Blocking a host

English Network/Internet
1

Hi all,

So I have a machine running slowroll with two (active) network cards in it which I use as my internet gateway. One of these is connected to my ISP and connects via PPPoE, and sets up a ppp0 connection which is my actual internet. One of the others eth3 is my connection to my local LAN on 192.168.0.0/25.

In firewall-config I have ppp0 setup in the external zone and eth3 setup in the internal zone I have masquarading setup on the external zone so all hosts on my internal network can reach the internet.

What I want to do is block one of the hosts on the internal net (192.168.0.242) from being able to connect outbound, but still allow it to communicate with hosts on the internal network.

Is this possible?

Cheers.

Phill.

2

If you are the manager of that internal host (that is you know how to get superuser privileges), you should configure on that system that it has no route configured to the gateway.

If another one is the manager there (and you do not trust him to do the above), you should indeed configure the firewall on your gateway. But then other people should help you, I can’t.

3

Have a look at firewalld policies…

This should suffice to block Internet traffic from the one host you mentioned, while still allowing it to communicate with other hosts on the LAN…

sudo firewall-cmd --permanent --new-policy block-host
sudo firewall-cmd --permanent --policy block-host --add-ingress-zone internal
sudo firewall-cmd --permanent --policy block-host --add-egress-zone external
sudo firewall-cmd --permanent --policy block-host --add-rich-rule='rule family="ipv4" source address="192.168.0.242" drop'
sudo firewall-cmd --reload
4

Thanks for that, it seems to have done the trick!

Cheers.

Phill.

1 Like