firewalld-users June 2024

firewalld-users@lists.fedorahosted.org

12 participants
8 discussions

Allowing ip address access to additional ports
by Nathanael Noblet 28 Jun '24

28 Jun '24

Hello, I think I misunderstood something about how firewalld works and need to make a change to some rules but I'm not sure how to go about it. I have srv1 and srv2. Srv1 hosts a web/db etc. Srv2 is a DB replication server so it connects to srv1 and is replicating the DB there. To do so I created a zone db-access, I added the port and as well as a number of source ip address which should be allowed to connect to that port. However, what that has resulted in is that srv2 can *only* connect to the srv1 on the db-access port. So ssh, web requests from srv2 to srv1 fail with no route to host while ping functions normally. How was I supposed to setup the firewall so that by default everything goes through the public zone, however if you match the source IP you're also allowed additional ports? Sincerely, -- Nathanael Noblet

4 7

firewalld performance concerns
by R C 24 Jun '24

24 Jun '24

Hello, I was wondering, in high performance environments (high compute loads, high bandwith loads(IB)), is it a concern to run a firewall for network performance reasons? Also, with high compute loads, I heard/read a rumor that a firewall might actually cap traffic? any thoughts? yhanks, Ron

5 15

NanoPI R4S: firewalld service on Debian (not RHEL, Fedora)
by Nayla Nikolic 22 Jun '24

22 Jun '24

Hi I have a NanoPI R4S and would like to run the device as a firewall server. My only task is to filter my network traffic with firewalld. Now I have seen on GitHub that firewalld is a Redhat/Fedora etc project. Are there any major disadvantages to running firewalld on Debian? I would rather install Debian than Fedora on R4S. Does firewalld run as well on Debian, as Fedora/RHEL etc? best regards and have a nice weekend Nayla

3 5

Re: firewalld-users Digest, Vol 118, Issue 9
by John Griffiths 21 Jun '24

21 Jun '24

I use iptables and blacklists to add blocked IPs using firewald-cmd. No need for an individual rule and no need to restart. ---------------------------------------- Jun 21, 2024 12:05:07 AM firewalld-users-request(a)lists.fedorahosted.org: > Send firewalld-users mailing list submissions to > firewalld-users(a)lists.fedorahosted.org > > To subscribe or unsubscribe via email, send a message with subject or > body 'help' to > firewalld-users-request(a)lists.fedorahosted.org > > You can reach the person managing the list at > firewalld-users-owner(a)lists.fedorahosted.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of firewalld-users digest..." > Today's Topics: > > 1. Re: firewalld performance concerns (Eric Garver) > 2. Re: time needed to apply rule takes 1 second (Eric Garver) > -- > _______________________________________________ > firewalld-users mailing list -- firewalld-users(a)lists.fedorahosted.org > To unsubscribe send an email to firewalld-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedoraho… > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

1 0

time needed to apply rule takes 1 second
by Marco Moock 20 Jun '24

20 Jun '24

Hello! The time to apply a simple rule (adding port) takes about one second. I use fail2ban which issues firewall-cmd commands. If now tens or hundreds of IPs are banned, a restart will take minutes because all rules are removed and then added. Is there a good way to speed that up? -- kind regards Marco Send unsolicited bulk mail to 1718601625muell(a)cartoonies.org

2 1

rich-rules logging without prefix
by Marco Moock 10 Jun '24

10 Jun '24

Hello! I've a rich-rule: rule family="ipv4" source address="185.122.204.97" log reject type="icmp-admin-prohibited" This results in nftables: chain filter_IN_public_deny { ip saddr 185.122.204.97 reject with icmp admin-prohibited } It does not include a logging prefix like here: chain filter_FWD_public { jump filter_FORWARD_POLICIES_pre jump filter_FWD_public_pre jump filter_FWD_public_log jump filter_FWD_public_deny jump filter_FWD_public_allow jump filter_FWD_public_post jump filter_FORWARD_POLICIES_post log prefix "filter_FWD_public_REJECT: " reject with icmpx admin-prohibited } Is that intended? How can I add it inside the rich-rule? -- Gruß Marco Send unsolicited bulk mail to 1717962664muell(a)cartoonies.org

2 1

Logging of firewalld
by Andreas Croci 07 Jun '24

07 Jun '24

Hello, I'm using openSUSE Leap and Tumbleweed, which both come with firewalld enabled. I wanted to see who is trying to access my computers and enabled the logs, but it writes to the normal journal and floods the entries there with an awful lot of messages that make the thing unreadable. I didn't find a way to specify a different file to log the dropped packets to, other than enabling rsyslog. Is there a way to keep using journald and still have the firewall log in a separate file? Thank you. Andreas

5 13

reject rich-rule with ICMP administratively prohibited
by Marco Moock 03 Jun '24

03 Jun '24

Hello! I have: rule family="ipv4" source address="185.122.204.97" reject This results in chain filter_IN_public_deny { ip saddr 185.122.204.97 reject with icmp port-unreachable } Is there a way to use firewalld rich-rules to use administratively prohibited instead? -- kind regards Marco Send unsolicited bulk mail to 1717319884muell(a)cartoonies.org

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

firewalld-users June 2024