Firewalld is a powerful firewall management tool used in Linux distributions such as CentOS, RHEL, and Fedora. It provides a flexible and dynamic way to manage firewall rules, allowing users to define security policies effectively. One of the key features of Firewalld is rich rules, which provide more granular control over network traffic compared to standard rules.

What Are Rich Rules in Firewalld?

Rich rules are an advanced method of defining firewall policies, offering additional filtering options such as:

  • Specifying source and destination addresses
  • Allowing or rejecting traffic based on protocols or ports
  • Defining logging and audit rules
  • Setting rate limits and actions for specific connections

Rich rules allow administrators to create fine-tuned security policies beyond the basic zone and service-based rules.

Checking Existing Rich Rules

To check if there are any rich rules currently configured, run the following command:

firewall-cmd --list-rich-rules

This will display any rich rules that are currently active in the firewall.

Adding a Rich Rule

To add a new rich rule, use the following syntax:

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" 
source address="192.168.1.100" service name="ssh" accept'

This rule allows SSH traffic from a specific IP address (192.168.1.100).

After adding a rule, reload Firewalld to apply the changes:

firewall-cmd --reload

Blocking Traffic with a Rich Rule

To block traffic from a specific IP address, use:

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" 
source address="192.168.1.200" drop'

This rule will silently drop all traffic from 192.168.1.200 without sending a response.

Allowing Traffic for a Specific Port and Protocol

To allow traffic for a particular port and protocol, such as HTTP on port 80:

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" 
source address="192.168.1.0/24" port protocol="tcp" port="80" accept'

This rule allows HTTP traffic from any device within the 192.168.1.0/24 subnet.

Logging and Auditing Traffic

To log dropped packets for monitoring purposes, use:

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" 
source address="192.168.1.150" drop log prefix="[FIREWALL-DROP]" level="info"'

This rule drops traffic from 192.168.1.150 and logs it with the prefix [FIREWALL-DROP].

Removing a Rich Rule

To remove a specific rich rule, use:

firewall-cmd --permanent --remove-rich-rule='rule family="ipv4" 
source address="192.168.1.100" service name="ssh" accept'

Then reload Firewalld:

firewall-cmd --reload

Best Practices for Managing Rich Rules

  • Always test new firewall rules before applying them permanently.
  • Use logging rules to monitor and analyze blocked traffic.
  • Regularly review firewall rules to ensure security compliance.
  • Restrict access to critical services by IP address or subnet.

Conclusion

Managing rich rules in Firewalld provides a flexible and powerful way to control network traffic with fine-grained filtering. Whether you’re allowing specific IP addresses, blocking unauthorized traffic, or logging connections, rich rules help enhance security and maintain network integrity.