firewalld-users July 2023

firewalld-users@lists.fedorahosted.org

7 participants
4 discussions

stale documentation, at least on Fedora 38
by D. Hugh Redelmeier 24 Jul '23

24 Jul '23

FIREWALLD.POLICY(5) says, under NOTES More documentation with examples: http://fedoraproject.org/wiki/FirewallD That documentationn is so stale that it predates policy objects. "This page was last edited on 27 January 2017, at 22:43."

2 1

kernel BUG at lib/list_debug.c:30! using kernel-6.3.9-200.fc38 or kernel-6.3.10-200.fc38
by Anthony Messina 21 Jul '23

21 Jul '23

I'm wondering if anyone would be willing take a look at the following: https://bugzilla.redhat.com/show_bug.cgi?id=2216972 For me, this issue is reproduced when I load firewalld rules referencing nf tables sets (ipsets) at boot with firewalld and kernel-6.3.9-200.fc38 or kernel-6.3.10-200.fc38 I have my backend set to nftables and am not using direct rules on the affected machines (2 Intel NUCs and a ThinkPad X1 Carbon) The issue does not occur with kernel-6.3.8-200.fc38 and does not occur if I add the rules referencing ipsets after the initial startup of firewalld is successful. Thanks in advance for any assistance with this kernel bug. -- Anthony - https://messinet.com

1 1

Cannot access libvirt kvm guest with bridged networking on Debian 12 Bookworm (nftables backend)
by Niccolò Belli 17 Jul '23

17 Jul '23

I've previously posted this in the libvirt mailing list because that's the package in charge of the libvirt zone, but it's probably better suited here. firewalld version 1.3.0-1 libvirt version 9.0.0-4 network-manager version 1.42.4-1 # firewall-cmd --get-active-zones libvirt interfaces: br28 public interfaces: dac0 dac0.100 dac0.28 ftth # firewall-cmd --list-all --zone=public public (active) target: default icmp-block-inversion: no interfaces: dac0 dac0.100 dac0.28 ftth sources: services: dhcpv6-client ssh ports: protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: dac0 is an SFP+ Direct Attach cable with several vlans. dac0.100 is the vlan where I create the ppoe connection from my FTTH provider. ftth is the ppp name. dac0.28 is the vlan for the public /28 IPv4 subnet. br28 is the bridge where dac0.28 is attached. # brctl show bridge name bridge id STP enabled interfaces br28 8000.d2605c025b1d no dac0.28 vnet1 # firewall-cmd --list-all --zone=libvirt libvirt (active) target: ACCEPT icmp-block-inversion: no interfaces: br28 sources: services: dhcp dhcpv6 dns ssh tftp ports: protocols: icmp ipv6-icmp forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: rule priority="32767" reject # nft list tables table inet firewalld table ip mangle # nft list table ip mangle # Warning: table ip mangle is managed by iptables-nft, do not touch! table ip mangle { chain FORWARD { type filter hook forward priority mangle; policy accept; oifname "ftth" tcp flags syn / syn,rst tcp option maxseg size 1400-65495 counter packets 0 bytes 0 tcp option maxseg size set rt mtu } } The previous rule is created by NetworkManager to clamp-mss-to-pmtu for the ftth pppoe. This is how I create the bridge and the dac0.28 vlan with NetworkManager: # nmcli con add ifname br28 type bridge con-name br28 ipv4.method manual ipv4.addresses MY_IP/28 connection.zone libvirt # nmcli connection add type vlan con-name dac0.28 ifname dac0.28 vlan.parent dac0 vlan.id 28 ipv4.method disabled ipv6.method disabled master br28 slave-type bridge I also have isc-dhcp-server, wide-dhcpv6-client and radvd running on the host. # nmcli con NAME UUID TYPE DEVICE ftth f370639c-2712-49c2-9749-e39f17102346 pppoe ftth br28 e4d2aad3-ef2d-4ac0-bda5-58471f21655c bridge br28 lo f0327b03-bbc3-4078-8bd1-5225df0ce153 loopback lo vnet1 25ae75cd-1606-4fd7-8213-09f4ef1280c4 tun vnet1 dac0 040e747e-fd7e-41e9-b6a6-ccec9e73c022 ethernet dac0 dac0.100 147c1632-2c60-42f3-a97a-a6733ef69f4c vlan dac0.100 dac0.28 cefb4bf3-dda9-465a-95d0-512ac1294a5b vlan dac0.28 enp1s0 81a44a95-efdc-47e2-9c12-76a0a140ca5a ethernet -- The previous are all dark green expect lo and vnet1 which are light green (externally managed) and enp1s0 which is white (disconnected). The br_netfilter module is not loaded and thus net.bridge.bridge-nf-call-ip6tables, net.bridge.bridge-nf-call-iptables, net.bridge.bridge-nf-call-arptables are not even exposed to /proc/sys/net/bridge. I don't have any nwfilter enabled yet, I'd like to get the basics working first. The guest gets an IP (both v4 and v6) and can reach the internet. The guest can be reached from the host (ALL ports and services and not just dhcp/dhcpv6/dns/ssh/tftp/icmp/ipv6-icmp) but unfortunately not from the outside: $ ping GUEST_IP PING GUEST_IP (GUEST_IP) 56(84) bytes of data. From FTTH_IP icmp_seq=1 Packet filtered $ ssh GUEST_IP ssh: connect to host GUEST_IP port 22: No route to host I also tried routed networking which works fine, but libvirt is in charge to create everything in that case (the bridge, assigning the libvirt-routed zone, enabling the libvirt-routed policies, etc) while bridged networking must be configured manually (at least on non-RedHat distros). What's wrong? It looks suspiciously similar to https://bbs.archlinux.org/viewtopic.php?id=274670 Thanks, Niccolo' Belli

