firewalld-users December 2023

firewalld-users@lists.fedorahosted.org

4 participants
3 discussions

Re: Multiple zones with same source
by mika313 18 Dec '23

18 Dec '23

Hello, Finally, my approach was not compliant with firewalld implementation. I understood that after reading to https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedoraho… <https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedoraho…> reply. One good approach to implement a setup based on services is: - zones define network (through sources or ifaces) - policies manage flow behaviour with the services Now the setup is like that: There is one zone per network with an ipset associated in it. There is one policy per service with: - service = <concerned service> - ingress zone = <concerned zone> - egress zone = HOST - target = CONTINUE Hope that helps. Many Thanks.

1 0

Multiple zones with same source
by mika313 15 Dec '23

15 Dec '23

Hello, I am trying to define a firewalld setup based on services. - each service has its own custom zone - and each custom zone has its own custom ipset as a source For exemple: There is a dedicated zone for ssh access with ipset:ssh (10.147.17.0/24 range) and ssh service. There is a dedicated zone for grafana access with ipset:grafana (10.147.17.0/24 range) and grafana service. Since all the ipsets have the same entry (10.147.17.0/24 range), i cannot access to both services from a good ip in the given range. The working zone is alphabetical selected. The flow trying to access to the second service is rejected by the first zone. Is it possible to use a service approach with policies or with another way? I tried to setup a policy but without success. I would like to avoid all services in one zone. firewalld version: 1.2.1 OS: AlmaLinux 9.2 Many Thanks

1 0

Logging port forwarding rules
by Sam Varshavchik 13 Dec '23

13 Dec '23

I have a forwarding rule and I'd like to log when it is being used. In my zone file I have port forwarding set up using a rich rule: <forward-port …/> firewall-config shows this rich rule, and it displays all of its particulars. But if I try to edit it in firewall-config the "Log" checkbox is disabled. Is this a firewall-config 2.0.2 limitation, or a backend limitation? I am using FirewallBackend=nftables

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

firewalld-users December 2023