Block all incoming connections, except certain subnet

[vinmansbrew]

I am running rhel 8.10, using firewalld.
I want to add a rule that blocks all incoming traffic, except a certain network. For example, I only want to all connections from 122.122.0.0/24, while blocking all others. I don't know if specifying services matters, but the server needs to allow 443(https) internally.

I've tried adding rules to different zones such as exclude. I can't seem to find the combo that blocks everything but 122.122.0.0/24
Even looking into rich rules. I haven't found a direct rule, either. I thought I would, since I've used a direct rule to block all traffic leaving the server, except to certain subnets.

I assume this would be possible?

 

[CaffeineAddict]

I know nothing about firewalld but this is usually done by blocking all by default globally (not a rule) and then adding allow rules.

According to article below, what you probably need is to assign your interface to "block" zone and then add allow rules to it.

A beginner's guide to firewalld in Linux

Our world has never been more connected than it is right now. Every person, business, government, etc. uses the web to communicate, exchange currency and...

www.redhat.com

 

[vinmansbrew]

I've tried something similar, but I'm missing something. Seems to me this should be a fairly common thing, but perhaps not.
Thanks

 

[CaffeineAddict]

I've tried something similar, but I'm missing something. Seems to me this should be a fairly common thing, but perhaps not.
Thanks

It's very simple if you use nftables instead of high level firewall such as firewalld

Although it takes to read wikies and to practice to be good with nftables, I use it myself and can do what ever I want with it.

 

[vinmansbrew]

Might be my only option. I'll have to set up a test box and play around with it.
Thanks again

 

[Trenix25]

I wrote a bash script to set up firewall rules with nftables to block input by default.

https://www.linux.org/threads/answered-how-do-i-use-nftables-to-create-a-firewall-in-linux-and-forward-packets-between-private-networks.48964/

From there just accept input from the desired saddr (source address) to let in the desired network.

Signed,

Matthew Campbell