Drop/Terminate data to/from source using firewalld rich rules

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]



I need to be able to temporarily cut off the source of network slowdowns.

What I used to do:
Router with 2 x NICs running slackware 14.
Execute iptraf-ng, choose IP Network Monitor and sort by Byte Count.
The sorted screen always seemed a bit confusing but I could usually
pluck a couple of IP addresses with racing byte counts and cut all
traffic to them using an iptables rule.
Then if I wanted to identify the computer or device, I’d go into the
dhcpd.leases file and look for the ip address and the corresponding
device hostname.
It was a bit of a pain, but it worked.

Now:
Router with 2 x NIC’s running CentOS 7.
Using systemd and firewalld with 2 zones: external (internet-facing)
and internal (LAN-facing).
Now when I try the same thing using firewall-cmd rich rules, it won’t work.

Example:

[root@hello ~]# firewall-cmd --zone=external --list-rich-rules
rule family="ipv4" source address="10.10.1.73/24" drop
rule family="ipv4" source address="40.97.126.210" drop
rule family="ipv4" source address="10.10.1.73/32" drop
rule family="ipv4" source address="40.97.126.210/32" drop

and

[root@hello ~]# firewall-cmd --zone=internal --list-rich-rules
rule family="ipv4" source address="10.10.1.73/24" drop
rule family="ipv4" source address="40.97.126.210" drop
rule family="ipv4" source address="10.10.1.73/32" drop

It didn’t work. The traffic continued to burst away for another hour
before stopping.
The address (40.97.126.210) belongs to Microsoft so I’m not concerned
about publishing it.

What am I doing wrong with firewalld rich rules and how do I properly
drop/terminate traffic to/from a specific source on the LAN?

Current command -
ADD rich rule to drop any traffic in zone "internal" from source ip
address 10.10.1.125:

firewall-cmd --permanent --zone=internal --add-rich-rule='rule
family=ipv4 source address=10.10.1.125/24 drop'
firewall-cmd --reload

REMOVE the same rich rule above:

firewall-cmd --permanent --zone=internal --remove-rich-rule='rule
family=ipv4 source address=10.10.1.125/24 drop'
firewall-cmd --reload

Thank you for reading.
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
https://lists.centos.org/mailman/listinfo/centos




[Index of Archives]     [CentOS]     [CentOS Announce]     [CentOS Development]     [CentOS ARM Devel]     [CentOS Docs]     [CentOS Virtualization]     [Carrier Grade Linux]     [Linux Media]     [Asterisk]     [DCCP]     [Netdev]     [Xorg]     [Linux USB]


  Powered by Linux