--On Saturday, October 27, 2018 4:19 PM +0200 Hans-Peter Jansen <hpj(a)urpla.net&gt; wrote: Use an ipset rule. It's easy to add and remove lots of IP addresses without changing the firewall. fail2ban can also use ipsets within firewalld. I suggest asking on the fail2ban mailing list to see if someone has a suitable jail definition.

On Samstag, 27. Oktober 2018 20:29:54 Oleg Cherkasov wrote: Thank you, Kenneth and Oleg, for your hints. Unfortunately, I still haven't figured out, how to limit a certain service to a couple of source addresses, namely I would like to accept connections on 15060/udp from internal and selected external sources only: e.g. 172.16.123.0/24 and 213.167.161.0/26. It might be possible with ipsets, but no example shows, how to use that as a white list with the destination port requirement. Any ideas? TIA, Pete

On Dienstag, 6. November 2018 19:24:09 Hans-Peter Jansen wrote: I think, I got it: $ firewall-cmd --permanent --new-zone=voip $ firewall-cmd --permanent --zone=voip --add-source=172.16.123.0/24 $ firewall-cmd --permanent --zone=voip --add-source=213.167.161.0/26 $ firewall-cmd --permanent --zone=voip --add-source=213.167.162.0/26 $ firewall-cmd --permanent --zone=voip --add-port=15060/udp $ firewall-cmd --permanent --zone=voip --add-port=10000-10099/udp $ firewall-cmd --zone=voip --permanent --list-all voip (active) target: default icmp-block-inversion: no interfaces: sources: 172.16.123.0/24 213.167.161.0/26 213.167.162.0/26 services: ports: 15060/udp 10000-10099/udp protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: What I still not grok is the relationship between the different zones, and how overlapping and non-overlapping rules are handled?!? Because: $ firewall-cmd --get-active-zones voip ... but I'm still able to use ssh, although it is defined in zone "external" $ firewall-cmd --zone=external --permanent --list-all external target: default icmp-block-inversion: no interfaces: sources: services: http ports: 4559/tcp 22/tcp protocols: masquerade: no forward-ports: source-ports: icmp-blocks: address-unreachable bad-header beyond-scope communication- prohibited destination-unreachable echo-reply failed-policy fragmentation- needed host-precedence-violation host-prohibited host-redirect host-unknown host-unreachable ip-header-bad network-prohibited network-redirect network- unknown network-unreachable no-route packet-too-big parameter-problem port- unreachable precedence-cutoff protocol-unreachable reject-route required- option-missing source-route-failed time-exceeded timestamp-reply timestamp- request tos-host-redirect tos-host-unreachable tos-network-redirect tos- network-unreachable ttl-zero-during-reassembly ttl-zero-during-transit unknown-header-type unknown-option rich rules: I can disable/enable nginx: $ firewall-cmd --zone=external --remove-service=http $ firewall-cmd --zone=external --add-service=http but a command like: $ firewall-cmd --remove-service=http You're performing an operation over default zone ('external'), but your connections/interfaces are in zone 'voip' (see --get-active-zones) You most likely need to use --zone=voip option. success After a reboot, things clear up (a bit): $ firewall-cmd --get-active-zones external interfaces: eth0 voip sources: 172.16.123.0/24 213.167.161.0/26 213.167.162.0/26 but how does firewalld knows, which zones are active? In case of voip, this is controlled from the sources okay, but in case of external, the interface isn't defined in the zone, nor in the interface script (no NetworkManager). To rephrase my question: what triggers the activeness? Sorry for these dump questions, but I really try to make up some consistent idea of the inner logical connections, that appear to be important to me, in order to avoid to have applied rules at the wrong places (zones), or, even badder, doesn't have them applied at all! So, please bear with me, Pete

Dear Eric, thanks for your answers. On Donnerstag, 8. November 2018 10:34:53 Eric Garver wrote: Okay, things clear up. This is, what I have now: $ firewall-cmd --get-default-zone external $ firewall-cmd --get-active-zones external interfaces: eth0 voip sources: 172.16.123.0/24 213.167.161.0/26 213.167.162.0/26 $ firewall-cmd --zone=external --permanent --list-all external (active) target: default icmp-block-inversion: no interfaces: eth0 sources: services: ports: 22/tcp protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: rule family="ipv4" source address="172.16.123.0/24" service name="http" accept rule family="ipv4" source address="172.16.123.0/24" port port="4559" protocol="tcp" accept rule family="ipv4" source address="172.16.123.0/24" port port="19150" protocol="tcp" accept $ firewall-cmd --zone=voip --permanent --list-all voip (active) target: default icmp-block-inversion: no interfaces: sources: 172.16.123.0/24 213.167.161.0/26 213.167.162.0/26 services: ports: 10000-10099/udp 15060/udp protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: Now, this behaves, how I would like it to, but I do have some overlapping sources, once in voip, and those in the external rich rules, and the whole thing starts to feel like I'm misusing the zones concepts again. But hopefully, this demonstrates, what I'm after. I'm about to combine these zones into external, using more rich rules, similar to those, that I'm using already, and changing the external target to drop. Is that considered good practice? Thanks, Pete

On Thu, Nov 08, 2018 at 11:32:56PM +0100, Hans-Peter Jansen wrote: I don't follow why you have these rich rules instead of just adding the services/ports to your "voip" zone. Ideally you'd have a zone per logical grouping of source IP address. I think zones setup as below get you what you desire without rich rules. voip-plus-more (active) target: default icmp-block-inversion: yes interfaces: http sources: 172.16.123.0/24 services: http ports: 10000-10099/udp 15060/udp 4559/tcp protocols: masquerade: no forward-ports: source-ports: icmp-blocks: echo-reply echo-request rich rules: voip (active) target: default icmp-block-inversion: no interfaces: sources: 213.167.161.0/26 213.167.162.0/26 services: ports: 10000-10099/udp 15060/udp protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: drop (active) target: DROP icmp-block-inversion: yes interfaces: eth0 sources: services: ports: 22/tcp protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: