Marius Vollmer <marius.vollmer(a)redhat.com> writes:
- In order to receive the unicast replies, we can punch a small hole
in
the firewall while we listen for those replies. The hole would allow
packets from *:427 to the socket we listen on, nothing else. This is
done inside cockpitd.
Right, my naivety knows no bounds. Of course we can't know the
destination port without patching OpenSLP and of course we can't
reliably add temporary firewall rules without patching firewalld.
So let's just open the firewall wide with
firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -p udp --sport 427 -j ACCEPT
until the conntrack helper exists.