firewalld-users October 2022

firewalld-users@lists.fedorahosted.org

9 participants
7 discussions

Is it possible to have firewalld create an bitmap:port type ipset so it can be used as part of rich-rules?
by Ferry de Jong 31 Oct '22

31 Oct '22

Hello, I have had a 'hybrid' firewall setup largely based on firewalld (backend=iptables) where I add some iptables rules after the firewalld rules have loaded (which is an ugly and fragile setup). During my attempts to integrate everything into the firewalld framework to get rid of the ugly manual iptables rules adding, I run into a problem with an ipset that is used. I would like to add an ipset of the type bitmap:port to the firewalld configuration so it can be used as part of some rich rules I will be creating. The ipset will contain a bunch of (tcp) ports that will cause a rule to create logging every time any of those destination ports see network traffic. The idea is to have a tripwire/'honeypot' facility to become aware of attempts to connect to ports like 23(telnet) and 443 (https) etc., but for a very long, and regularly changing list of ports. As is clear per "firewall-cmd --get-ipset-types" this ipset type is not supported. IS there any way to 'integrate' my intended rich rules which depend on an bitmap:port type ipset?

2 2

Feature request: web gui console
by andrew goh 28 Oct '22

28 Oct '22

hi all, I've been using firewalld for a while. firewall-config (GTK) and firewall-cmd are cool clients to configure firewalld. However, can an additional web based interface be provided for it? The reason for this request is that : 1 partly I run it in a gateway box, it may not literally have a display attached. Much like a plastic router box if you'd like. 2 (Many?) distributions are 'migrating' to wayland https://wayland.freedesktop.org/ <https://wayland.freedesktop.org/>. This is a big bummer as setting -display in the old X11 may way no longer works and it requires RDP (remote desktop), just to get onto the graphical screen. For (2) I may be 'confused', unsure. The thing is if the distribution runs on a Wayland server rather than a conventional X Org / X11 based server. firewall-config (GTK) would still remain as a X11 app and -display would still work normally? Either way, I'd think providing a web based interface / console for the configs is a good thing. And it'd seem the effort is modest? This would also cater to the 'headless' boxes that use firewalld. I'd think HTTP digest (preferably not basic - this requires https to be safe) authentication, https://www.rfc-editor.org/rfc/rfc7616 <https://www.rfc-editor.org/rfc/rfc7616> https://www.rfc-editor.org/rfc/rfc2617 <https://www.rfc-editor.org/rfc/rfc2617> ,would likely be adequate for it. Note that in addition, the web interface will need to have configs to run on IP address and accessible on the 'internal' side of the firewall only. Probably that it is deactivated by default in configs as well. Thanks, Andrew

1 0

Feature request: web gui console
by andrew goh 28 Oct '22

28 Oct '22

1 0

Bug or Feature?
by Andy Burns 25 Oct '22

25 Oct '22

Running Fedora36 workstation, I have the firewall config pretty much as I want in terms of zones/ports etc. One thing though, which I can't findwhether it's intentional or not ... The firewall acts as though it defaults to blocking everything unless I'm logged in (on the desktop, or via SSH) but that means I can't first logon via SSH until after I've logged onto the desktop, then I can't logout from the desktop, otherwise then I can't get logged back via SSH. If it should be like that, I'm quite surprised I can't see an option to make the rules apply regardless of whether i'm logged in? Thanks for any answers ...

4 7

FirewallD allows all port
by Chintan Mishra from Rebhu 18 Oct '22

18 Oct '22

All ingress, egress traffic are allowed to an AWS EC2 using Security Groups. The goal is to manage traffic and ports using FirewallD. I have only allowed certain ports in FirewallD, but I can access services that belong outside the open ports. Here is the output of publicly accessible services: $ nmap -Pn <my-ip> Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower. Starting Nmap 7.91 ( https://nmap.org ) at 2022-10-16 17:58 UTC Nmap scan report for ec2-<my-ip>.*.compute.amazonaws.com (<my-ip>) Host is up (0.57s latency). Not shown: 992 filtered ports PORT STATE SERVICE 22/tcp open ssh 5432/tcp open postgresql 8080/tcp open http-proxy 8081/tcp open blackice-icecap 8082/tcp open blackice-alerts 8083/tcp open us-srv 9090/tcp open zeus-admin 50000/tcp open ibm-db2 And, here is the output for services and ports opened with FirewallD $ sudo firewall-cmd --list-all public (active) target: default icmp-block-inversion: no interfaces: eth0 sources: services: cockpit dhcpv6-client ssh ports: 8080/tcp 8081/tcp 50000/tcp 8082/tcp 9980/tcp protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: _*What is missing in this setup to prevent access to port 8083 from public internet to the EC2 instance?*_ Thank you. -- Chintan Mishra

2 2

routing without NAT (NAPT)
by Mototsugu Ohgami 06 Oct '22

06 Oct '22

Hello. I want to routing without NAT (NAPT) on a host with firewalld. Stack Exchange posts and others have previously recommended using direct rules and not using firewalld. https://unix.stackexchange.com/questions/493275/firewalld-to-allow-routing-… The backend is nftables. I'm using alma linux 9. So the package version is firewalld-1.0.0. Please give me some information, even if it's just a little. thanks,regards

3 4

New Concepts Page: https://firewalld.org/documentation/concepts.html
by Eric Garver 06 Oct '22

06 Oct '22

Hi all, I'd like to highlight the new firewalld concepts page. It's a good summary for new and long term users. Please give it a read! https://firewalld.org/documentation/concepts.html Thanks. Eric.

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

firewalld-users October 2022