firewalld mixed access -- how?
by Gordon harris
On our WISP, we have a WAN with about a dozen subnets in the 172.16.x.x space. I have a small server on the 172.16.10.x subnet, statically configured.
Let's say I want to open 5201/tcp|5201/udp for an iperf3 server to all those subnets.
Let's also say I want to open 873/tcp|873/udp for an rsyncd server to just one subnet, say 172.16.10.0/24.
What's the best way to go about doing this?
Add 172.16.10.0/24 as a destination in the rsyncd.xml service profile?
Create a zone with 172.16.10.0/24 as a source and add the rsyncd service to that zone?
Run the iperf3 service in the public zone, having added the interface to that zone?
Something else?
3 years, 4 months
Forward/NAT nftables rules
by Alexander Tumin
Hi, I'm trying to add a rule on NAT'ed traffic to reject certain local
IPs from being masqueraded, but I can't see how it can be done with
nftables backend.
The problem:
(1) --add-rule seems to always operate on iptables-restore, regardless
of what backend is being used.
(2) --add-rich-rule doesn't seem to provide a way to add rule on
forwarded traffic.
(3) there is seem to be no option like --add-rule, but for nftables
specifically.
Currently I had to switch to iptables backend to do:
firewall-cmd --permanent --new-ipset=nonetvm --type=hash:ip
firewall-cmd --permanent --ipset=nonetvm --add-entry=192.168.1.52
firewall-cmd --permanent --ipset=nonetvm --add-entry=192.168.1.53
firewall-cmd --permanent --ipset=nonetvm --add-entry=192.168.1.54
firewall-cmd --permanent --ipset=nonetvm --add-entry=192.168.1.55
# enp0s31f6 is the WAN interface in external zone
firewall-cmd --permanent --direct --add-rule \
ipv4 filter FORWARD 0 -m set --match-set nonetvm src \
-o enp0s31f6 -j REJECT
firewall-cmd --reload
Please correct me if I'm wrong somewhere or is there simply no way to do
this with firewalld using (now default) nftables backend?
3 years, 4 months
SLES15 Default Iptable rule causing issue
by bsp team
Below rule in iptables is causing the slptool to fail in detecting the services of other hosts.
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
I deleted it by using below command
iptables -D INPUT -j REJECT --reject-with icmp-host-prohibited
and slp started to discover from other node with firewall enabled.
however when i reload the firewalld or reboot it again went back to original rule (REJECT)
how can i delete this rule permanently so that even after reoading firewalld daemon it does not go back to default.
or is there anyother way
3 years, 5 months
New User - block all allow all only from 2 IP addresses
by Steve Frazier
I come from iptables (didn't know it well but enough to get by). I am trying to learn firewalld now which appears to be much more powerful.
First of all I need some help, please.
I would like to remove all the rules and zones since I have probably messed up my installation so far and do the following:
I would like to "DROP" all outside traffic I would then like to only allow all ports from (2) two IP addresses.
Could someone explain to me how to do this.
My configuration only has:
(1) one public IP Address (ens3)
Thanks in advance.
Also, is there a good tutorial that would walk me through learning firewalld? Thanks again for this as well.
Have a great day.
3 years, 5 months
Firewalld pass traffic between 2 networks
by Robert Smuhar
Hi, I'm struggling to set up firewalld to pass traffic between 2 networks. Is this possible with firewalld?
My lab setup is:
Server (ens192:192.168.3.2) <-> (ens224:192.168.3.1) firewall (ens192:192.168.110.8) <-> (ens192:192.168.110.9) client
Freshly installed CentOS 8.2 (2004), server installation with no GUI on all 3 VMs.
[root@firewall ~]# sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1
Client can ping Server
[root@client ~]# ping -c 3 192.168.3.2
PING 192.168.3.2 (192.168.3.2) 56(84) bytes of data.
64 bytes from 192.168.3.2: icmp_seq=1 ttl=63 time=0.530 ms
64 bytes from 192.168.3.2: icmp_seq=2 ttl=63 time=0.552 ms
64 bytes from 192.168.3.2: icmp_seq=3 ttl=63 time=0.444 ms
Client can't get to the server's ssh port.
[root@client ~]# nc 192.168.3.2 22
Ncat: No route to host.
[root@firewall ~]# systemctl stop firewalld
[root@client ~]# nc 192.168.3.2 22
SSH-2.0-OpenSSH_8.0
So far things are working as expected.
I configure firewalld as follows:
[root@firewall ~]# systemctl start firewalld
[root@firewall ~]# firewall-cmd --version
0.8.0
[root@firewall ~]# firewall-cmd --zone=public --remove-interface=ens192
success
[root@firewall ~]# firewall-cmd --zone=public --remove-interface=ens224
success
[root@firewall ~]# firewall-cmd --zone=dmz --add-interface=ens224
success
[root@firewall ~]# firewall-cmd --zone=internal --add-interface=ens192
success
[root@firewall ~]# firewall-cmd --zone=internal --add-rich-rule='rule family=ipv4 source address=192.168.110.9/32 destination address=192.168.3.2/32 service name=ssh accept'
success
[root@firewall ~]# firewall-cmd --zone=internal --list-all
internal (active)
target: default
icmp-block-inversion: no
interfaces: ens192
sources:
services: cockpit dhcpv6-client mdns samba-client ssh
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family="ipv4" source address="192.168.110.9/32" destination address="192.168.3.2/32" service name="ssh" accept
[root@firewall ~]# firewall-cmd --zone=dmz --list-all
dmz (active)
target: default
icmp-block-inversion: no
interfaces: ens224
sources:
services: ssh
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
[root@client ~]# nc 192.168.3.2 22
Ncat: No route to host.
Shouldn't this work? What am I missing?
3 years, 5 months