masquerade between zones
by tim aliaj
Hi Guys,
I have setup one firewall machines with two interfaces one on public zone and one in internal zone.
i created a new policy with ingress internal and egress public and enabled masquerade on it.
if i enable masquerade on zone public as normal i works
the issue is it does not work with policies. Bellow is my config so far:
[root@FW1 ~]# firewall-cmd --list-all-policies
allow-host-ipv6 (active)
priority: -15000
target: CONTINUE
ingress-zones: ANY
egress-zones: HOST
services:
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family="ipv6" icmp-type name="neighbour-advertisement" accept
rule family="ipv6" icmp-type name="neighbour-solicitation" accept
rule family="ipv6" icmp-type name="router-advertisement" accept
rule family="ipv6" icmp-type name="redirect" accept
brenda2jashte (active)
priority: -500
target: CONTINUE
ingress-zones: internal
egress-zones: public
services:
ports:
protocols:
masquerade: yes
forward-ports:
source-ports:
icmp-blocks:
rich rules:
[root@FW1 ~]#
public (active)
target: default
icmp-block-inversion: no
interfaces: enp1s0
sources:
services: cockpit dhcpv6-client ssh
ports:
protocols:
forward: yes
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
internal (active)
target: default
icmp-block-inversion: no
interfaces: enp7s0
sources:
services: cockpit dhcpv6-client mdns samba-client ssh
ports:
protocols:
forward: yes
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
i am using the info from:
https://firewalld.org/2020/09/policy-objects-introduction
https://firewalld.org/2021/06/the-upcoming-1-0-0
Please can someone help out. first time i am trying to do NAT with policies
Tim
2 years, 2 months
Rich rules of blocking traffic to a specific IP seem not to work
by Snow Summer
Hello,
I am trying to block all kinds (TCP/UDP/ICMP and so on) of network traffic
from/to a specific IP address, and I have used the IP 4.2.2.1 as a
test. My firewall-cmd
--list-all shows:
root@summersnow # firewall-cmd --list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: wlp4s0
sources:
services: dhcpv6-client
ports:
protocols:
forward: yes
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family="ipv4" destination address="4.2.2.1" drop
rule family="ipv4" source address="4.2.2.1" drop
rule family="ipv4" source address="4.2.2.1" reject
rule family="ipv4" destination address="4.2.2.1" reject
However, I can confirm that I can still receive DNS responses from it by:
root@summersnow # nslookup twitter.com 4.2.2.1
Server: 4.2.2.1
Address: 4.2.2.1#53
Non-authoritative answer:
Name: twitter.com
Address: 104.244.42.65
Name: twitter.com
Address: 104.244.42.129
The rich rules above seem not working properly. Any ideas?
Thanks,
HanatoK
2 years, 3 months
Setting Deny Forward Rules with Firewalld
by Sean Zimmermann
Hi everyone,
I'm trying to setup a firewall so one of my VMs is barred from accessing the LAN (if saddr = VM Address and daddr = 192.168.0.0/16, deny input and forward). I was able to do this in nftables here:
table inet ext_only {
chain input {
type filter hook input priority filter - 10; policy accept;
ct state new ip saddr 192.168.100.100 drop
}
chain forward {
type filter hook forward priority filter - 10; policy accept;
ct state new ip saddr 192.168.100.100 ip daddr 192.168.0.0/16 drop
}
}
However, I've been having trouble trying to figure out the correct way to do this for firewalld. I know I can move the VM IP to its own zone, and I can then block input, but I couldn't figure out how to write a forward deny rule.
What is the recommended way to handle dropping forwarded packets?
Thank you for any help with this.
Regards,
Sean
2 years, 3 months