For basic firewall-cmd Using firewall-cmd in CentOS 7

For starting and stopping firewalld service Disable FirewallD Services on CentOS 7

Firewall Rich Rules are an additional feature of firewalld that allows you to create the most sophisticated firewall rules.

Option 1a: To add a rich rule to allow a subnet to be whitelisted. The rest should be rejected. For example, you only want 192.168.1.0/24 to be admitted; the rest of the source IP addresses should be rejected.

# firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" invert="true" port port="22" protocol="tcp" accept'
# firewall-cmd --reload

public (active)
  target: ACCEPT
  icmp-block-inversion: no
  interfaces: ens33
  sources: 192.168.1.0/24
  services: 
  ports: 
  protocols: 
  forward: no
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 
	rule family="ipv4" source NOT address="192.168.1.0/24" port="22" reject

Option 1b: To add a rule to allow a service to be whitelisted. The rest should be rejected. For example, you only want 192.168.1.0/24 to be admitted; the rest of the source IP addresses should be rejected.

# firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" invert="true" service name="ssh" accept'
# firewall-cmd --reload

public (active)
  target: ACCEPT
  icmp-block-inversion: no
  interfaces: ens33
  sources: 192.168.1.0/24
  services: 
  ports: 
  protocols: 
  forward: no
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 
	rule family="ipv4" source NOT address="192.168.1.0/24" service name="ssh" reject

Option 1c: To remove a rich rule to allow a subnet to be whitelisted

# firewall-cmd --permanent --zone=public --remove-rich-rule='rule family="ipv4" source address="192.168.1.0/24" invert="true" port port="22" protocol="tcp" accept'
# firewall-cmd --reload

Option 2a: To add log entry

# firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24 invert="true" port port="22" protocol="tcp" log prefix="Firewall Rich Rule Log" level="notice" accept'

Step 1: Stop the libvirtd Service

# systemctl stop libvirtd.service

You should see something like this

● libvirtd.service - Virtualization daemon
Loaded: loaded (/usr/lib/systemd/system/libvirtd.service; enabled; vendor preset: enabled)
Active: inactive (dead) since Mon 2019-06-03 13:33:26 +08; 43s ago
Docs: man:libvirtd(8)
https://libvirt.org
Process: 28069 ExecStart=/usr/sbin/libvirtd $LIBVIRTD_ARGS (code=exited, status=0/SUCCESS)
Main PID: 28069 (code=exited, status=0/SUCCESS)
Tasks: 2 (limit: 32768)
Memory: 6.7M
CGroup: /system.slice/libvirtd.service
├─28896 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr/libexec/libvirt_leaseshelper
└─28897 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr/libexec/libvirt_leaseshelper

Step 2. Disable the service

# systemctl disable libvirtd.service

Step 3: Removing the virbr0 interfaces on machine

# brctl show

bridge name     bridge id               STP enabled     interfaces
docker0         8000.0242f3432864       no
virbr0          8000.525400d6fcaa       yes             virbr0-nic

Step 4: Down the Bridge Link

# ip link set virbr0 down

Step 5: Remove the Bridge

# brctl delbr virbr0

Step 6: Verify that the bridge has been removed.

# brtcl show

bridge name bridge id STP enabled interfaces
docker0 8000.0242f3432864 no