firewalld-users August 2014

firewalld-users@lists.fedorahosted.org

7 participants
6 discussions

how to block incoming and outgoing connections with IP?
by Patrick Hinkley 17 Aug '15

17 Aug '15

Given an IP address, how can I prevent any connection both to and from that IP? If there are multiple methods, please describe the pros and cons of each. I've found a lot of contradictory and confusing information about this online and in the documentation. Thanks for any help!

2 2

Appreciated hints about expected exact firewall-offline-cmd --direct --add-rule / --query-rule syntax (mainly about the priority field) or corresponding richlanguage syntax
by Jan Lieskovsky 16 Sep '14

16 Sep '14

Hello folks, I participate on developing SCAP content: [1] http://scap.nist.gov/ within the SCAP Security Guide project: [2] https://fedorahosted.org/scap-security-guide/ Within that [2] project we develop security compliance guidance for Red Hat products (content for RHEL-6, RHEL-7, Fedora already exist, content for products like OpenStack, RHEVM3, JBossEAP5 needs care yet). Within the process of identification, which parts of existing RHEL-6 content would require modification when trying to port it to RHEL-7 we identified firewalld as one of the components, that might require our attention. FWIW regarding firewall configuration the system administrators situation slightly changed when considering RHEL-6 and RHEL-7. For the very least, in RHEL-6 there was system-config-firewall tool, which in RHEL-7 the firewall can be managed in two ways (when not counting direct iptables command usage): * via system-config-firewall or * via firewalld. From the very introductory article: [3] http://www.oracle-base.com/articles/linux/linux-firewall-firewalld.php each of these (system-config-firewall & firewalld) constitute different approaches to the system's firewall administration / management. Starting from differing config files (/etc/sysconfig/iptables, /etc/sysconfig/ip6tables for s-c-f vs the XML format based configuration files in /usr/lib/firewalld/services -- the services XML templates, and actually honoured configuration present in /etc/firewalld/services), through the concept of zones, firewalld introduced a different view at system's firewall administration / management. Consider the use case: ----------------------- What we have now are iptables rules defined in the form acceptable / generated by s-c-f (for RHEL-6). But when checking RHEL-7 system to be security compliant wrt to firewall settings we will also need to check the newly added config location (/etc/firewalld/services) if it contains the corresponding rules expressed in the form as accepted / expected by firewalld. Have searched the firewalld manual pages deeper and noticed firewalld package provides firewall-offline-cmd for cases like this (when the firewalld service isn't running) to migrate older s-c-f rules to newer firewalld syntax. Actually moved yet further, and tried firewall-offline-cmd --direct --add-rule case. Suppose the old rule (from /etc/sysconfig/iptables for IPv4) has the form of (for simplicity): -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT then the corresponding firewall-offline-cmd command syntax that came out from reading of the manual pages for me is as follows: # firewall-offline-cmd --direct --add-rule ipv4 filter INPUT 0 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT Execution of this command succeeded & appropriate /etc/firewalld/direct.xml entry was created. Wanted to ask regarding the priority parameter ("0" in the above example) -- is it a way how to specify "order / place" into which the rule would be added into the XML file? IOW using 0 again second time would mean the second rule would be inserted before the already existing rule (e.g. the behaviour of -I iptables option) or when using priority 1 it would be appended instead at the end of the filter table & INPUT chain of it (e.g. the behaviour would correspond to -A iptables option)? Another question being -- also noticed firewalld provides concept of "richlanguage" which allows (at least from what I got) the administrator to define the rules in the iptables-like syntax. Since it's not mentioned in the manual page, does richlanguage support concept of "match extensions", e.g. for example: -m iprange | -m limit | -m state | -m time | -m account .. as known / supported by iptables? If yes, what would be the syntax to formulate these in the richlanguage syntax? To mention some examples, suppose the following two rules: iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s --limit-burst 10 -j ACCEPT iptables -A INPUT -p tcp --dport 50:55 -m iprange --dst-range 192.168.0.1-192.168.0.10 -j ACCEPT Is there a way how to express them via firewalld's richlanguage constructs or would the usage of firewall-offline-cmd --direct --add-rule be necessary? Is it possible to commonly express what kind of former iptables rules are possible to express via richlanguage & what kind of rules require use of firewall-offline-cmd tool? Thank you in advance for your time & reply. Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 3

running firewall-cmd from a detached script
by Nikos Mavrogiannopoulos 27 Aug '14

27 Aug '14

Hello, I'm trying to run firewall-cmd (0.3.9 on RHEL7) under a script that is run by a vpn server (as root) on a client connect. The command is something like the following: #!/bin/sh firewall-cmd --zone=internal --add-interface=$DEVICE However, that script seems to hang and firewall-cmd never returns. Running the same command from a terminal or using screen succeeds. Is there some requirement of firewall-cmd to run from a terminal? Any ideas on how to debug? The hanged process on gdb seems to block at: #0 0x00007f1dd5a76df0 in __poll_nocancel () from /lib64/libc.so.6 #1 0x00007f1dcb19d780 in socket_do_iteration () from /lib64/libdbus-1.so.3 #2 0x00007f1dcb19c5ff in _dbus_transport_do_iteration () from /lib64/libdbus-1.so.3 #3 0x00007f1dcb185d7c in _dbus_connection_do_iteration_unlocked () from /lib64/libdbus-1.so.3 #4 0x00007f1dcb18687c in _dbus_connection_block_pending_call () from /lib64/libdbus-1.so.3 #5 0x00007f1dcb186d3a in dbus_connection_send_with_reply_and_block () from /lib64/libdbus-1.so.3 #6 0x00007f1dcb3ca0df in Connection_send_message_with_reply_and_block () from /usr/lib64/python2.7/site-packages/_dbus_bindings.so #7 0x00007f1dd6751b94 in PyEval_EvalFrameEx () from /lib64/libpython2.7.so.1.0 #8 0x00007f1dd67531ad in PyEval_EvalCodeEx () from /lib64/libpython2.7.so.1.0 -- Nikos Mavrogiannopoulos, Sr. Security Software Engineer Red Hat, Inc.

3 3

firewalld-0.3.11
by Jiri Popelka 21 Aug '14

21 Aug '14

Hi all, firewalld-0.3.11 is out. It's mainly a bug-fix release, the only notable change might be that ipp-client service has been removed from home/internal/work zones. See https://bugzilla.redhat.com/show_bug.cgi?id=1105639#c2 for more details. https://fedorahosted.org/released/firewalld/firewalld-0.3.11.tar.bz2 sha1sum: 21af848087d4f13f555cb07d6bd856be360eb5cd Changelog: - firewalld: - improve error messages - check built-in chains in direct chain handling functions (RHBZ#1120619) - dbus_to_python() check whether input is of expected type (RHBZ#1122018) - handle negative timeout values (RHBZ#1124476) - warn when Command/Uid/Use/Context already in lockdown whitelist (RHBZ#1126405) - make --lockdown-{on,off} work again (RHBZ#1111573) - firewall-cmd: - --timeout now accepts time units (RHBZ#994044) - firewall-config: - show active (not default) zones in bold (RHBZ#993655) - configuration: - remove ipp-client service from all zones (RHBZ#1105639). - fallbacks for missing values in firewalld.conf - create missing dirs under /etc if needed - add -Es to python command in lockdown-whitelist.xml (RHBZ#1099065) - docs: - 'direct' methods concern only chains/rules added via 'direct' (RHBZ#1120619) - --remove-[interface/source] don't need a zone to be specified (RHBZ#1125851) - various fixes in firewalld.zone(5), firewalld.dbus(5), firewalld.direct(5) - others: - rpm macros for easier packaging of e.g. services -- Jiri

1 0

many questions migrating from iptables/firewall-2.4-stronger
by David Andrew Michael Noelle 14 Aug '14

