Ravindra BagaleCourses & study guides Track your progress

Guides

How to Block an IP Address with firewalld on Linux

By , Cyber Security trainer LinkedIn Published: Last updated:

On a host using firewalld, block one IP with a rich rule: sudo firewall-cmd --add-rich-rule='rule family=ipv4 source address=203.0.113.50 drop'. Add --permanent and reload to keep it after reboot. Prefer Fail2ban for repeated SSH noise.

Quick answer

sudo firewall-cmd --add-rich-rule='rule family=ipv4 source address=203.0.113.50 drop'
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=203.0.113.50 drop'
sudo firewall-cmd --reload

Why block at the host?

Sometimes one IP floods SSH or your app. You need a fast host-level drop while you also fix cloud rules. Aisha in Lagos and Dev in Aurangabad both keep the rich-rule syntax in their incident notes.

What is a rich rule?

A firewalld rule with extra match fields (source address, port, service). drop discards matching packets.

How do I block step by step?

  1. Confirm firewalld is running: 
    systemctl is-active firewalld

    What it means: Must print active. If not, do not blindly enable without knowing your network plan.

  2. Temporary block: 
    sudo firewall-cmd --add-rich-rule='rule family="ipv4" source address="203.0.113.50" drop'
    success

    What it means: Packets from that IPv4 address are dropped until reboot (or until removed).

  3. List rules: 
    sudo firewall-cmd --list-rich-rules

    What it means: Shows the active rich rules so you can audit them.

  4. Make it permanent: 
    sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.50" drop'
sudo firewall-cmd --reload

    What it means: Saved to permanent config and applied.

  5. Remove later with --remove-rich-rule using the same rule string.

On AWS, also consider a security-group deny via tighter allow-lists, or an NACL deny for stubborn cases (NACL guide).

Ravindra Bagale's Tip

Blocking one IP is a bandage. If you are on AWS, also restrict the security group. Cloud and host firewalls work together. Chen in Singapore blocks at both layers during an incident.

Quick quiz: check what you learned

  1. Which two firewalld steps make a rich rule survive reboot?

    1. Add with --permanent then --reload
    2. Only hope the attacker goes away
    3. Disable SELinux on the whole host
    4. Open port 0 to the public internet
    Show answer

    A. Runtime rules die on reboot without --permanent + reload.

  2. Best long-term protection for SSH on a public server?

    1. Fail2ban plus a tight security group
    2. Public password auth left forever
    3. No logging of failed SSH attempts
    4. FTP on port 21 left wide open
    Show answer

    A. Layer host firewall, cloud SG, and fail2ban.

Learn it properly

This guide is the short path. These pages go deeper, with labs:

Frequently asked questions

How do I block an IP with firewalld?

sudo firewall-cmd --add-rich-rule='rule family=ipv4 source address=IP drop'

How do I block a whole /24?

Use source address=203.0.113.0/24 in the rich rule — carefully.

firewalld vs AWS NACL?

firewalld is on the OS. NACL is in the VPC subnet. Different layers.

What about Ubuntu ufw?

Use sudo ufw deny from IP. This guide focuses on firewalld (Amazon Linux / RHEL).

Related?

Fail2ban guide and Cyber 32.3 host firewall lesson.