firewalld-users January 2019

firewalld-users@lists.fedorahosted.org

2 participants
2 discussions

Why no --timeout option with --add-source?
by David Sewell 21 Jan '19

21 Jan '19

I've just begun using firewalld, and am curious whether there is a reason why the --timeout option is not available with --add-source. That would be useful in a case where you want to permit connection to a host from a specific IP address or range for a limited period of time--an hour or 24 hours say. It's not terribly important, but it would be nice to have the ability.

2 1

Using ipset with nftables backend
by Alexander Murashkin 07 Jan '19

07 Jan '19

My firewalld configuration has ipsets. I have switched to nftables backend by setting FirewallBackend=nftables in /etc/firewalld/firewalld.conf and restarting firewalld. nft command shows empty sets (no elements) while ipsets still exist (an example is below). Is firewalld with nftables can be used at all if it has ipsets? Is nftables compatible with ipsets? Does nftables read IP list from ipsets? Searching on the Internet suggests using nftables sets but it seems that firewalld does not support them. --------------------------------------------------- # nft list sets table inet firewalld { set gluster_v4 { <---- nftables set exists but empty type ipv4_addr flags interval } } # ipset list Name: gluster_v4 Type: hash:ip Revision: 4 Header: family inet hashsize 1024 maxelem 65536 Size in memory: 328 References: 0 Number of entries: 5 Members: <---- IP list is part of the ipset 172.16.x.a 172.16.x.b .... I am using Fedora 29 and firewalld-0.6.3-1.fc29.noarch.

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

firewalld-users January 2019