On Wed, 2023-06-21 at 16:26 +0000, Amadeus WM via users wrote: > I tried to add the rule in the running firewalld, i.e. without the -- > permanent option and I can still connect to the darn thing. I wonder if it > has something to do with the order in which the rules or the tables are > being processed. > > firewall-cmd --add-rich-rule="rule family='ipv4' protocol value="tcp" > destination address='a.b.0.0/16' reject"
I would imagine rule order would be important, it always used to be with iptables, unless firewalld has some in-built prioritising. But for your above example, can double-quotes around tcp be inside double quotes for the whole thing? It's many years since I did personal firewall rules. Back then it was iptables, I'd made a script with all the rules I wanted. Going from memory, it started off with an isolation command (didn't want things sneaking it while it's pants were down), cleared all the existing rules, put in my rules, and then the network was allowed to pass traffic. When needed, I did any needed changes in my script, and ran it. It was the best way I could think of to always get consistent results. -- uname -rsvp Linux 3.10.0-1160.90.1.el7.x86_64 #1 SMP Thu May 4 15:21:22 UTC 2023 x86_64 Boilerplate: All unexpected mail to my mailbox is automatically deleted. I will only get to see the messages that are posted to the mailing list. _______________________________________________ users mailing list -- users@lists.fedoraproject.org To unsubscribe send an email to users-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.org Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
