and don't want to create a dual-homed setup... so how can I tell firewall-cmd "if the remote client is coming from 1.2.3.4 use the home zone... if it's any other remote source IP, use the public zone"?

I thought it might be as simple as just adding an interface but I get an error:

[root@foobox ~]# firewall-cmd --permanent --zone=public --add-interface=eth0
Error: ZONE_CONFLICT: eth0
0

I only have one interface

Since there's no interface or source associated with the public zone, I suspect that everything is matching home and using that.

Yes.

I thought it might be as simple as just adding an interface but I get an error

Remove the eth0 interface from the home zone. Then you will be able to add it to the public zone, without any error.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.