I am running Red Hat Enterprise Linux 7.9, where I'm trying to block docker-proxy
TCP port 5000
via firewall-cmd
. I am using the default public
zone as the only active zone and have tried the following individually and in combination:
- Removed port
5000
from thepublic
zone. - Added a rich-rule to reject all traffic to port
5000
.
Still, when I telnet
from a different host, it says "Connected to <FQDN>". This behavior is seen only for port 5000
. Other ports, such as 443
obey the firewall rules as expected.
Here is my firewall configuration:
[root@<hostname> ~]# firewall-cmd --list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: ens160
sources:
services: dhcpv6-client ssh
ports: 8472/udp 22/tcp 443/tcp 2376/tcp 2379-2380/tcp 6443/tcp 1300-3000/tcp
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family="ipv4" port port="5000" protocol="tcp" reject
rule family="ipv6" port port="5000" protocol="tcp" reject
Here is docker-proxy
listening on it:
[root@<hostname> ~]# netstat -tnlp | grep 5000
tcp6 0 0 :::5000 :::* LISTEN 3541/docker-proxy
Any help is appreciated.