I need to be able to temporarily cut off the source of network slowdowns.

What I used to do:
Router with 2 x NICs running slackware 14. Execute iptraf-ng, choose IP Network Monitor and sort by Byte Count. The sorted screen always seemed a bit confusing but I could usually pluck a couple of IP addresses with racing byte counts and cut all traffic to them using an iptables rule. Then if I wanted to identify the computer or device, I’d go into the dhcpd.leases file and look for the ip address and the corresponding device hostname. It was a bit of a pain, but it worked.

Now:
Router with 2 x NIC’s running CentOS 7. Using systemd and firewalld with 2 zones: external (internet-facing)
and internal (LAN-facing). Now when I try the same thing using firewall-cmd rich rules, it won’t work.

Example:

[root@hello ~]# firewall-cmd –zone=external –list-rich-rules rule family=”ipv4″ source address=”10.10.1.73/24″ drop rule family=”ipv4″ source address=”40.97.126.210″ drop rule family=”ipv4″ source address=”10.10.1.73/32″ drop rule family=”ipv4″ source address=”40.97.126.210/32″ drop

and

[root@hello ~]# firewall-cmd –zone=internal –list-rich-rules rule family=”ipv4″ source address=”10.10.1.73/24″ drop rule family=”ipv4″ source address=”40.97.126.210″ drop rule family=”ipv4″ source address=”10.10.1.73/32″ drop

It didn’t work. The traffic continued to burst away for another hour before stopping. The address (40.97.126.210) belongs to Microsoft so I’m not concerned about publishing it.

What am I doing wrong with firewalld rich rules and how do I properly drop/terminate traffic to/from a specific source on the LAN?

Current command –
ADD rich rule to drop any traffic in zone “internal” from source ip address 10.10.1.125:

firewall-cmd –permanent –zone=internal –add-rich-rule=’rule family=ipv4 source address=10.10.1.125/24 drop’
firewall-cmd –reload

REMOVE the same rich rule above:

firewall-cmd –permanent –zone=internal –remove-rich-rule=’rule family=ipv4 source address=10.10.1.125/24 drop’
firewall-cmd –reload

Thank you for reading.