Same here, I didn't monkey with the firewall since the days of iptables, where I had my rules in a file that I'd load up in iptables. I would drop everything by default and only poke holes for things that I needed. Now we have zones and policies and stuff and I have to read an entire treatise on firewall just to add a simple drop rule. In fact I did add the rule, it just doesn't do anything. I'm intrigued by the fact that the GUI won't let me add the rule (but the command line does). Maybe there's something wrong with my rule and the GUI detects that, but then I would expect the command line to error out too. On Thu, 22 Jun 2023 02:23:18 +0930, Tim via users wrote: > On Wed, 2023-06-21 at 16:26 +0000, Amadeus WM via users wrote: >> I tried to add the rule in the running firewalld, i.e. without the -- >> permanent option and I can still connect to the darn thing. I wonder if >> it has something to do with the order in which the rules or the tables >> are being processed. >> >> firewall-cmd --add-rich-rule="rule family='ipv4' protocol value="tcp" >> destination address='a.b.0.0/16' reject" > > I would imagine rule order would be important, it always used to be with > iptables, unless firewalld has some in-built prioritising. But for your > above example, can double-quotes around tcp be inside double quotes for > the whole thing? > > It's many years since I did personal firewall rules. Back then it was > iptables, I'd made a script with all the rules I wanted. Going from > memory, it started off with an isolation command (didn't want things > sneaking it while it's pants were down), cleared all the existing rules, > put in my rules, and then the network was allowed to pass traffic. > > When needed, I did any needed changes in my script, and ran it. It was > the best way I could think of to always get consistent results. _______________________________________________ users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
