4

In a CentOS 7 web server that needs to remain totally closed to the public, I need to block all ip addresses and then only allow specified ip addresses to access specified services. How can I configure Firewalld to accomplish this?

I read this other posting, but it does not seem to address my use case because it speaks mainly of giving blanket access to specific ip addresses rather than giving different types of access to different ip addresses. The other posting does not address the question of email. Also, the other posting seems to assume using lockdown mode. My question asks whether or not to use lockdown mode for this use case.

Four services need to be enabled on the server. 

1.) ssh access only to one administrator at either of 2 ip addresses
2.) https access only to 30 ip addresses of users, including administrator
3.) encrypted emails:
     sent to the 30 users who have https access
     sent to and received from another list of known email addresses
4.) encrypted ftp upload from another list of known ip addresses

All other inbound and outbound access needs to be blocked.

Do I have to set Lockdown=yes to accomplish this?

Also, do I then add in each user as follows: 

rule family="ipv4" source address="192.168.0.0" service name="tftp" log prefix="tftp" level="info" limit value="1/m" accept

rule family="ipv4" source address="192.235.89.45" service name="https" accept

rule family="ipv4" source address="192.235.89.45" service name="ssh" accept

rule family="ipv4" source address="192.987.376.97" service name="https" accept

Currently, firewall-cmd --list-all returns the following: 

public (default, active)
  interfaces: enp3s0
  sources: 
  services: dhcpv6-client https ssh
  ports: 
  masquerade: no
  forward-ports: 
  icmp-blocks: 
  rich rules:
Community
  • 1
CodeMed
  • 5,079
  • 45
  • 100
  • 147
  • there is something that could answer here http://serverfault.com/a/680789/144691 – mike-m Oct 05 '15 at 18:29
  • You achieve your goal in a bad way. I think you have a network topology issue. The easiest way to achieve your goal is to have 3 IP on your server on 3 interface (physical or by using vlans). One interface for ssh connection where the ssh server listen to, another one for http and emails, and the last one for ftp. – alexises Dec 31 '14 at 08:59
  • 1
    Your problem is what _zones_ are for in Firewalld. The documentation is somewhat hard to read, but [this tutorial](https://ctrl.blog/entry/how-to-firewalld-zone-by-ip) will get you sorted. – Daniel Feb 14 '17 at 06:29

0 Answers0