Firewalld/docker/nftables basic questions
by Thomas HUMMEL
Hello,
I'm new to firewalld which I'm running on RHEL 8.6 x86_64
(firewalld-0.9.3-13) with nftables-0.9.3-25 backend.
I previously used nftables.services (so without firewalld as services
conflict) to reject some basic outgoing traffic depending on the meta
packet attribute skuid != root
The problem is that on hosts running docker, any update to my rules
would flush docker related rules, hence my exploring of firewalld to see
if both can live happily together.
My understanding is that firewalld policy (even for the HOST virtual
zone configured as ingress zone for a policy) cannot express a match on
such an attribute. Is this correct ?
Anyway, my readings of firewalld docs lead me to the following questions:
1) my understanding is that a "real" (non virtual) zone (can) embedds
some firewall logic/rules for *incoming* traffic to the *host* (running
firewalld) - the so called implicit zone policy, and that policies are
meant to handle traffic between 2 zones (one called the ingress zone for
whats' coming into the firewall and one called the egress zone for
what's leaving the firewall). And that to handle traffic coming from/to
the host (as in input/ouput Netfilter hooks) the HOST virtual zone can
be used (as ingres OR egress but not both)
a) if HOST is used as egress : would not that overlap or even conflict
with what's coming inside the host throught a real active zone ?
b) if one wants to apply rules for both incoming and outcoming traffic
how should he use (ingress or egress) the HOST zone ? Do we have to
write 2 policies ?
c) if a policy declares only one zone instead of both an ingress and an
egress zone: is the second one similar the ANY virtual zone ?
2) I wonder how docker does its magic with firewalld :
a) how does the docker0 bridge interface get bound to the docker zone ?
b) why do docker nftables rules survive either:
a systemctl reload or restart of firewalld
a firewall-cmd --reload or --complete-reload
what's the difference between this and doing some runtime (non
--permanent) change ?
Thanks for your help
--
Thomas HUMMEL
7 months, 1 week
how to set up wg0 on internal, and public + host
by Gijs Hillenius
Hello,
My server hosts several services, (web, mail), and I use firewalld.
All of these services are defined in zone public, reachable via the
Internet over interface eth0.
I also want to use it as a WireGuard server.
wg0 is the interface for zone=internal. This way, traffic from peers is
masquerared fine to the Internet, because I use this policy:
# firewall-cmd --new-policy NAT_int_to_ext --permanent
# firewall-cmd --permanent --policy NAT_int_to_ext --add-ingress-zone internal
# firewall-cmd --permanent --policy NAT_int_to_ext --add-egress-zone public
# firewall-cmd --permanent --policy NAT_int_to_ext --set-target ACCEPT
However, WireGuard peers are for now unable to reach the web and mail services on
the host.
I've studied the firewalld website documentation, searched the mailing
list, and perused other sources. Not entirely confident ... I would like
confirmation that this is what is needed:
1) allow wg0 (internal) --> eth1 (public) <<< done
2) allow eth1 (public) --> wg0 (internal)
And for that second step, that could be something like this - copied
from the firewalld blog "Policy Objects: Introduction":
# firewall-cmd --permanent --new-policy myOutputPolicy
# firewall-cmd --permanent --policy myOutputPolicy --add-ingress-zone HOST
# firewall-cmd --permanent --policy myOutputPolicy --add-egress-zone ANY
In addition, I have a doubt about my initial configuration of wireguard
to use port 51820 on the zone public.
If I run "firewall-cmd --zone=public --list-all" it will show (among
other)
ports: 51820/udp
the same command for zone internal won't show that port.
I wonder if I needed to add that port to zone=public. I think it is only
for zone internal? And there it works without needing explicit
assignment?
Kind greetings
Gijs
7 months, 2 weeks