Firewall-cmd allow a single mac source

[supertight]

I want to switch the server from zone=home to zone=drop w/ the client MAC listed as the sol approved source.

I can get the interface into drop, I can add the MAC as a source. When I attempt to ssh into the server with that configuration, I'm blocked out. If I add SSH as a service, I can get in. But so can all the other clients on the network....

Do I need to write a rich rule? or am I just missing a step?

Thanks for reading.

[TrevorH]

This looks like a duplicate of your other recent posts. Please keep to one topic at a time and keep your posts in one place.

Is the machine you are trying to ssh from in the same network segment as the server you are trying to ssh to? No routers/firewalls in between?

[supertight]

This looks like a duplicate of your other recent posts. Please keep to one topic at a time and keep your posts in one place.

Is the machine you are trying to ssh from in the same network segment as the server you are trying to ssh to? No routers/firewalls in between?

My previous post was for my 6.9 servers. This post is for my 7.3 servers. I'm sorry If I should be lumping this into one topic. I made a new topic because I switched from iptables to firewalld. Feel free to close any of the other threads?

This time, Both client and server are on the same switch. No router in the mix.
client interface - 192.168.1.15
server interface - 192.168.1.14

[supertight]

This looks like a duplicate of your other recent posts. Please keep to one topic at a time and keep your posts in one place.

Is the machine you are trying to ssh from in the same network segment as the server you are trying to ssh to? No routers/firewalls in between?

My previous post was for my 6.9 servers. This post is for my 7.3 servers. I'm sorry If I should be lumping this into one topic. I made a new topic because I switched from iptables to firewalld. Feel free to close any of the other threads?

This time, Both client and server are on the same switch. No router in the mix.
client interface - 192.168.1.15
server interface - 192.168.1.14

I'm still hung up on this. Anyone? thanks.

[jlehtone]

Do I need to write a rich rule?

That should do it.

For example, if you do add rich rule

Code: Select all

rule family="ipv4" source mac="01:23:45:67:89:AB" service name="ssh" accept

then the IN_zonename_allow will have

Code: Select all

-p tcp -m mac --mac-source 01:23:45:67:89:AB -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT

You obviously have to remove the ssh from the services of the zone, or else
you will have the "too liberal"

Code: Select all

-p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT

[supertight]

Do I need to write a rich rule?

That should do it.

For example, if you do add rich rule

Code: Select all

rule family="ipv4" source mac="01:23:45:67:89:AB" service name="ssh" accept

then the IN_zonename_allow will have

Code: Select all

-p tcp -m mac --mac-source 01:23:45:67:89:AB -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT

You obviously have to remove the ssh from the services of the zone, or else
you will have the "too liberal"

Code: Select all

-p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT

Thank you for the reply and the code. Was helpful. I understand way better now.
So, Firewalld still writes iptables. It's just a different front end management.
With Centos 6, I have a script that I run with a flush, my rules and save/load at the end.

Code: Select all

iptables -F
## Set
 iptables -A INPUT -p tcp -m mac --mac-source 00:24:**:aa:**:9b -j ACCEPT
#
# default policies
#
 iptables -P INPUT DROP
 iptables -P FORWARD DROP
 iptables -P OUTPUT ACCEPT
#
 iptables -A INPUT -i lo -j ACCEPT
#
# Established and Related connections
#
 iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#
 /sbin/service iptables save
#
 iptables -L -v

Is there a way I can do this in Centos 7 and skip the firewall-cmd all together?

[TrevorH]

Yes, yum remove firewall\* then yum install iptables-services and configure as before. Might also need a systemctl enable iptables.

[supertight]

Yes, yum remove firewall\* then yum install iptables-services and configure as before. Might also need a systemctl enable iptables.

Thank you so much you guys. It's all very clear now. I can safely say I understand iptables.