\section{Source Management}

\begin{frame}
   {Source Management}

   \begin{itemize}
      \item Bind zones to particular network addresses, not
      just interfaces
      \item Packets not from associated addresses go to default zone
      \item Assign with \textbf{firewall-cmd}:
      \begin{cmd}
$ sudo firewall-cmd --permanent --zone=trusted --add-source=192.168.1.0/24
   \end{cmd}
      \begin{response}
success
      \end{response}
   \end{itemize}

\end{frame}

\cprotect\note {

   Any zone can be bound not just to a network interface,
   but also to particular network addresses.  A packet is
   associated with a zone if:
   \begin{itemize}
      \item It comes from a source address already bound to
      the zone; or if not:
      \item It comes from an interface bound to the zone.
   \end{itemize}
   Any packet not fitting the above criteria is assigned to
   the default zone (i.e, usually \textbf{public}).

   To assign a source to a zone (permanently):
   \begin{cmd}
$ sudo firewall-cmd --permanent --zone=trusted --add-source=192.168.1.0/24
   \end{cmd}
   \begin{response}
success
   \end{response}
   This says anyone with an IP address of
   \texttt{192.168.1.x} will be added to the
   \textbf{trusted} zone.

   Note you can remove a previously assigned source from a
   zone by using the \texttt{--remove-source} option, or
   change the zone by using \texttt{--change-source}.

   You can list the sources bound to a zone with:
   \begin{cmd}
$ sudo firewall-cmd --permanent --zone=trusted --list-sources 192.168.1.0/24
   \end{cmd}

   In both of the above commands, if you leave out the
   \texttt{--permanent} option, you get only the current
   run time behavior.

}

