Why no --timeout option with --add-source?
by David Sewell
I've just begun using firewalld, and am curious whether there is a reason why the --timeout option is not available with --add-source. That would be useful in a case where you want to permit connection to a host from a specific IP address or range for a limited period of time--an hour or 24 hours say.
It's not terribly important, but it would be nice to have the ability.
5 years, 2 months
Using ipset with nftables backend
by Alexander Murashkin
My firewalld configuration has ipsets. I have switched to nftables backend by setting FirewallBackend=nftables in /etc/firewalld/firewalld.conf and restarting firewalld.
nft command shows empty sets (no elements) while ipsets still exist (an example is below).
Is firewalld with nftables can be used at all if it has ipsets? Is nftables compatible with ipsets? Does nftables read IP list from ipsets?
Searching on the Internet suggests using nftables sets but it seems that firewalld does not support them.
---------------------------------------------------
# nft list sets
table inet firewalld {
set gluster_v4 { <---- nftables set exists but empty
type ipv4_addr
flags interval
}
}
# ipset list
Name: gluster_v4
Type: hash:ip
Revision: 4
Header: family inet hashsize 1024 maxelem 65536
Size in memory: 328
References: 0
Number of entries: 5
Members: <---- IP list is part of the ipset
172.16.x.a
172.16.x.b
....
I am using Fedora 29 and firewalld-0.6.3-1.fc29.noarch.
5 years, 2 months