4 16

firewalld error on debian 12
by David Mehler 11 Jul '23

11 Jul '23

Hello, I'm trying to get firewalld going on Debian 12 a vps. I've asked on the debian users list who refered me here with a way to get more verbose error messages, see below. Unfortunately I'm clueless as to what this could be. It from what I can see looks like it's trying to delete a chain and failing which causes firewalld to fail, though I could be wrong, python and myself are not friends. Any help appreciated. Thanks. Dave. root@hostname:~#systemctl --full --no-pager status firewalld ? firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/lib/systemd/system/firewalld.service; enabled; preset: enabled) Active: inactive (dead) since Sat 2023-07-08 02:06:48 EDT; 7h ago Duration: 2.316s Docs: man:firewalld(1) Process: 77366 ExecStart=/usr/sbin/firewalld --nofork --nopid (code=exited, status=0/SUCCESS) Main PID: 77366 (code=exited, status=0/SUCCESS) Jul 08 02:06:48 hostname.example.com firewalld[77366]: ERROR: '/usr/sbin/ebtables-restore --noflush' failed: ebtables-restore v1.8.9 (nf_tables): line 3: CHAIN_DEL failed (Device or resource busy): chain PREROUTING_direct line 3: CHAIN_DEL failed (Device or resource busy): chain POSTROUTING_direct line 3: CHAIN_DEL failed (Device or resource busy): chain OUTPUT_direct Jul 08 02:06:48 hostname.example.com firewalld[77366]: ERROR: 'python-nftables' failed: internal:0:0-0: Error: Could not process rule: No such file or directory JSON blob: {"nftables": [{"metainfo": {"json_schema_version": 1}}, {"delete": {"table": {"family": "inet", "name": "firewalld"}}}, {"add": {"table": {"family": "inet", "name": "firewalld"}}}]} Jul 08 02:06:48 hostname.example.com firewalld[77366]: ERROR: COMMAND_FAILED: '/usr/sbin/ebtables-restore --noflush' failed: ebtables-restore v1.8.9 (nf_tables): line 3: CHAIN_DEL failed (Device or resource busy): chain PREROUTING_direct line 3: CHAIN_DEL failed (Device or resource busy): chain POSTROUTING_direct line 3: CHAIN_DEL failed (Device or resource busy): chain OUTPUT_direct Jul 08 02:06:48 hostname.example.com firewalld[77366]: Traceback (most recent call last): File "/usr/lib/python3/dist-packages/firewall/core/fw.py", line 633, in start self._start() File "/usr/lib/python3/dist-packages/firewall/core/fw.py", line 597, in _start self._start_apply_objects(reload=reload, complete_reload=complete_reload) File "/usr/lib/python3/dist-packages/firewall/core/fw.py", line 495, in _start_apply_objects transaction.execute(True) File "/usr/lib/python3/dist-packages/firewall/core/fw_transaction.py", line 161, in execute raise FirewallError(errors.COMMAND_FAILED, errorMsg) firewall.errors.FirewallError: COMMAND_FAILED: '/usr/sbin/ebtables-restore --noflush' failed: ebtables-restore v1.8.9 (nf_tables): line 3: CHAIN_DEL failed (Device or resource busy): chain PREROUTING_direct line 3: CHAIN_DEL failed (Device or resource busy): chain POSTROUTING_direct line 3: CHAIN_DEL failed (Device or resource busy): chain OUTPUT_direct During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/usr/lib/python3/dist-packages/firewall/core/fw.py", line 638, in start self._start_failsafe() File "/usr/lib/python3/dist-packages/firewall/core/fw.py", line 629, in _start_failsafe self._start_apply_objects(reload=reload, complete_reload=complete_reload) File "/usr/lib/python3/dist-packages/firewall/core/fw.py", line 495, in _start_apply_objects transaction.execute(True) File "/usr/lib/python3/dist-packages/firewall/core/fw_transaction.py", line 161, in execute raise FirewallError(errors.COMMAND_FAILED, errorMsg) firewall.errors.FirewallError: COMMAND_FAILED: 'python-nftables' failed: internal:0:0-0: Error: Could not process rule: No such file or directory JSON blob: {"nftables": [{"metainfo": {"json_schema_version": 1}}, {"delete": {"table": {"family": "inet", "name": "firewalld"}}}, {"add": {"table": {"family": "inet", "name": "firewalld"}}}]} Jul 08 02:06:48 hostname.example.com firewalld[77366]: ERROR: COMMAND_FAILED: 'python-nftables' failed: internal:0:0-0: Error: Could not process rule: No such file or directory JSON blob: {"nftables": [{"metainfo": {"json_schema_version": 1}}, {"delete": {"table": {"family": "inet", "name": "firewalld"}}}, {"add": {"table": {"family": "inet", "name": "firewalld"}}}]} Jul 08 02:06:48 hostname.example.com firewalld[77366]: ERROR: Failed to load full stock configuration. This likely indicates a system level issue, e.g. the firewall backend (nftables, iptables) is broken. All hope is lost. Exiting. Jul 08 02:06:48 hostname.example.com firewalld[77366]: ERROR: '/usr/sbin/ebtables-restore --noflush' failed: ebtables-restore v1.8.9 (nf_tables): line 3: CHAIN_DEL failed (Device or resource busy): chain PREROUTING_direct line 3: CHAIN_DEL failed (Device or resource busy): chain POSTROUTING_direct line 3: CHAIN_DEL failed (Device or resource busy): chain OUTPUT_direct Jul 08 02:06:48 hostname.example.com firewalld[77366]: ERROR: 'python-nftables' failed: internal:0:0-0: Error: Could not process rule: No such file or directory JSON blob: {"nftables": [{"metainfo": {"json_schema_version": 1}}, {"delete": {"table": {"family": "inet", "name": "firewalld"}}}]} Jul 08 02:06:48 hostname.example.com firewalld[77366]: ERROR: Raising SystemExit in run_server Jul 08 02:06:48 hostname.example.com systemd[1]: firewalld.service: Deactivated successfully.

2 6

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

firewalld-users July 2023