- So we are going to do this on the main machine,
the center west machine.
And we need to think about incoming traffic only allowed
if it comes from the default router IP address.
So we need a source as well.
And that means
that we should probably have a look at rich rules.
So man firewalld.richlanguage.
And let's check if there is an example
that is doing what we want it to do.
And here we can see something pretty accurate.
Let me copy this.
And let me use firewall-cmd - -add-rich-rule
rule is single quote, paste.
Let me not forget the closing single quote.
We don't need the logging information.
So we can remove all of this.
We can work with the service name ftp,
instead of tftp and the source address.
Well the source address should be the default gateway.
That is 29.2.
So this should be doing it.
Oh boy, bad attribute 'rule'.
So, what's going on?
Well, in cases like this where the syntax is confusing you,
I would advise you use
firewall-cmd - -help | grep add-rich
and it should give you enough.
So add-rich-rule is .
Ah, now I understand what I've done wrong.
Directly after add-rich-rule,
we can specify the equals sign and then the rule.
So we have too much information in this line.
I like this approach to do a quick check
of the syntax using firewall-cmd - -help,
grep whatever you want to grep.
And in most cases this does make sense.
Now I added this to runtime.
Let's also add it to permanent
so that the configuration is persistent.
And let's verify firewall-cmd - -list-all.
Where we can see that a couple of rich-rules
exist at this point.
And this is what we want.
Name is "ftp" accept.
That's only going to accept incoming ftp traffic
if it is from 29.2.
So that's all.
Now we're done.