Sstrhsrtj

I'm trying to setup firewalld to restrict access to the CentOS7 server to specific IPs (192.168.10.5 and 167.165.100.22) both for incoming and outgoing traffic.

I have only one network interface, enp0s01.

I have switched the firewalld a custom zone that has 'ssh' service enabled.

firewall-cmd --zone=customlist --list-all

internal (active)

target: default

icmp-block-inversion: no

interfaces: enp0s01

sources:

services: ssh

ports:

protocols:

masquerade: no

forward-ports:

source-ports:

icmp-blocks:

rich rules:

I tested with adding one IP address, for example,

firewall-cmd --permanent --zone=external --add-source=192.168.10.5

However, other IPS within the network could still access the server via ssh.

How can I restrict the access? I thought firewall blocks all traffic unless explicitly whitelisted by adding the source.

Background

In researching this it appears that you cannot restrict outgoing traffic using the basic firewalld commands. Several sources back this up:

• How To Drop Outbound Connections With Firewalld


• Understanding Firewalld in Multi-Zone Configurations


• Firewalld OutBound rules

Your only recourse is to make use of firewall-cmd --direct ... commands which do little more than facilitate iptables rules for you. Given this you have a choice of doing this through Firewalld or just doing this using whatever methods you may have employed previously when using iptables.

NOTE: direct rules will look something like this:

$ firewall-cmd --direct --remove-rule ipv4 filter OUTPUT 0 -d 74.125.136.99/32 -p tcp -m tcp --dport=80 -j DROP

Potential solution

If you can relax the requirement of disallowing the host from any outgoing communications, you can get most of what you want as follows using the basic firewall-cmd commands.

NOTE: In my example I have 3 nodes:

• 192.168.56.101 - VM #1 - server with Firewalld rules


• 192.168.56.102 - VM #2


• 192.168.56.1 - my laptop

$ firewall-cmd --permanent --zone=internal --add-source=192.168.56.101/32

$ firewall-cmd --permanent --zone=internal --add-source=192.168.56.1/32

$ firewall-cmd --permanent --zone=internal --add-port=8080/tcp

$ firewall-cmd --zone=public --set-target=DROP

With this set up I can access VM #1 from my laptop, but cannot from anywhere else, such as from VM #2.

$ firewall-cmd --get-default-zone

public

$ firewall-cmd --get-active-zones

internal

  sources: 192.168.56.101/32 192.168.56.1/32

public

  interfaces: eth0 eth1

$ firewall-cmd --zone=public --list-all

public (active)

  target: DROP

  icmp-block-inversion: no

  interfaces: eth0 eth1

  sources:

  services: ssh dhcpv6-client

  ports:

  protocols:

  masquerade: no

  forward-ports:

  source-ports:

  icmp-blocks:

  rich rules:

$ firewall-cmd --zone=internal --list-all

internal (active)

  target: default

  icmp-block-inversion: no

  interfaces:

  sources: 192.168.56.101/32 192.168.56.1/32

  services: ssh mdns samba-client dhcpv6-client

  ports: 8080/tcp

  protocols:

  masquerade: no

  forward-ports:

  source-ports:

  icmp-blocks:

  rich rules:

$ firewall-cmd --permanent --get-target

DROP

Testing

To test this setup, I'm going to make use of nc (ncat) to create a 'listener daemon' on port 8080 and use curl -v telnet://... commands to act as clients which will connect to these listeners.

NOTE: This is purely to illustrate that things are working as expected, and can be removed later on.

$ nc -4 -l -p 8080 -k

$ timeout 1 curl -v telnet://192.168.56.101:8080

* About to connect() to 192.168.56.101 port 8080 (#0)

*   Trying 192.168.56.101...

$

$ timeout 1 curl -v telnet://192.168.56.101:8080

* Rebuilt URL to: telnet://192.168.56.101:8080/

*   Trying 192.168.56.101...

* Connected to 192.168.56.101 (192.168.56.101) port 8080 (#0)

$

The only catch with this approach, is that the VM #1 node can still egress:

$ timeout 2 ping 8.8.8.8

PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.

64 bytes from 8.8.8.8: icmp_seq=1 ttl=63 time=26.4 ms

64 bytes from 8.8.8.8: icmp_seq=2 ttl=63 time=25.6 ms

$



$ timeout 1 curl -v telnet://www.google.com:80

* About to connect() to www.google.com port 80 (#0)

*   Trying 216.58.217.164...

* Connected to www.google.com (216.58.217.164) port 80 (#0)

$

References

• Whitelist source IP addresses in CentOS 7


• https://serverfault.com/questions/707774/how-to-create-advanced-rules-with-firewall-cmd


• How To Drop Outbound Connections With Firewalld


• Firewalld Rich and Direct Rules: Setting up RHEL 7 Server as a Router