firewalld-users November 2020

firewalld-users@lists.fedorahosted.org

7 participants
5 discussions

firewalld mixed access -- how?
by Gordon harris 30 Nov '20

30 Nov '20

On our WISP, we have a WAN with about a dozen subnets in the 172.16.x.x space. I have a small server on the 172.16.10.x subnet, statically configured. Let's say I want to open 5201/tcp|5201/udp for an iperf3 server to all those subnets. Let's also say I want to open 873/tcp|873/udp for an rsyncd server to just one subnet, say 172.16.10.0/24. What's the best way to go about doing this? Add 172.16.10.0/24 as a destination in the rsyncd.xml service profile? Create a zone with 172.16.10.0/24 as a source and add the rsyncd service to that zone? Run the iperf3 service in the public zone, having added the interface to that zone? Something else?

2 1

Forward/NAT nftables rules
by Alexander Tumin 23 Nov '20

23 Nov '20

Hi, I'm trying to add a rule on NAT'ed traffic to reject certain local IPs from being masqueraded, but I can't see how it can be done with nftables backend. The problem: (1) --add-rule seems to always operate on iptables-restore, regardless of what backend is being used. (2) --add-rich-rule doesn't seem to provide a way to add rule on forwarded traffic. (3) there is seem to be no option like --add-rule, but for nftables specifically. Currently I had to switch to iptables backend to do: firewall-cmd --permanent --new-ipset=nonetvm --type=hash:ip firewall-cmd --permanent --ipset=nonetvm --add-entry=192.168.1.52 firewall-cmd --permanent --ipset=nonetvm --add-entry=192.168.1.53 firewall-cmd --permanent --ipset=nonetvm --add-entry=192.168.1.54 firewall-cmd --permanent --ipset=nonetvm --add-entry=192.168.1.55 # enp0s31f6 is the WAN interface in external zone firewall-cmd --permanent --direct --add-rule \ ipv4 filter FORWARD 0 -m set --match-set nonetvm src \ -o enp0s31f6 -j REJECT firewall-cmd --reload Please correct me if I'm wrong somewhere or is there simply no way to do this with firewalld using (now default) nftables backend?

2 3

SLES15 Default Iptable rule causing issue
by bsp team 19 Nov '20

19 Nov '20

Below rule in iptables is causing the slptool to fail in detecting the services of other hosts. REJECT all -- anywhere anywhere reject-with icmp-host-prohibited I deleted it by using below command iptables -D INPUT -j REJECT --reject-with icmp-host-prohibited and slp started to discover from other node with firewall enabled. however when i reload the firewalld or reboot it again went back to original rule (REJECT) how can i delete this rule permanently so that even after reoading firewalld daemon it does not go back to default. or is there anyother way

4 13

New User - block all allow all only from 2 IP addresses
by Steve Frazier 16 Nov '20

16 Nov '20

I come from iptables (didn't know it well but enough to get by). I am trying to learn firewalld now which appears to be much more powerful. First of all I need some help, please. I would like to remove all the rules and zones since I have probably messed up my installation so far and do the following: I would like to "DROP" all outside traffic I would then like to only allow all ports from (2) two IP addresses. Could someone explain to me how to do this. My configuration only has: (1) one public IP Address (ens3) Thanks in advance. Also, is there a good tutorial that would walk me through learning firewalld? Thanks again for this as well. Have a great day.

2 5

Firewalld pass traffic between 2 networks
by Robert Smuhar 10 Nov '20

10 Nov '20

Hi, I'm struggling to set up firewalld to pass traffic between 2 networks. Is this possible with firewalld? My lab setup is: Server (ens192:192.168.3.2) <-> (ens224:192.168.3.1) firewall (ens192:192.168.110.8) <-> (ens192:192.168.110.9) client Freshly installed CentOS 8.2 (2004), server installation with no GUI on all 3 VMs. [root@firewall ~]# sysctl net.ipv4.ip_forward net.ipv4.ip_forward = 1 Client can ping Server [root@client ~]# ping -c 3 192.168.3.2 PING 192.168.3.2 (192.168.3.2) 56(84) bytes of data. 64 bytes from 192.168.3.2: icmp_seq=1 ttl=63 time=0.530 ms 64 bytes from 192.168.3.2: icmp_seq=2 ttl=63 time=0.552 ms 64 bytes from 192.168.3.2: icmp_seq=3 ttl=63 time=0.444 ms Client can't get to the server's ssh port. [root@client ~]# nc 192.168.3.2 22 Ncat: No route to host. [root@firewall ~]# systemctl stop firewalld [root@client ~]# nc 192.168.3.2 22 SSH-2.0-OpenSSH_8.0 So far things are working as expected. I configure firewalld as follows: [root@firewall ~]# systemctl start firewalld [root@firewall ~]# firewall-cmd --version 0.8.0 [root@firewall ~]# firewall-cmd --zone=public --remove-interface=ens192 success [root@firewall ~]# firewall-cmd --zone=public --remove-interface=ens224 success [root@firewall ~]# firewall-cmd --zone=dmz --add-interface=ens224 success [root@firewall ~]# firewall-cmd --zone=internal --add-interface=ens192 success [root@firewall ~]# firewall-cmd --zone=internal --add-rich-rule='rule family=ipv4 source address=192.168.110.9/32 destination address=192.168.3.2/32 service name=ssh accept' success [root@firewall ~]# firewall-cmd --zone=internal --list-all internal (active) target: default icmp-block-inversion: no interfaces: ens192 sources: services: cockpit dhcpv6-client mdns samba-client ssh ports: protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: rule family="ipv4" source address="192.168.110.9/32" destination address="192.168.3.2/32" service name="ssh" accept [root@firewall ~]# firewall-cmd --zone=dmz --list-all dmz (active) target: default icmp-block-inversion: no interfaces: ens224 sources: services: ssh ports: protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: [root@client ~]# nc 192.168.3.2 22 Ncat: No route to host. Shouldn't this work? What am I missing?

3 7

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

firewalld-users November 2020