Built-in Firewall for Systemd Services

Systemd includes a feature to restrict which IP addresses can communicate with a service. The neat thing is that these rules operate independently of any iptables configuration, providing an extra layer of security.

Restricting SSH to a local subnet

As an example, let's restrict sshd to the subnet. Run systemctl edit sshd.service and add the following.


Then run systemctl daemon-reload; systemctl restart sshd