SIMULATION - Configure iptables, there are two domains in the network, the address of local domain is 172.24.0.0/16 other domain is 172.25.0.0/16, now refuse domain 172.25.0.0/16 to access the server.
Suggested Answer:See explanation below.
iptables -F service iptables save iptables -A INPUT -s 172.25.0.0/16 -j REJECT service iptables save service iptables restart
This answer seems to be incorrect, by the documentation standards I printed above.
Unless I am interpreting wrong, your entry would do the following if the block zone was enabled:
Block ALL Incoming Traffic except for that which exists within subnet 172.25.0.0/16.. all outgoing established connections are permitted.
For this solution to work, you would need to permit the .24 subnet and all of the necessary ports utilized in this exam. the rich-rules are a better/quicker solution.
--zone=block --add-source=172.25.0.0/16 means that rules of block zone would apply to the packets from 172.25.0.0/16. While other packets would still be applied the rule of public zone.Because the target of block zone is reject, any connection from 172.25.0.0/16 will be rejected.
To do this in RHEL8, you must use the command firewall-cmd.
#firewall-cmd --permanent --add-rich-rule="rule family='ipv4' source address='172.25.0.0/16' reject" --> Add the permanent rule to reject the whole network
#firewall-cmd --reload --> Reload firewall rules
#firewall-cmd --list-all --> List all loaded rules
The correct answer is :
# firewall-cmd --zone=block --add-source=172.25.0.0/16 --permanent
# firewall-cmd --reload
Every packet that comes into a system is analyzed
for its source address, and based on that source address, Firewalld analyzes whether
or not the packet belongs to a specific zone. If not, the zone for the incoming network interface is used. If no specific zone is available, the packet is handled by the
settings in the default zone.
After some research in the firewalld documentation:
Block Zone: Any incoming network connections are rejected [...]. Only network connections initiated within this system are possible.
Here is the thing that confuses me about the 2 solutions that have been provided in this discussion:
adolfoale: Is this zone always active, or do you have to change the default/active zone to zone=block for this to work? As I understand it, this would only work if the block zone was active.
Roldo: Your solution seems correct, I've just never used this solution before. what are your thoughts on adolfoale's solution?
any other comments is really helpful.
thanks much
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
adolfoale
Highly Voted 1 year, 11 months agoArchBishop
1 year, 6 months agobadguy001djh
1 year, 4 months agomdtjan
8 months, 2 weeks agoRoldo97
Highly Voted 1 year, 11 months agoSTFN2019
1 year, 2 months agohanienarimani
Most Recent 1 month, 1 week agosugisho
1 year, 5 months agoArchBishop
1 year, 6 months agoArchBishop
1 year, 6 months agobadguy001djh
1 year, 4 months agoadolfoale
1 year, 11 months agocytron
2 years, 1 month ago