Firewalld不阻止SSH请求

Question

我在centos 7.7上有以下配置。寻找只允许有限的IP设置和阻塞休息。在公共区域走富有规则的道路听起来很简单。删除ssh服务并使用富规则添加所需的ip。似乎已经开始正常工作了。大多数垃圾邮件都停止了。但是，当我重新启动服务器时，允许列表之外的I可以在短时间内到达服务器。我多次重新启动服务器，并且可以看到重复的模式。被阻塞的IP能够在重启后达到2-3分钟左右的时间，然后停止。

[root@ABC ~]# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500

[root@ABC ~]# firewall-cmd --get-default-zone
public

[root@ABC ~]# firewall-cmd --get-active-zones
(Nothing)

[root@ABC ~]# firewall-cmd --list-all-zones 
block
  target: %%REJECT%%
  icmp-block-inversion: no
  interfaces:
  sources:
  services:
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:


dmz
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:


drop
  target: DROP
  icmp-block-inversion: no
  interfaces:
  sources:
  services:
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:


external
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: ssh
  ports:
  protocols:
  masquerade: yes
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:


home
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: dhcpv6-client mdns samba-client ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:


internal
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: dhcpv6-client mdns samba-client ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:


public
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services:
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:
    rule family="ipv4" source address="1.2.3.4" service name="ssh" accept

trusted
  target: ACCEPT
  icmp-block-inversion: no
  interfaces:
  sources:
  services:
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:


work
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services:
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

被封锁的IP如何能够在火势下到达？

Answer 1

您的防火墙看起来配置不正确。我会添加一个名为“可信”的新区域。然后添加服务SSH和需要访问ssh上的服务器的源IP。然后，在zone public中，添加需要公共的所有服务，并将接口eth0添加到该区域。我相信这是配置基于区域防火墙的正确方法。