7.d Restrict network access using firewall-cmd/firewall

...

Create a new zone

# firewall-cmd --permanent --new-zone=server
success
Copy

Add the http service

# firewall-cmd --permanent --zone=server --add-service=http
success
Copy

Add an interface to the zone

# firewall-cmd --change-interface=enp0s8 --zone=server --permanent
The interface is under control of NetworkManager, setting zone to 'server'.
success
Copy

Add another service to the zone

# firewall-cmd --add-service=ssh --zone=server --permanent
success
Copy

Reload the configuration

# firewall-cmd --reload
success
Copy

Check that the zone was added

# firewall-cmd --get-zones
block dmz drop external home internal libvirt nm-shared public server trusted work
Copy

Check the zone configuration

# firewall-cmd --list-all --zone=server
server (active)
  target: default
  icmp-block-inversion: no
  interfaces: enp0s8
  sources:  
  services: http ssh
  ports:  
  protocols:  
  masquerade: no
  forward-ports:  
  source-ports:  
  icmp-blocks:  
  rich rules:  
Copy

Add the port

# firewall-cmd --add-port=8888/tcp --zone=server --permanent
success
Copy

Confirm that the new rule was added

# firewall-cmd --zone=server --list-ports --permanent  
8888/tcp
Copy

Reload the configuration

# firewall-cmd --reload
success
Copy

Close a Port

# firewall-cmd --remove-port=[port/protocol] {--permanent}
Copy

Reload the configuration

# firewall-cmd --reload
success
Copy

⬅️ Back