0

I'm using CentOS Linux release 7.7.1908 (Core).

I want to block incoming and outgoing connections from all the TCP/UDP ports except a few ones.

Following is the current firewall configuration of the OS:

# firewall-cmd --get-active-zones
public
  interfaces: ens160

# firewall-cmd --list-ports
5901/tcp 5902/tcp 5912/tcp 5911/tcp 5913/tcp 5914/tcp

# firewall-cmd --list-services
dhcpv6-client ssh

Although firewall only seems to allow connections over the ports listed above, I can still use certain ports such as 22 (SSH), 80 (HTTP), etc.

How can I fix this?

13
  • firewall-cmd --list-services Commented Sep 24, 2020 at 14:17
  • @ArtemS.Tashkinov I've updated my post with the output of firewall-cmd --list-services. Commented Sep 24, 2020 at 14:39
  • Last time I checked firewall-cmd cannot block outgoing connections and I'm not sure about I can still use certain ports such as 22 (SSH), 80 (HTTP), etc. - if you're connecting locally, i.e. to 127.0.0.1, all the ports will be open. Commented Sep 24, 2020 at 14:53
  • @ArtemS.Tashkinov I can connect via SSH from another machine in my local area network. Commented Sep 25, 2020 at 11:00
  • 1
    Perhaps using iptables directly is the best way forward for you but that will require a good understanding of networking. Commented Sep 25, 2020 at 11:50

2 Answers 2

1

There you can find the answer with iptables

https://superuser.com/questions/769814/how-to-block-all-ports-except-80-443-with-iptables/770191

you can just put the ports you need open there intead of 80 and 443

2
  • I tried to apply a similar solution that was mentioned at unix.stackexchange.com/a/358701 but it didn't help. Commented Sep 24, 2020 at 14:42
  • There is a chain called IN_public_allow in the firewall rules that are listed by iptables. Is it something related to public zone that is listed by firewall-cmd? Commented Sep 25, 2020 at 11:36
1

You can look at the /etc/firewalld/zones directory and change public.xml

Default /etc/firewalld/zones/public.xml

<?xml version="1.0" encoding="utf-8"?>
<zone>
  <short>Public</short>
  <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
  <service name="ssh"/>
  <service name="dhcpv6-client"/>
  <service name="cockpit"/>
</zone>

Then

firewall-cmd --reload

You can change your zone from public to drop.

cp /usr/lib/firewalld/zones/drop.xml /etc/firewalld/zones/
 
#Add to /etc/firewalld/zones/ the following to permit ssh.
<service name="ssh"/>
 
firewall-cmd --set-default-zone=drop
firewall-cmd --reload

If you elect to change default firewall zone to DROP, you may have to add readd your ports to it.

firewall-cmd --permanent --add-port={5901,5902,5912.5911,5913,59124}/tcp
firewall-cmd --reload

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .