firewalld-users October 2014

firewalld-users@lists.fedorahosted.org

9 participants
12 discussions

how to block incoming and outgoing connections with IP?
by Patrick Hinkley 17 Aug '15

17 Aug '15

Given an IP address, how can I prevent any connection both to and from that IP? If there are multiple methods, please describe the pros and cons of each. I've found a lot of contradictory and confusing information about this online and in the documentation. Thanks for any help!

2 2

firewalld example gateway
by Igor Gnatenko 22 Oct '14

22 Oct '14

Hi, many people using Fedora/CentOS/RHEL/.. for organizing gateways, with transparent proxy or with many other options. And they using iptables. I have not seen any examples for organizing gateway with/without transparent proxy using firewalld. I think would be good if we will have this how-to. Thoughts? P.S. I can't write this doc, because I can't set it up =( -- -Igor Gnatenko

2 1

firewalld-0.3.12
by Jiri Popelka 15 Oct '14

15 Oct '14

Hi everybody, here's firewalld-0.3.12 https://fedorahosted.org/released/firewalld/firewalld-0.3.12.tar.bz2 sha1sum: 265fab1899b600f9f1dead109ef5d53143aba6cb Changelog: The most visible change is a new feature, which allows you to save active runtime configuration and overwrite permanent configuration with it. The way this is supposed to work is that when configuring firewalld you do runtime changes only and once you're happy with the configuration and you tested that it works the way you want, you save the configuration to disk. You do that by running: $ firewall-cmd --runtime-to-permanent or selecting 'Runtime To Permanent' in firewall-config menu. (while I'm writing this I've noticed that it's not documented in firewall-cmd man page and also the firewall-config says 'permant' instead of 'permanent' - but that needs to wait for another release) Second most significant change (even not visible to end users) is that D-Bus interfaces for permanent changes are now more fine grained and there are new methods for permanent changes of zones, services, icmptypes, direct and policies (lockdown whitelist) so the permanent interfaces are more in sync with runtime ones. Other changes: - firewalld: - richLanguage: allow using destination with forward-port - Rich_Rule.check(): action can't be used with icmp-block/forward-port/masquerade - fixed Python specific D-Bus exception (RHBZ#1132441) - firewall-cmd: - use new D-Bus methods for permanent changes - show target REJECT instead of %%REJECT%% (RHBZ#1058794) - --direct: make fail messages consistent (RHBZ#1141835) - firewall-config: - richRuleDialog - OK button tooltip indicates problem - use new D-Bus methods for permanent changes - show target REJECT instead of %%REJECT%% (RHBZ#1058794) - update "Change Zones of Connections" menu on default zone change (RHBZ#11120212) - fixed rename of zones, services and icmptypes to not create new entry (RBHZ#1131064) - configuration: - new service for Squid HTTP proxy server - new service for Kerberos admin server - new services for syslog and syslog-tls - new services for SNMP and SNMP traps - add Keywords to .desktop to improve software searchability - docs: - updated translations - firewalld.richlanguage: improvements suggested by Rufe Glick - firewalld.dbus: various improvements - firewalld.zone: better description of Limit tag - mention new homepage everywhere Enjoy, Jiri

1 0

port forwarding by address
by Andrus, Brian Contractor 14 Oct '14

14 Oct '14

All, So under iptables I am able to do things like: *nat -A PREROUTING -d 204.1.8.6 -j DNAT --to-destination 10.2.1.1 -A POSTROUTING -s 10.2.1.1 -j SNAT --to-source 204.1.8.6 -A PREROUTING -d 204.1.8.2 -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.3.1.1 -A PREROUTING -d 204.1.8.2 -p tcp -m tcp --dport 443 -j DNAT --to-destination 10.3.1.1 -A PREROUTING -d 204.1.8.3 -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.4.1.1 -A PREROUTING -d 204.1.8.3 -p tcp -m tcp --dport 110 -j DNAT --to-destination 10.4.1.1 -A POSTROUTING -s 10.0.0.0/8 ! -d 10.0.0.0/8 -j MASQUERADE I am at a loss to figure out how to do that under firewalld. The main intention here is to have a particular incoming addr[:port] be redirected to a particular internal addr[:port] used to have VMs on an internal network (10.x.y.z). The net effect of the above entry is a specific external IP address appears to be a specific internal server, even for outgoing connections while the other internal servers get masqueraded as the primary ip. The piece I cannot seem to find is to tell firewalld-cmd to use a particular destination ip address for incoming requests and NAT that. I have tried: firewall-cmd --zone=public --remove-rich-rule='rule family="ipv4" destination address="204.1.8.6" forward-port to-addr="10.3.1.2" protocol="tcp" port="0-65535"' But that seems to ignore the destination address and instead routes everything for ALL addresses to 10.3.1.2 Is there a way with firewall-cmd to only nat traffic coming in to for a particular IP address when there are several IP addresses on the same nic? Brian Andrus ITACS/Research Computing Naval Postgraduate School Monterey, California voice: 831-656-6238

2 1

Firewalld way how to change default policy type from ACCEPT to something else for a particular chain
by Jan Lieskovsky 13 Oct '14

13 Oct '14

Hello folks, we develop security guidance / compliance related tools and content for Red Hat Enterprise Linux. Recently within the effort to port old(er) iptables sections from Red Hat Enterprise Linux 6 to Red Hat Enterprise Linux 7 we encountered the following firewalld related question. Please have a look at sample guidance document at: [1] https://jlieskov.fedorapeople.org/rhel6-guide.html In the section "2.5.7. iptables and ip6tables", under rule: "2.5.7.2.a. Set Default iptables Policy for Incoming Packets" there's the following requirement: <quote> To set the default policy to DROP (instead of ACCEPT) for the built-in INPUT chain which processes incoming packets, add or correct the following line in /etc/sysconfig/iptables: :INPUT DROP [0:0] </quote> The question is how to ensure the iptables rule of the exact meaning is applied on the system by using firewalld related tools? In other words is there a way via firewalld tools how to change default policy type from "ACCEPT" to e.g. "DROP" for some particular filter chain (e.g. "INPUT")? [*] Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team [*] We are aware that firewalld uses different configuration file than /etc/sysconfig/iptables & can handle that. But the question is how to change the default policy type from 'ACCEPT' to something else.

3 5

Re: Ways to limit outgoing traffic?
by Rufe Glick 13 Oct '14

13 Oct '14

I didn't know that /etc/firewalld/direct.xml file exists. And I didn't know that rules added through the direct interface can be made permanent. The thing is that I'm preparing for the RHCE (RHEL 7) exam. And there aren't any study guides out there for this version yet. So the first place I go for information is the official Red Hat documentation for RHEL 7 [https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/] Here [https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/ht…] in the second paragraph of the 'Understandin the Direct Interface' section of the 'Security Guide'. It says that 'The direct interface mode is intended for services or applications to add specific firewall rules during run time. The rules are not permanent and need to be applied every time after receiving the start, restart or reload message from firewalld using D-BUS.' Then later in the same document [https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/ht…] the note under the 'Configuring the Firewall Using the Command Line Tool, firewall-cmd' says that 'In order to make a command permanent or persistent, add the --permanent option to all commands apart from the --direct commands (which are by their nature temporary).' Now I see that those statements are either outdated or simply incorrect. I'll take a closer look on the direct interface. Thanks for pointing it out for me. I think that is what I need for limiting outgoing traffic. Rufe On 10/13/2014 7:25:50 AM, Jiri Popelka <jpopelka(a)redhat.com> wrote: On 10/06/2014 07:41 PM, Rufe Glick wrote: > While skimming through this mailing list's archives I saw that this > question was raised a couple of times. And last time in August of this > year Jiri reiterated that "So far we don't handle outbound traffic in > firewalld". > > So if I still need to limit outgoing traffic what is the best way to > proceed? I could probably use the direct interface. But then I'll have > to write a daemon that'll handle reload\reboot events of firewalld to > re-add the rules. That sounds a bit complicated. Have you known that 'direct' configuration can be stored in /etc/firewalld/direct.xml ? see firewalld.direct man page. Or you can use firewall-cmd like for example: $ firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 -p tcp -m tcp --sport 1234 -j DROP Or perhaps I don't understand your use case. > The only solution I see is to disable the firewalld service altogether > and fall back to iptables service. > > Any other ideas? > > Also in my opinion a full value firewall solution has to have an > ability to limit outgoing traffic. Are there plans to incorporate this > functionality any time soon? None that I know of. -- Jiri

2 1

Ways to limit outgoing traffic?
by Rufe Glick 13 Oct '14

13 Oct '14

While skimming through this mailing list's archives I saw that this question was raised a couple of times. And last time in August of this year Jiri reiterated that "So far we don't handle outbound traffic in firewalld". So if I still need to limit outgoing traffic what is the best way to proceed? I could probably use the direct interface. But then I'll have to write a daemon that'll handle reload\reboot events of firewalld to re-add the rules. That sounds a bit complicated. The only solution I see is to disable the firewalld service altogether and fall back to iptables service. Any other ideas? Also in my opinion a full value firewall solution has to have an ability to limit outgoing traffic. Are there plans to incorporate this functionality any time soon? Thanks, Rufe

2 1

What exactly does the limit tag of the action element do?
by Rufe Glick 10 Oct '14

10 Oct '14

> > >> 2. In the *Action *description the very last line says "Also an action > >> can be limited using the /limit tag/." What limit tag does the statement > >> refer to? > > > > > > The limit tag is described in Log. > The thing is that 'limit tag' term is not used in the description of > the Log element. Please use the 'limit tag' term in the description of > the Log element at least once. For consistency it'll also be a good > idea to include that extra option in the description of the Action > element, like this: > accept | reject [type="reject type"] | drop [limit value="rate/duration"] > For me this rises another question. What does it mean to limit, say, > an accept action to once a day? Does it mean that only one connection > attempt a day will be let through the firewall and all other attempts > be dropped? Will they be dropped with a drop action? How about reject > action (if once a day) -- will the first connection attempt be > rejected with ICMP message and all other attempts be dropped? And for > the drop action rate limiting will not change anything then. Please > clarify. Well, after some tests I see that what I suggested is not true. The 'limit tag' doesn't limit connection attempts. So what exactly does the limit tag do for the action? Please consider the following example and explain me the functional difference: firewall-cmd --add-rich-rule='rule family=ipv4 service name=http accept limit value=1/m' firewall-cmd --add-rich-rule='rule family=ipv4 service name=http accept' Thank you, Rufe

2 1

Clarification on some statements form firewalld.richlanguage man page
by Rufe Glick 10 Oct '14

10 Oct '14

Hello, Please clarify the following issues related to the rich language for me: 1. In the Rule description it is said that "If source or destination addresses are used in a rule, then the rule family need to be provided." Then in the description for the Source says that "A source address or address range is either an IP address or a network IP address with a mask for IPv4 or IPv6. The network family (IPv4/IPv6) will be automatically discovered)." It seems to me that wordings marked in italic contradict each other. When using source keyword the rule family either has to be provided or it will be discovered automatically. Which one is true? 2. In the Action description the very last line says "Also an action can be limited using the limit tag." What limit tag does the statement refer to? System info: CentOS 7, firewalld-0.3.9-7.el7.noarch Thank you, Rufe

2 3

What's the purpose of having port range for the 'forward-to-ports' when using Port Forwarding feature?
by Rufe Glick 06 Oct '14

06 Oct '14

Hello, On the 'forwarder' machine with ip address of 10.0.0.1 I set up port forwarding using firewalld from of5001-5002/tcp range to ports 6001-6002 of 10.0.0.2 machine. Now when I connect to 10.0.0.1 from a third machine to ports 5001 or 5002 both connections go to port 6001 of the 10.0.0.2 machine; no connection ever goes to port 6002. So what's the purpose of having range if connections to all 'forward-from-ports' always go to the first port from the 'forward-to-ports' range? What am I missing? Thank you, Rufe

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

firewalld-users October 2014