14 Aug '14

My trusty old heavily customized firewall-2.4-stronger script doesn't like systemd, so I think firewalld is probably the way to go, but it doesn't seem to support some of the things I need to do without resorting to direct rules, which seems to be undermining the whole "dynamic" idea. Maybe I missed something and there are better ways to do this. This is for a small office that I can't really replicate the setup of, so I can't test it properly without them being offline for a while. Maybe someone could tell me if I'm on the right track before I do that. There are three relevant ethernet interfaces: 0) cable modem in bridge mode (p35p1) - "external" zone 1) office lan (p2p1) - "work" zone - 192.168.10.0/24 segment 2) dmz for testing client machines (p3p1) - "dmz" zone 192.168.20.0/24 question 1 Internet traffic is being routed successfully from both internal networks out to the world and back. I used to have rules dropping packets between the two localnets, just to keep the customer machines from spreading viruses to the office. Even without those rules, the few tests I was able to try without their network to test on didn't connect. Did I miss something? Do I have to do something more to /enable/ routing between the two localnets? Or is this a fluke/misconfiguration/bad test I need to be concerned about? question 2 How exactly are zones applied? When a packet wants to be routed from the "work" localnet to the masquerading "external", which zone applies? Both of them? What if the packet is coming from an interface with one zone, from an address with another zone, routed to an interface with a third zone? How do zone rules translate to incoming, outgoing, and forwarding traffic? question 3 What are the recommended methods of blocking specific localnet addresses or the whole "work" zone from connecting to specific ports on external host ranges, i.e. no FaceBook at work? Would rich rules in the "work" zone be the proper way? It's kinda messy not being able to note the purpose of blocking a specific address when you have 20 or so different address ranges blocked and keep adding more. question 4 Is there a way to specify classes of destinations, like a destination zone? It would be nice to bundle up the ip ranges or even domains of FaceBook and Twitter and Tumblr and whatnot into a "SocialMedia" class and just block any traffic to those destinations, either from the "work" zone or from specific localnet IPs. Lists of IPs with no notes are pretty unwieldy and not very reliable. Although, the xml file does allow notes, so that's what I'm doing so far. It works, I think, but it's ugly. question 5 If I want to allow the dmz to only call out to the internet on specific services, like http/https, but no smtp or ftp, is it sufficient to just enable the services I want in the dmz zone? Does that affect connections that would just be masqueraded and forwarded out the external zone? What if I want to temporarily enable ftp from the dmz to one specific address, like a server on the work localnet? Would a rich rule for FTP service with an accept action do it? Would it have to be passive FTP only? That's a bit more question than I thought I had when I started writing this, but hopefully someone's still reading. Thanks in advance for any guidance you can offer. -- -Dave Noelle, dave(a)Straylight.org

2 4

Firewalld takes minutes to fully start and uses > 100 MB RAM
by Marcel Dopita 04 Aug '14

04 Aug '14

Hello there, I'm hobbyist running CentOS 6.5 on 1 GB RAM VPS where I have my mailserver, jabber, groupware and some other web services. I already know about systemd from Arch Linux so I'm working on scripts so I can deploy my setup on CentOS 7. I'm testing it in VMware Workstation on my desktop also with 1 GB RAM and total 2 processor cores (based on i7 3770k). I want to use the current tools and avoid obsolete methods (and mostly learn new stuff) so I migrated my iptables configuration to Firewalld. With iptables I use something like -A INPUT -m state --state NEW -m tcp -p tcp -m multiport --dports 22,80,143,443,587,993,4190,5222 -s 85.70.0.0/15 -j ACCEPT to limit some services only to my country (Czech Republic) as there's no need for me to waste bandwidth thanks to various bots. Other services (SMTP, XMPP S2S) are open from everywhere. In the end iptables is set to allow access from 1100 various ipv4 and ip6 ranges in total. 1) I tried generating Firewalld config using following line in a script firewall-cmd --permanent --add-rich-rule="rule family=ipv4 source address=85.70.0.0/15 service name=ssh accept" running in loop but after waiting few minutes it became painfully slow (single firewall-cmd took something around one second to finish). So I had to write a script creating the actual xml (/etc/firewalld/zones/public.xml) which finished within few seconds (public.xml is now 1.5 MB large - comparing to 150 kB iptables config). 1b) I also received following error when I stopped my running batch and entered new command manually (not sure if something like that is expected): # firewall-cmd --permanent --zone=public --add-service=ssh ERROR:dbus.proxies:Introspect error on :1.6126:/org/fedoraproject/FirewallD1/config: dbus.exceptions.DBusException: org.freedesktop.DBus.Error.NoReply: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken. success 2) When I started firewalld service it took several minutes (5 or 10) until I could finally establish new connection. The whole time top showed 49% sy (so I suppose full usage of single core). 3) When cpu settled, the memory usage reported by top still showed more than 10% (of 1 GB RAM). PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 61972 root 20 0 411692 105252 6248 S 0.0 10.4 0:25.70 firewalld My thought/question: - Ok, I can still use iptables but I would expect Firewalld to be equally good or better (in terms of performance). It uses too much cpu power and memory. - Am I even using it right? Or is there other tool I should use instead? Best regards, Marcel Dopita

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

firewalld-users August 2014