I have a current ruleset:

net1 (active)
  target: default
  icmp-block-inversion: no
  interfaces: ens192
  services: http https smtp smtp-submission pop3 pop3s imap imaps ssh
  masquerade: no
  rich rules: 

Which allows access from all IPs on the network ens192 is connected to to those ports. However I would like to restrict connections to port 25 only to a single IP.

I would "normally" just edit the relevant line in whatever plain text file I was saving the rules in and add "-s x.x.x.x". I seem to have the option of restricting all ports to specific IPs but not just for one port. What am I missing?

  • 'Which allows access from all IPs on the network ens192 is connected to to those ports.' Actually, it allows access to any traffic that comes from wherever that interfaces is connected to. If it connects to your modem, then all those services are accessible from the internet. If it connects to your router and the router does not block/filter traffic, then all those services are accessible from the internet. You need to add a source IP range that represents your internal network if you want to limit traffic to that range. I do not know how to edit rules in firewalld, so I cannot answer. – Xalorous Dec 21 '18 at 13:50
  • I think the stumbling block you're seeing is that firewalld expands upon iptables (which is still used underneath) and adds a layer above. One thing this layer adds is zones. This layer and the fact that I'm using mostly RHEL6 and iptables in the environment I manage are the reasons I haven't focused on learning firewalld. – Xalorous Dec 21 '18 at 13:55

Rather than messing with rich rules, which can be hard to understand, you can create a new firewalld zone. A zone is defined by either network interfaces or source addresses. In this case you'll define it with only source addresses:

firewall-cmd --new-zone=smtp
firewall-cmd --zone=smtp --add-source=
firewall-cmd --zone=smtp --add-service=smtp

firewall-cmd --zone=net1 --remove-service=smtp

firewall-cmd --runtime-to-permanent

Thus, incoming connections to SMTP will be limited only to those coming from You can also easily add or remove IP addresses later if necessary, much more easily than with rich rules.


Found it. I needed to use 'rich rules':

firewall-cmd --remove-service=smtp
firewall-cmd --add-rich-rule='rule family="ipv4" source address="x.x.x.x" service name="smtp" accept'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.