Select Your Language

Infrastructure and Management

Cloud Computing

Storage

Runtimes

Integration and Automation

  • Comments
  • RHEL9.1 - firewalld not stopping traffic

    Posted on

    I'm new to firewalld, so probably something I'm doing wrong.

    I have a host, single NIC, and I configured (or so I thought) the public zone to only accept ssh and cockpit traffic from source 10.251.0.0/24 - see below.

    However, when I tested it, I can ssh in from a 10.100.0.0/24, which is not listed as a source - so why is it allowing the traffic?

    My goal is to only allow traffic from 2 subnets, for only ssh and cockpit, and I thought the below should do it, but it does not so I'm missing something.

      target: %%REJECT%%
      icmp-block-inversion: no
      interfaces:
      sources:
      services:
      ports:
      protocols:
      forward: yes
      masquerade: no
      forward-ports:
      source-ports:
      icmp-blocks:
      rich rules:
    
    dmz
      target: default
      icmp-block-inversion: no
      interfaces:
      sources:
      services:
      ports:
      protocols:
      forward: yes
      masquerade: no
      forward-ports:
      source-ports:
      icmp-blocks:
      rich rules:
    
    drop
      target: DROP
      icmp-block-inversion: no
      interfaces:
      sources:
      services:
      ports:
      protocols:
      forward: yes
      masquerade: no
      forward-ports:
      source-ports:
      icmp-blocks:
      rich rules:
    
    external
      target: default
      icmp-block-inversion: no
      interfaces:
      sources:
      services: ssh
      ports:
      protocols:
      forward: yes
      masquerade: yes
      forward-ports:
      source-ports:
      icmp-blocks:
      rich rules:
    
    home
      target: default
      icmp-block-inversion: no
      interfaces:
      sources:
      services:
      ports:
      protocols:
      forward: yes
      masquerade: no
      forward-ports:
      source-ports:
      icmp-blocks:
      rich rules:
    
    internal
      target: default
      icmp-block-inversion: no
      interfaces:
      sources:
      services: ssh
      ports:
      protocols:
      forward: yes
      masquerade: no
      forward-ports:
      source-ports:
      icmp-blocks:
      rich rules:
    
    nm-shared
      target: ACCEPT
      icmp-block-inversion: no
      interfaces:
      sources:
      services: dhcp dns ssh
      ports:
      protocols: icmp ipv6-icmp
      forward: no
      masquerade: no
      forward-ports:
      source-ports:
      icmp-blocks:
      rich rules:
            rule priority="32767" reject
    
    public (active)
      target: default
      icmp-block-inversion: no
      interfaces: ens192
      sources: 10.251.0.0/24
      services: cockpit ssh
      ports:
      protocols:
      forward: yes
      masquerade: no
      forward-ports:
      source-ports:
      icmp-blocks:
      rich rules:
    
    trusted
      target: ACCEPT
      icmp-block-inversion: no
      interfaces:
      sources:
      services:
      ports:
      protocols:
      forward: yes
      masquerade: no
      forward-ports:
      source-ports:
      icmp-blocks:
      rich rules:
    
    work
      target: default
      icmp-block-inversion: no
      interfaces:
      sources:
      services:
      ports:
      protocols:
      forward: yes
      masquerade: no
      forward-ports:
      source-ports:
      icmp-blocks:
      rich rules:
    

    by

    points

    Responses

    Red Hat LinkedIn YouTube Facebook X, formerly Twitter

    Quick Links

    Help

    Site Info

    Related Sites

    © 2026 Red Hat