firewalld source-based access rules

category: notez · date: 2018-01-01 · author: LALA

noteHistorical technical note from 2018. Environment-specific identifiers and credentials have been anonymized. Commands reflect the technology and operating-system generation used at the time and should be reviewed before reuse on a current system.

This quick note shows two useful ways to restrict SSH with firewalld: bind trusted source addresses to a dedicated zone, or use a rich rule that matches source, destination and port.

Source-based zone

bash

$ firewall-cmd --permanent --new-zone=src-admin
$ firewall-cmd --permanent --zone=src-admin --add-source=192.0.2.10/32
$ firewall-cmd --permanent --zone=src-admin --add-source=2001:db8:10::10/128
$ firewall-cmd --permanent --zone=src-admin --add-service=ssh
$ firewall-cmd --reload

Inspect:

bash

$ firewall-cmd --get-active-zones
$ firewall-cmd --zone=src-admin --list-all

A source address and an interface/connection are different zone selectors. Avoid assigning the same traffic ambiguously to multiple zones.

Rich-rule alternative

bash

$ firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="192.0.2.10/32" destination address="198.51.100.20/32" service name="ssh" accept'
$ firewall-cmd --reload

For IPv6 host addresses use /128, not /64, unless the intention is to match a whole subnet.

Validate before disconnecting

bash

$ firewall-cmd --check-config
$ firewall-cmd --zone=public --list-rich-rules

Keep an existing administrative session open until the new rule has been tested.

References

firewalld zones: https://firewalld.org/documentation/zone/
firewalld rich language: https://firewalld.org/documentation/man-pages/firewalld.richlanguage.html
firewalld documentation: https://firewalld.org/documentation/