firewalld-users August 2023

firewalld-users@lists.fedorahosted.org

4 participants
3 discussions

Re: Evaluating monitoring rules in multiple zones (public and another zone)
by Eric Garver 21 Aug '23

21 Aug '23

On Mon, Aug 21, 2023 at 01:11:32PM +0000, Will Furnell - STFC UKRI wrote: > Hello, > > Sorry to bump this - but I was looking at this again and noted you > appear to be the one packaging firewalld as well - do you know if this > fix will be backported to EL9? It seems unlikely because it was fixed as part of a major version bump, v2.0.0. Backporting it to RHEL-9 would be very difficult.

1 0

Re: Evaluating monitoring rules in multiple zones (public and another zone)
by Will Furnell - STFC UKRI 21 Aug '23

21 Aug '23

Hello, Sorry to bump this - but I was looking at this again and noted you appear to be the one packaging firewalld as well - do you know if this fix will be backported to EL9? Thanks, Will.

1 0

tcp-mss-clamp
by D. Hugh Redelmeier 08 Aug '23

08 Aug '23

I'm having trouble getting a gateway/router working. Context: - I have two gateways, both to broadband, both requiring PPPoE - both are running Fedora 38 and use firewalld-1.3.1-1.fc38.noarch - one works and one doesn't work reliably: some web sites time out I think that the problem is with MTU. PPPoE doesn't allow 1500 byte packets through: the limit is 1492. The "proof" is that if I set the MTU to 1492 on a client's ethernet interface, the client can use the bad gateway with no problem. firewalld.policy(5) says that there is an option: tcp-mss-clamp Is an optional empty-element tag and can be used several times. If left empty maximum segment size is set to 'pmtu'. This tag has exactly one optional attribute: value="string" Value can set maximum segment size to 'pmtu' (Path Maximum Transmission Unit) or a user-defined value that is greater than or equal to 536. I took this as meaning that I could add <tcp-mss-clamp/> to the policy file, like this: <?xml version="1.0" encoding="utf-8"?> <policy priority="100" target="ACCEPT"> <ingress-zone name="FedoraServer"/> <egress-zone name="external"/> <tcp-mss-clamp/> </policy> When I do so, firewalld throws a python error (see below). ==> am I writing this option correctly? Should I have used <tcp-mss-clamp value="1492"/>? ==> is there a way of expressing this in firewall-cmd? (None is documented in firewall-cmd(1).) ==> is this a reasonable diagnostic? (I don't think so.) ==> bonus questions: Why would some web sites be blocked by this MTU problem with one ISP and not the other? The working ISP is providing VDSL, the last mile provided by Bell Canada. The failing ISP is Bell Canada itself, providing FTTH. Why some sites (eg. news.banggood.com) and not others? What is the correct fix for my problem? Somehow Path MTU discovery isn't solving the problem. ================ log of firewalld python error ================ Aug 06 02:29:40 my-hostname systemd[1]: Starting firewalld.service - firewalld - dynamic firewall daemon... Aug 06 02:29:40 my-hostname systemd[1]: Started firewalld.service - firewalld - dynamic firewall daemon. Aug 06 02:29:40 my-hostname audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=firewalld comm="systemd" exe="/usr/lib> Aug 06 02:29:40 my-hostname firewalld[17576]: ERROR: Failed to load user configuration. Falling back to full stock configuration. Aug 06 02:29:40 my-hostname audit[17576]: NETFILTER_CFG table=firewalld:13 family=1 entries=1 op=nft_register_table pid=17576 subj=system_u:system_r:firewalld_t:s0 comm="firewa> Aug 06 02:29:40 my-hostname audit[17576]: NETFILTER_CFG table=firewalld:14 family=1 entries=222 op=nft_register_chain pid=17576 subj=system_u:system_r:firewalld_t:s0 comm="fire> Aug 06 02:29:40 my-hostname firewalld[17576]: Traceback (most recent call last): File "/usr/lib/python3.11/site-packages/firewall/server/decorators.py", line 51, in _impl return func(*args, **kwargs) ^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3.11/site-packages/firewall/server/firewalld.py", line 91, in start return self.fw.start() ^^^^^^^^^^^^^^^ File "/usr/lib/python3.11/site-packages/firewall/core/fw.py", line 656, in start raise original_ex File "/usr/lib/python3.11/site-packages/firewall/core/fw.py", line 633, in start self._start() File "/usr/lib/python3.11/site-packages/firewall/core/fw.py", line 584, in _start self._start_load_user_config() File "/usr/lib/python3.11/site-packages/firewall/core/fw.py", line 410, in _start_load_user_config self._loader_policies(config.ETC_FIREWALLD_POLICIES) File "/usr/lib/python3.11/site-packages/firewall/core/fw.py", line 716, in _loader_policies obj = policy_reader(filename, path) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3.11/site-packages/firewall/core/io/policy.py", line 1075, in policy_reader parser.parse(source) File "/usr/lib64/python3.11/xml/sax/expatreader.py", line 111, in parse xmlreader.IncrementalParser.parse(self, source) File "/usr/lib64/python3.11/xml/sax/xmlreader.py", line 125, in parse self.feed(buffer) File "/usr/lib64/python3.11/xml/sax/expatreader.py", line 217, in feed self._parser.Parse(data, isFinal) File "/builddir/build/BUILD/Python-3.11.4/Modules/pyexpat.c", line 416, in StartElement File "/usr/lib64/python3.11/xml/sax/expatreader.py", line 333, in start_element self._cont_handler.startElement(name, AttributesImpl(attrs)) File "/usr/lib/python3.11/site-packages/firewall/core/io/policy.py", line 993, in startElement if common_startElement(self, name, attrs): ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3.11/site-packages/firewall/core/io/policy.py", line 117, in common_startElement attrs["value"]) ~~~~~^^^^^^^^^ File "/usr/lib64/python3.11/xml/sax/xmlreader.py", line 318, in __getitem__ return self._attrs[name] ~~~~~~~~~~~^^^^^^ KeyError: 'value'

3 5

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

firewalld-users August 2023