Question

A security engineer must configure a firewall on a RHEL 9 server so that inbound SSH is permitted only from the management subnet 10.20.0.0/24, while all other inbound SSH attempts are dropped. The change must survive reboots. Which firewalld approach correctly accomplishes this?

Accepted Answer

Create a permanent rich rule allowing the ssh service from source 10.20.0.0/24, remove the plain ssh service from the zone, then reload firewalld

Answer

Add the ssh service permanently to the public zone and set the zone target to DROP, then reload firewalld

Answer

Run 'firewall-cmd --add-source=10.20.0.0/24' in the runtime configuration only so the rule applies immediately

Answer

Add port 22/tcp permanently to the trusted zone and assign all interfaces to that zone