Otdfbt

How Can I Tell The Difference Between Unmarked Sugar and Stevia?

How do governments keep track of their issued currency?

Is open-sourcing the code of a webapp not recommended?

How to build suspense or so to establish and justify xenophobia of characters in the eyes of the reader?

Magento 2: PWA sample data installation error

Is it possible to 'live off the sea'

How can drunken, homicidal elves successfully conduct a wild hunt?

What is the giant octopus in the torture chamber for?

What are the peak hours for public transportation in Paris?

Orange material in grout lines - need help to identify

Are there downsides to using std::string as a buffer?

Does the mixture and throttle setting affect the quality of priming of fuel prior to start?

Preventing Employees from either switching to Competitors or Opening Their Own Business

Print the string equivalents of a phone number

Implement Homestuck's Catenative Doomsday Dice Cascader

How to retract an idea already pitched to an employer?

Was there a priest on the Titanic who stayed on the ship giving confession to as many as he could?

At what point in time did Dumbledore ask Snape to kill him?

Smooth switching between 12 V batteries, with a toggle switch

Can a user sell my software (MIT license) without modification?

Are "living" organ banks practical?

What risks are there when you clear your cookies instead of logging off?

Comparing and find out which feature has highest shape area in QGIS?

Frame failure sudden death?

How do I completely block port using firewalld?

Trying to make iptables stateless is causing unforeseen filteringFC19 FirewallD debugging help requested: ports not forwardingCentos 7.1 Firewalld source address restrictionfirewalld multiple public ips to multiple private ips routingAllow outgoing IPv6 connections for VPN clientsFirewalld - Logging denied packets enabled - not loggingfirewalld masquerade controlPort does not nping in Centos 7firewalld port forwarding not working in centOSLinux firewalld - I can hit port 4506, but my configuration shouldn't let me

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;

2

^{Disclaimer: It's the first time I use firewalld, be gentle :) .}

---

I have a CentOS machine and I want to implement the following requirements using firewalld:

• Allow connections from anywhere to ports 1, 2, 3, 4.


• Allow connections to port 5 only from IP addresses IP1, IP2 and IP3


• Completely block connections to port 6, from anywhere.

So I did this:

• added the ports 1, 2, 3 and 4 to the public zone


• added port 5 and IP addresses IP1, IP2 and IP3 to zone trusted
  

Now the zones look like this:

public (active)
 target: default
 icmp-block-inversion: no
 interfaces: eno12345
 sources:
 services: ssh dhcpv6-client
 ports: 1/tcp 2/tcp 3/tcp 4/tcp
 protocols:
 masquerade: no
 forward-ports:
 source-ports:
 icmp-blocks:
 rich rules:

trusted (active)
 target: ACCEPT
 icmp-block-inversion: no
 interfaces:
 sources: IP1 IP2 IP3
 services:
 ports: 5/tcp
 protocols:
 masquerade: no
 forward-ports:
 source-ports:
 icmp-blocks:
 rich rules:

Note: public is the default zone.

So the first 2 rules seem to be applied correctly.

However I got stuck with the final rule (completely block port 6). I tried multiple solutions and none seem to work.

1). What should I do to apply this?

2). How come I can connect through port 6 even though it's not explicitly listed as allowed in the firewalld configuration? No rule about it is added in iptables either.

centos firewall centos7 firewalld

share|improve this question

asked May 21 at 9:29

Radu MurzeaRadu Murzea

1313

add a comment | 

2

^{Disclaimer: It's the first time I use firewalld, be gentle :) .}

---

I have a CentOS machine and I want to implement the following requirements using firewalld:

• Allow connections from anywhere to ports 1, 2, 3, 4.


• Allow connections to port 5 only from IP addresses IP1, IP2 and IP3


• Completely block connections to port 6, from anywhere.

So I did this:

• added the ports 1, 2, 3 and 4 to the public zone


• added port 5 and IP addresses IP1, IP2 and IP3 to zone trusted
  

Now the zones look like this:

public (active)
 target: default
 icmp-block-inversion: no
 interfaces: eno12345
 sources:
 services: ssh dhcpv6-client
 ports: 1/tcp 2/tcp 3/tcp 4/tcp
 protocols:
 masquerade: no
 forward-ports:
 source-ports:
 icmp-blocks:
 rich rules:

trusted (active)
 target: ACCEPT
 icmp-block-inversion: no
 interfaces:
 sources: IP1 IP2 IP3
 services:
 ports: 5/tcp
 protocols:
 masquerade: no
 forward-ports:
 source-ports:
 icmp-blocks:
 rich rules:

Note: public is the default zone.

So the first 2 rules seem to be applied correctly.

However I got stuck with the final rule (completely block port 6). I tried multiple solutions and none seem to work.

1). What should I do to apply this?

2). How come I can connect through port 6 even though it's not explicitly listed as allowed in the firewalld configuration? No rule about it is added in iptables either.

centos firewall centos7 firewalld

share|improve this question

asked May 21 at 9:29

Radu MurzeaRadu Murzea

1313

add a comment | 

^{Disclaimer: It's the first time I use firewalld, be gentle :) .}

---

I have a CentOS machine and I want to implement the following requirements using firewalld:

• Allow connections from anywhere to ports 1, 2, 3, 4.


• Allow connections to port 5 only from IP addresses IP1, IP2 and IP3


• Completely block connections to port 6, from anywhere.

