On Wed, 2023-06-21 at 16:26 +0000, Amadeus WM via users wrote:
I tried to add the rule in the running firewalld, i.e. without the
--
permanent option and I can still connect to the darn thing. I wonder if it
has something to do with the order in which the rules or the tables are
being processed.
firewall-cmd --add-rich-rule="rule family='ipv4' protocol
value="tcp"
destination address='a.b.0.0/16' reject"
I would imagine rule order would be important, it always used to be
with iptables, unless firewalld has some in-built prioritising. But
for your above example, can double-quotes around tcp be inside double
quotes for the whole thing?
It's many years since I did personal firewall rules. Back then it was
iptables, I'd made a script with all the rules I wanted. Going from
memory, it started off with an isolation command (didn't want things
sneaking it while it's pants were down), cleared all the existing
rules, put in my rules, and then the network was allowed to pass
traffic.
When needed, I did any needed changes in my script, and ran it. It was
the best way I could think of to always get consistent results.
--
uname -rsvp
Linux 3.10.0-1160.90.1.el7.x86_64 #1 SMP Thu May 4 15:21:22 UTC 2023 x86_64
Boilerplate: All unexpected mail to my mailbox is automatically deleted.
I will only get to see the messages that are posted to the mailing list.