62

I'd accomplish this by adding sources to a zone. First checkout which sources there are for your zone: firewall-cmd --permanent --zone=public --list-sources If there are none, you can start to add them, this is your "whitelist" firewall-cmd --permanent --zone=public --add-source=192.168.100.0/24 firewall-cmd --permanent --zone=public --add-source=192.168....


51

Maybe better than earlier answer; firewall-cmd --permanent --zone=trusted --change-interface=docker0 firewall-cmd --permanent --zone=trusted --add-port=4243/tcp firewall-cmd --reload


45

This should be enough: firewall-cmd --permanent --add-service=nfs firewall-cmd --permanent --add-service=mountd firewall-cmd --permanent --add-service=rpc-bind firewall-cmd --reload


35

Use the firewall-cmd command. Assuming you're opening the firewall up to OpenVPN on the default zone, carry out the following commands. If you are running it on a non-default zone, then add --zone=<zone> to the commands. Note: If you use default public zone for your external facing network adapter then your loopback interface could also be ...


32

Even if an answer has been accepted and up-voted, I do not think it is a correct one. I fail to find clear explanation in the documentation, but from the implemented behaviour it looks like that: interface and source are used as selectors - which zone(s) to activate both are ignored for the default zone (always active) So the answer would be: lock down ...


23

This is needed if you are using DHCP v6 due to the slightly different way that DHCP works in v4 and v6. In DHCP v4 the client establishes the connection with the server and because of the default rules to allow 'established' connections back through the firewall, the returning DHCP response is allowed through. However, in DHCP v6, the initial client ...


16

The correct way to do this is to add a profile for SNMP to firewalld. Using UDP 161 not TCP vim /etc/firewalld/services/snmp.xml <?xml version="1.0" encoding="utf-8"?> <service> <short>SNMP</short> <description>SNMP protocol</description> <port protocol="udp" port="161"/> </service> Then you should ...


13

I know this is a dated post, but I've been searching for this today, and have found tons of old blogs that attempt to address this issue. For the public, this update from Red Hat should be more available than only to subscribers: Upgrade to firewalld-0.4.3.2-8.el7 from Errata RHSA-2016:2597 Specify which packets should be logged firewall-cmd --set-log-...


12

Theses commands did the trick: firewall-cmd --permanent --zone=trusted --add-interface=docker0 firewall-cmd --permanent --zone=trusted --add-port=4243/tcp


10

With RHEL 7 / CentOS 7, firewalld was introduced to manage iptables. IMHO, firewalld is more suited for workstations than for server environments. It is possible to go back to a more classic iptables setup. First, stop and mask the firewalld service: systemctl stop firewalld systemctl mask firewalld Then, install the iptables-services package: yum ...


8

Disclaimer: I haven't actually tried what I'm suggesting, here, but it's fairly close to the last firewalld setup I did, so I'm going off of that. Firewalld provides you with a few pre-configured zones, just for this purpose. There's one called "drop", which drops anything coming in, and one called "trusted", which allows any connection (ie, so you shouldn't ...


8

I operate my firewalls in this manner. Here is my preferred method to accomplish what you want. # firewall-cmd --list-all You'll see your default zone is public and the services enabled are dhcpv6-client and ssh. We don't want any public services available, right? Only the whitelisted IP's are authorized. So let's remove the two public services. # ...


8

--direct commands cannot be made permanent. Use equivalent zone command: sudo firewall-cmd --zone=public --add-port=7199/tcp --permanent sudo firewall-cmd --reload and to check the result: sudo firewall-cmd --zone=public --list-all


7

According to this page, the FirewallD logs are at /var/log/firewalld. To get debug messages, you need to run it with --debug or --debug=2.


7

I think the answer is fairly straightforward. First, you have done exactly the right thing... Firewalld is a pure frontend. It's not an independent firewall by itself. It only operates by taking instructions, then turning them into nftables rules (formerly iptables), and the nftables rules ARE the firewall. So you have a choice between running "...


