☰

Firewalld 不阻止 SSH 请求

tag-icon • tag-icon ssh firewalld
Firewalld 不阻止 SSH 请求

我在 centos 7.7 上有以下配置。寻找仅允许有限的 IP 设置并阻止其余 IP。在公共区域上使用富规则方式听起来很简单。删除 ssh 服务并使用富规则添加所需的 ip。它似乎已经开始正常工作。大多数垃圾邮件 ssh 都停止了。但是当我重新启动服务器时，允许列表之外的 IP 在短时间内能够访问服务器。我多次重新启动服务器，我可以看到重复的模式。被阻止的 IP 在重启后大约 2-3 分钟内能够访问，然后停止。

[root@ABC ~]# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500

[root@ABC ~]# firewall-cmd --get-default-zone
public

[root@ABC ~]# firewall-cmd --get-active-zones
(Nothing)

[root@ABC ~]# firewall-cmd --list-all-zones 
block
  target: %%REJECT%%
  icmp-block-inversion: no
  interfaces:
  sources:
  services:
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:


dmz
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:


drop
  target: DROP
  icmp-block-inversion: no
  interfaces:
  sources:
  services:
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:


external
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: ssh
  ports:
  protocols:
  masquerade: yes
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:


home
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: dhcpv6-client mdns samba-client ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:


internal
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: dhcpv6-client mdns samba-client ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:


public
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services:
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:
    rule family="ipv4" source address="1.2.3.4" service name="ssh" accept

trusted
  target: ACCEPT
  icmp-block-inversion: no
  interfaces:
  sources:
  services:
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:


work
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services:
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

被阻止的 IP 在运行 Firewalld 时如何能够访问？

答案1

您的防火墙配置似乎不正确。我会添加一个名为受信任的新区域。然后添加服务 ssh 和需要通过 SSH 访问服务器的源 IP。然后在区域 public 中添加所有需要公开的服务，并将接口 eth0 添加到该区域。我相信这是配置基于区域的防火墙的正确方法。

相关内容