Create subzones in firewallD

Question

In firewalld, I can assign a zone to an network interface. A zone contains some firewall rules.

Now I have a network interface with different levels of trust (172.16.1.1/32 should have special access in the 172.16.1.0/24 network). For example SSH access for an admin host.

The only way I found to realize that, is to use a rich rule. But I am not happy with this approach, because it's basically an iptables rule without the possibility to give a description. Is there a way to create a separate zone or subzone for the admin host?

The advantage would be, that the configuration is more readable. I could create a ManagmentZone with special permissions. And when another Admin-PC comes to life, I can simply add its address to this zone.

Solution

Is there a way to create a separate zone?

Yes, you can create new zones:

https://fedoraproject.org/wiki/FirewallD#How_to_configure_or_add_zones.3F

How to configure or add zones?

To configure or add zones you can either use one of the firewalld interfaces to handle and change the configuration. These are the graphical configuration tool firewall-config, the command line tool firewall-cmd or the D-BUS interface. Or you can create or copy a zone file in one of the configuration directories. @PREFIX@/lib/firewalld/zones is used for default and fallback configurations and /etc/firewalld/zones is used for user created and customized configuration files.

From http://www.certdepot.net/rhel7-get-started-firewalld/

# firewall-cmd --permanent --new-zone=test
success
# firewall-cmd --reload
success

Comments

[Michael Hampton]

You could just add these IP addresses to the trusted zone, or a new zone.

[Mathias Vetsch]

Thanks! I did not understand that I can add ip ranges to zones: firewall-cmd --permanent --zone=trusted --add-source=192.168.2.0/24