So I did this:

• added the ports 1, 2, 3 and 4 to the public zone


• added port 5 and IP addresses IP1, IP2 and IP3 to zone trusted
  

Now the zones look like this:

public (active)
 target: default
 icmp-block-inversion: no
 interfaces: eno12345
 sources:
 services: ssh dhcpv6-client
 ports: 1/tcp 2/tcp 3/tcp 4/tcp
 protocols:
 masquerade: no
 forward-ports:
 source-ports:
 icmp-blocks:
 rich rules:

trusted (active)
 target: ACCEPT
 icmp-block-inversion: no
 interfaces:
 sources: IP1 IP2 IP3
 services:
 ports: 5/tcp
 protocols:
 masquerade: no
 forward-ports:
 source-ports:
 icmp-blocks:
 rich rules:

Note: public is the default zone.

So the first 2 rules seem to be applied correctly.

However I got stuck with the final rule (completely block port 6). I tried multiple solutions and none seem to work.

1). What should I do to apply this?

2). How come I can connect through port 6 even though it's not explicitly listed as allowed in the firewalld configuration? No rule about it is added in iptables either.

centos firewall centos7 firewalld

share|improve this question

asked May 21 at 9:29

Radu MurzeaRadu Murzea

1313

public (active)
 target: default
 icmp-block-inversion: no
 interfaces: eno12345
 sources:
 services: ssh dhcpv6-client
 ports: 1/tcp 2/tcp 3/tcp 4/tcp
 protocols:
 masquerade: no
 forward-ports:
 source-ports:
 icmp-blocks:
 rich rules:

trusted (active)
 target: ACCEPT
 icmp-block-inversion: no
 interfaces:
 sources: IP1 IP2 IP3
 services:
 ports: 5/tcp
 protocols:
 masquerade: no
 forward-ports:
 source-ports:
 icmp-blocks:
 rich rules:

share|improve this question

asked May 21 at 9:29

Radu MurzeaRadu Murzea

1313

share|improve this question

asked May 21 at 9:29

Radu MurzeaRadu Murzea

1313

asked May 21 at 9:29

Radu MurzeaRadu Murzea

1313

asked May 21 at 9:29

Radu MurzeaRadu Murzea

1313

2 Answers
2

active

oldest

votes

2

Some generic command are below

firewall-cmd --list-ports
firewall-cmd --get-zones
firewall-cmd --zone=public --add-port=5000/tcp

For some more docs and more details, please check it.
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Configuring_firewalld.html

share|improve this answer

answered May 21 at 9:40

asktyagiasktyagi

515110

add a comment | 

2

The way I solved it is I added a rich rule in the trusted zone:

rule family="ipv4" port port="6" protocol="tcp" drop

From what I know, rich rules are applied first. It seems to be working correctly in my case.

share|improve this answer

answered May 29 at 7:53

Radu MurzeaRadu Murzea

1313

add a comment | 

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f968194%2fhow-do-i-completely-block-port-using-firewalld%23new-answer', 'question_page');

);

Post as a guest

Name

Email

Required, but never shown

2

Some generic command are below

firewall-cmd --list-ports
firewall-cmd --get-zones
firewall-cmd --zone=public --add-port=5000/tcp

For some more docs and more details, please check it.
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Configuring_firewalld.html

share|improve this answer

answered May 21 at 9:40

asktyagiasktyagi

515110

add a comment | 

2

Some generic command are below

firewall-cmd --list-ports
firewall-cmd --get-zones
firewall-cmd --zone=public --add-port=5000/tcp

For some more docs and more details, please check it.
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Configuring_firewalld.html

share|improve this answer

answered May 21 at 9:40

asktyagiasktyagi

515110

add a comment | 

Some generic command are below

firewall-cmd --list-ports
firewall-cmd --get-zones
firewall-cmd --zone=public --add-port=5000/tcp

For some more docs and more details, please check it.
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Configuring_firewalld.html

share|improve this answer

answered May 21 at 9:40

asktyagiasktyagi

515110

firewall-cmd --list-ports
firewall-cmd --get-zones
firewall-cmd --zone=public --add-port=5000/tcp

share|improve this answer

answered May 21 at 9:40

asktyagiasktyagi

515110

answered May 21 at 9:40

asktyagiasktyagi

515110

answered May 21 at 9:40

asktyagiasktyagi

515110

2

The way I solved it is I added a rich rule in the trusted zone:

rule family="ipv4" port port="6" protocol="tcp" drop

From what I know, rich rules are applied first. It seems to be working correctly in my case.

share|improve this answer

answered May 29 at 7:53

Radu MurzeaRadu Murzea

1313

add a comment | 

2

The way I solved it is I added a rich rule in the trusted zone:

rule family="ipv4" port port="6" protocol="tcp" drop

From what I know, rich rules are applied first. It seems to be working correctly in my case.

share|improve this answer

answered May 29 at 7:53

Radu MurzeaRadu Murzea

1313

add a comment | 

The way I solved it is I added a rich rule in the trusted zone:

rule family="ipv4" port port="6" protocol="tcp" drop

From what I know, rich rules are applied first. It seems to be working correctly in my case.

share|improve this answer

answered May 29 at 7:53

Radu MurzeaRadu Murzea

1313

rule family="ipv4" port port="6" protocol="tcp" drop

share|improve this answer

answered May 29 at 7:53

Radu MurzeaRadu Murzea

1313

answered May 29 at 7:53

Radu MurzeaRadu Murzea

1313

answered May 29 at 7:53

Radu MurzeaRadu Murzea

1313