Firewalld
2024-10-24
Allow connections only from tailnet
Create a new zone for the tailscale0 interface.
sudo firewall-cmd --permanent --new-zone=tailnet
sudo firewall-cmd --permanent --zone=tailnet --add-interface=tailscale0
sudo firewall-cmd --reload
Add services and ports to the tailnet zone.
sudo firewall-cmd --permanent --zone=tailnet --add-service={http,https,ssh}
sudo firewall-cmd --permanent --zone=tailnet --add-port=9100/tcp
sudo firewall-cmd --reload
Ensure the public zone does not have any interfaces or sources.
sudo firewall-cmd --permanent --zone=public --remove-interface=eth0
sudo firewall-cmd --reload
The firewall should now only allow traffic coming from the tailnet interface, tailscale0.