1

I want to add a range of OUTPUT chain ports using firewall-cmd using its direct rule method, something like this:

firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 -p tcp -m tcp --dport=80-1000 -j ACCEPT

This says success however not seem to work

Ibrahim Quraish
  • 3,889
  • 2
  • 31
  • 39

2 Answers2

1

Use a comma, i.e. --dport 80,1000.

That said, using direct rules is discouraged (your command returns 'success' because firewall-cmd doesn't check the directly entered iptables syntax -- it assumes you have the rule correct). Man page says:

Direct options should be used only as a last resort when it's not possible to use for example --add-service=service or --add-rich-rule='rule'.

See Configuring Complex Firewall Rules with the "Rich Language" Syntax.

Robert Kratky
  • 542
  • 3
  • 14
0

The below command will accept traffic from ports 22,53 and 80 (see source):

/sbin/iptables -A INPUT -p tcp --match multiport --dports 22,53,80 -j ACCEPT

I prefer this variation with reload required for permanent rules only:

sudo firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -p tcp -m multiport --dport 22,53,80 -j ACCEPT && sudo firewall-cmd --reload
alboforlizo
  • 170
  • 1
  • 6