firewalld-users June 2019

firewalld-users@lists.fedorahosted.org

3 participants
2 discussions

nftabless backend / forward chain
by Frank Ansari 07 Jun '19

07 Jun '19

I was trying to allow my docker container to pass DNS requests through my host. As backend I use nftables. I have put this into /etc/firewalld/firewalld.conf: FirewallBackend=nftables Trying to add a direct rule via command line gave an error message from iptables. Why is iptables here? Or is --direct no longer usable with nftables? firewall-cmd --direct --add-rule ipv4 filter filter_FWDI_FedoraWorkstation_allow 0 -p tcp --dport 53 -j ACCEPT Error: COMMAND_FAILED: '/usr/sbin/iptables-restore -w -n' failed: iptables-restore: line 2 failed In the past I could put a file /etc/firewalld/direct.xml like this: <?xml version="1.0" encoding="utf-8"?> <direct> [ <rule ipv="ipv6" table="filter" chain="FWDI_FedoraWorkstation" priority="0"> -p tcp --dport 53 -j ACCEPT </rule> ] [ <rule ipv="ipv6" table="filter" chain="FWDI_FedoraWorkstation" priority="0"> -p udp --dport 53 -j ACCEPT </rule> ] [ <rule ipv="ipv4" table="filter" chain="FWDI_FedoraWorkstation" priority="0"> -p tcp --dport 53 -j ACCEPT </rule> ] [ <rule ipv="ipv4" table="filter" chain="FWDI_FedoraWorkstation" priority="0"> -p udp --dport 53 -j ACCEPT </rule> ] </direct> when I needed forwarding. But now when I do this I cannot see anything in "nft list ruleset" but I see it in "iptables -L -n -v" instead. What is the correct way to configure forward chains in firewalld with nftables backend?

2 3

Forwarding without masquerading / NAT
by Ronald Verbeek 06 Jun '19

06 Jun '19

Hi, My use case is setting up a Centos 7 router/gateway/firewall between an office lan and an industrial lan network. Both with private ipv4 network addresses, so with no need for nat / masquerading / port forwarding. There will be restrictions from the office to the industrial lan and other restrictions from industrial to the office lan. I was used to work with iptables in Centos 5 and 6, but willing to learn the modern approach of firewalld. But I am struggling for days now to find out how to work with the firewalld concepts for my use case. Also I can not find any relevant documentation to support my use case. I can write direct rules for the FORWARD chain using my iptables knowledge, but then what is the advantage of using firewalld over iptables? Firewalld makes it more complicated, because of adding a lot of unused chains. Any recommendations how I should continue with firewalld or should I just replace it with iptables for my setup? Is there any development going on for better support of the FORWARD chain? I have found how I can turn on logging for dropped packages. But I can not find an option to change the log level from warning to info. Any suggestion how to do this? Thanks

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

firewalld-users June 2019