how to block incoming and outgoing connections with IP?
by Patrick Hinkley
Given an IP address, how can I prevent any connection both to and from that IP? If there are multiple methods, please describe the pros and cons of each.
I've found a lot of contradictory and confusing information about this online and in the documentation.
Thanks for any help!
8 years, 10 months
firewalld-0.3.14.2
by Thomas Woerner
Hi,
here is a new firewalld release:
firewalld-0.3.14.2
This release is another bug fix release for 0.3.14. It provides a small
fix for the applet and firewall-config to only honour active connections
from NetworkManager, an adapted firewall-applet man page and a QSettings
fix.
Changelog for firewalld-0.3.14.2
firewalld.spec:
- fixed requirements for -applet and -config
man pages:
- adapted firewall-applet man page to new version
firewall-applet:
- Only honour active connections for zone changes
- Change QSettings path and file names
firewall-config:
- Only honour active connections for zone changes in the “Change
Zones of Connections” menu
Translations:
- updated translations
- marked translations for “Connections” for review
firewalld can be obtained from:
- https://fedorahosted.org/released/firewalld/
- https://github.com/t-woerner/firewalld/
Please remember that the source code repo of firewalld has been migrated
to github.
Thanks to all contributors, testers and bug reporters.
Regards,
Thomas
9 years
firewalld-0.3.14
by Thomas Woerner
Hi,
here is a new firewalld release:
firewalld-0.3.14
This release contains several bug fixes, but also some enhancements.
The long standing issue with the dbus NoReply error in FirewallClient
because of an issues in polkitd has been fixed finally.
Changelog for firewalld-0.3.14
firewalld:
- print real zone names in error messages
- iptables 1.4.21 does not accept limits of 1/day, minimum is 2/day now
- rate limit fix for rich rules
- fix readdition of removed permanent direct settings
- adaption of the polkit domains to use PK_ACTION_DIRECT_INFO
- fixed two minor Python3 issues in firewall.core.io.direct
- fixed use of fallback configuration values
- fixed use without firewalld.conf
- firewalld main restructureization
- IPv6_rpfilter now also available as a property on D-Bus in the
config interface
- fixed wait option use for ipXtables
- added --concurrent support for ebtables
- richLanguage: allow masquerading with destination
- richLanguage: limit masquerading forward rule to new connections
- ipXtables: No dns lookups in available_tables and _detect_wait_option
- full ebtables support: start, stop, reload, panic mode, direct
chains and rules
- fix for reload with direct rules
- fix or flaws found by landscape.io
- pid file handling fixes in case of pid file removal
- fix for client issue in case of a dbus NoReply error
configuration
- new services: dropbox-lansync, ptp
- new icmptypes: timestamp-request, timestamp-reply
man pages:
- firewalld.zones(5): fixed typos
- firewalld.conf(5): Fixed wrong reference to
firewalld.lockdown-whitelist page
firewall-applet:
- new version using Qt4 fixing several issues with the Gtk version
spec file:
- enabled Python3 support: new backends python-firewall and
python3-firewall
- some cleanup
git:
- migrated to github
translations:
- migrated to zanata
build environment:
- no need for autoconf-2.69, 2.68 is sufficient
firewalld can be obtained from:
- https://fedorahosted.org/released/firewalld/
- https://github.com/t-woerner/firewalld/
Please remember that the source code repo of firewalld has been migrated
to github.
Thanks to all contributors, testers and bug reporters.
Regards,
Thomas
9 years
firewalld-0.3.14.1
by Thomas Woerner
Hi,
here is a new firewalld release:
firewalld-0.3.14.1
This release is mostly a hot fix release for 0.3.14 to fix the new Qt
firewall-applet to start properly in KDE5.
Changelog for firewalld-0.3.14.1
firewall-applet
- do not use isSystemTrayAvailable check to fix KDE5 startup
- dropped gtk applet remain: org.fedoraproject.FirewallApplet.gschema.xml
spec file:
- adaptions from Fedora firewalld spec file
firewalld can be obtained from:
- https://fedorahosted.org/released/firewalld/
- https://github.com/t-woerner/firewalld/
Please remember that the source code repo of firewalld has been migrated
to github.
Thanks to all contributors, testers and bug reporters.
Regards,
Thomas
9 years
firewalld ssh restrict
by Anton Matta
Hi,
I red man firewalld.richlanguage really focussed and some searched webpages
and I really don't know how to restrict ssh with systemd like from 2
sources ok, other not ok?
a.b.c.d > ssh OK
b.c.d.a > ssh OK
x.x.x.x (everyone else) > REJECT, DROP, whatever.
Do You have any ideas? Thanks for reply. m.
9 years
New to firewalld, Questions about getting started.
by Fryer, David
Hello,
I am new to using firewalld. I have been through the documentation at https://fedoraproject.org/wiki/FirewallD, but am having some trouble with configuration. It would seem that, regardless of zone or services enabled, I cannot ssh into the machine that has firewalld running without adding the client's subnet to the trusted zone. In addition, adding "UseDNS no" to the end of /etc/ssh/sshd_config seems to ignore firewall configuration.
I have been using firewall-cmd in order to set firewall options, if it makes a difference.
It seems that there is no HOWTO for getting started with firewalld, and there doesn't seem to be any one resource that's helpful for troubleshooting problems such as this.
Thank You,
David Fryer
9 years
After config cleanup, masquerade is auto-enabled on external zone
by Marcos Felipe Rasia de Mello
When I do this:
systemctl stop firewalld.service
rm -f /etc/firewalld/zones/*
rm -f /etc/firewalld/direct.xml*
systemctl start firewalld.service
firewalld enables by default masquerade on my external network:
grep ZONE /etc/sysconfig/network-scripts/ifcfg-*
/etc/sysconfig/network-scripts/ifcfg-Conexão_cabeada_1:ZONE=external
/etc/sysconfig/network-scripts/ifcfg-Conexão_cabeada_2:ZONE=trusted
firewall-cmd --zone=external --query-masquerade
yes
Unexpected I think. Is there other way to reset all firewalld settings?
firewalld-0.3.13-2.fc21.noarch here.
9 years
