Firewalld Rich Rule

To add a so called rich rule to firewalld I did the following.

Check existing rules after a recent upgrade to Fedora 22. 55555/tcp was a custom app not Fedora default.

1
# firewall-cmd --get-default-zone
2
FedoraServer
3

4
# firewall-cmd --zone=FedoraServer --list-all
5
FedoraServer (default)
6
  interfaces:
7
  sources:
8
  services: cockpit dhcpv6-client http smtp ssh
9
  ports: 55555/tcp
10
  masquerade: no
11
  forward-ports:
12
  icmp-blocks:
13
  rich rules:

Lets remove some rules.

1
# firewall-cmd --permanent --zone=FedoraServer --remove-port=55555/tcp
2
success
3
# firewall-cmd --permanent --zone=FedoraServer --remove-service=cockpit
4
success
5
# firewall-cmd --permanent --zone=FedoraServer --remove-service=dhcpv6-client
6
success

Add custom rule non-permanent.
** Note x.x.x.x is a placeholder for a real public IP. Most likely you won”t need a public IP but a non-routable Class C or B on your internal network.

1
# firewall-cmd --zone=FedoraServer --add-rich-rule="rule family="ipv4" source address="x.x.x.x/32" port protocol="tcp" port="55555" accept"
2
success

Or if you need it permanently added remember to use –permanent.

Restart the firewall.

1
# systemctl restart firewalld.service

1
# firewall-cmd --zone=FedoraServer --list-all
2
FedoraServer (default)
3
  interfaces:
4
  sources:
5
  services: http smtp ssh
6
  ports:
7
  masquerade: no
8
  forward-ports:
9
  icmp-blocks:
10
  rich rules:
11
        rule family="ipv4" source address="x.x.x.x/32" port port="55555" protocol="tcp" accept