mirror of
https://codeberg.org/hyperreal/techne
synced 2024-11-01 14:23:06 +01:00
30 lines
854 B
Org Mode
30 lines
854 B
Org Mode
#+title: Firewalld
|
|
#+setupfile: ../org-templates/page.org
|
|
|
|
** Allow connections only from tailnet
|
|
|
|
Create a new zone for the ~tailscale0~ interface.
|
|
|
|
#+BEGIN_SRC shell
|
|
sudo firewall-cmd --permanent --new-zone=tailnet
|
|
sudo firewall-cmd --permanent --zone=tailnet --add-interface=tailscale0
|
|
sudo firewall-cmd --reload
|
|
#+END_SRC
|
|
|
|
Add services and ports to the ~tailnet~ zone.
|
|
|
|
#+BEGIN_SRC shell
|
|
sudo firewall-cmd --permanent --zone=tailnet --add-service={http,https,ssh}
|
|
sudo firewall-cmd --permanent --zone=tailnet --add-port=9100/tcp
|
|
sudo firewall-cmd --reload
|
|
#+END_SRC
|
|
|
|
Ensure the ~public~ zone does not have any interfaces or sources.
|
|
|
|
#+BEGIN_SRC shell
|
|
sudo firewall-cmd --permanent --zone=public --remove-interface=eth0
|
|
sudo firewall-cmd --reload
|
|
#+END_SRC
|
|
|
|
The firewall should now only allow traffic coming from the tailnet interface, ~tailscale0~.
|