7

firewalld parameter service is a string. Use loop to iterate a list of services. For example - name: firewalld configuration firewalld: zone: public service: "{{ item }}" permanent: yes state: enable notify: reload firewalld loop: - https - http


6

I had problems with this as well; this did the trick for me: firewall-cmd --zone=public --add-masquerade --permanent From: https://serverfault.com/questions/987686/no-network-connectivity-to-from-docker-ce-container-on-centos-8


6

After configuring NFS server we should enable and start three services: nfs-server.service rpcbind.service nfs-mountd.service (only start is needed) And also allow these services on server firewall: # firewall-cmd --permanent --add-service=nfs # firewall-cmd --permanent --add-service=rpcbind # firewall-cmd --permanent --add-service=mountd # firewall-cmd --...


6

The safest way to get rid of firewalld is to remove it: dnf remove firewalld It is quite ok to do for virtual machines.


6

Why I can't see the Machine B in connections? because it's acting as a router, not an endpoint of the connection. and what shall I do to see it? To show connections tracked by the stateful firewall, run conntrack. http://conntrack-tools.netfilter.org/manual.html#conntrack If you did not have a stateful firewall, you would have to simply capture and ...


6

If you know your destination/port as you're initiating ssh connection I would suggest, ideally, that you connect to JumpBox with something like ssh -L 8080:10.0.0.1:80 <JumpBox address> where you're seeking 10.0.0.1 which is behind firewall/NAT but is accessible to JumpBox. This creates a connection and binds to 127.0.0.1 (localhost) such that if you ...


6

You can find the xml files this information is stored in in /usr/lib/firewalld/services/ (for distro-managed services) and/or /etc/firewalld/services/ for your own user-defined services. For example, samba.xml reads (on my centos7): <?xml version="1.0" encoding="utf-8"?> <service> <short>Samba</short> <description>This ...


5

For logging the traffic blocked by firewalld, the following approach with rsyslogd worked for me: Edit /etc/sysconfig/firewalld and update the value for LogDenied to all (or as required) LogDenied=all restart firewalld sudo systemctl restart firewalld This typically adds logging rules just before reject/drop rules in the firewall, something like: LOG ...


5

One reason the accepted solution works for some people but not for others lies in a design issue of firewalld. Firewalld only processes the first matching zone for any connections. It also processes zones based on IP address before zones based on interfaces. As long as any of your zones happens to include the IP addresses docker is using, the ACCEPT rule in ...


5

From what I can tell unless there's an interface using the trusted zone that's directly recognized by firewalld (i.e. eth0) the trusted zone isn't marked as active. In order to get around this, you can explicitly set the iptables rule with the following: firewall-cmd --permanent --zone=trusted --add-interface=docker0 firewall-cmd --direct --permanent --add-...


5

Mask and disable the firewalld service: systemctl mask firewalld systemctl disable firewalld


5

The first problem was that you were using the wrong syntax for the telnet command. Running man telnet will show you that the syntax is something like this: telnet <host> [<port>] So in your case, you should run this: telnet 192.168.1.5 5432 A second problem is that you have a firewall rule on each host preventing outbound traffic to 5432/tcp. ...


5

After so many try and fail and brainstorming with wireguard IRC chanel guys, apparently I forgot to add a static route for 10.7.0.0/24 for each server behind wireguard. Ping goes to the server, but does not return as server does not know where to send that echo-reply: ip route add 10.7.0.0/24 via 11.11.11.11 dev eth0 (main device for communication) For me, ...


4

You should also check out this page on the Fedora Wiki. I think you will want to use the drop zone because it's the most strict way. create an advanced rule so that you can connect from your ip to port 22 (or your different ssh port) with firewall-cmd ---permanent -zone=home --add-forward-port=port=22:proto=tcp:toaddr=xxx.xxx.xxx.xxx and allow your own ip ...


4

First thing you need to know is how UPnP IGD protocol is working. You choose random local UDP port and from it you send discovery request to well-known multicast address 239.255.255.250 and UDP port 1900. UPnP IGD server (running on your router) listen for those multicast queries and send you back unicast UDP reply from randomly chosen port to your ip ...


Only top voted, non community-wiki answers of a minimum length are eligible