firewalld-users August 2024

firewalld-users@lists.fedorahosted.org

4 participants
4 discussions

Firewalld & DMZ
by Paavo Leinonen 21 Aug '24

21 Aug '24

Hi, please help me configure DMZ for my network. Used about half an hour to look for detailed docs and/or good examples, but failed. Either I need to improve my search skills, or firewalld+dmz is not very common thing or widely documented. Router/server is a Fedora box running firewalld, with interfaces - eth0 (DHCP) towards public internet - eth1 (192.168.111.1/24): DMZ - eth2 (192.168.222.1/24): trusted network for trusted devices firewall-cmd --list-all-zones for relevant zones ... dmz (active) target: ACCEPT ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: eth1 sources: services: ports: protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: ... private (default, active) target: ACCEPT ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: eth2 sources: services: ports: protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: ... public (active) target: default ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: eth0 sources: services: dhcpv6-client ports: protocols: forward: no masquerade: yes forward-ports: source-ports: icmp-blocks: rich rules: ... Now everything works, but the problem is that devices in DMZ can access devices in trusted network. When dmz zone target was default, then devices in DMZ could not access the internet. The basic goals for the network architecture is to - allow devices in DMZ access internet - allow devices in DMZ access chosen or all services in the router/server - deny devices in DMZ accessing devices in trusted network - allow devices in trusted network access internet - allow devices in trusted network access other devices in trusted network - allow devices in trusted network access devices in DMZ (ideally, not must have) Any help appreciated. -Paavo

1 0

ipset and --permanent
by Marco Moock 10 Aug '24

10 Aug '24

Hello! I would like to understand when and why I need --permanent when using ipsets. My goal is the following: fail2ban should ban IPs via the ipset option through firewalld. I want this way because I prefer to have all firewall stuff at one place. I've now deleted a permanent ipset, and it still resides in the runtime. Although, I can't delete it from the runtime. m@zbook:~$ sudo firewall-cmd --permanent --new-ipset=test --type=hash:ip --family=inet success m@zbook:~$ sudo firewall-cmd --delete-ipset=test --permanent success m@zbook:~$ sudo firewall-cmd --get-ipsets test m@zbook:~$ sudo firewall-cmd --get-ipsets --permanent m@zbook:~$ What is the preferred way to handle that? -- kind regards Marco

2 4

encrypted SIP/RTSP conn tracking
by Marco Moock 07 Aug '24

07 Aug '24

Hello! I use Linphone and SIP via TLS and SRTP. I notice that the incoming SRTP is being blocked. Is there any way to track that to allow it on demand? Aug 07 18:46:57 zbook kernel: filter_IN_FedoraServer_REJECT: IN=vpn0 OUT= MAC= SRC=2a04:2100:0000:0300:0000:0000:0000:0160 DST=2a01:0170:xxxx LEN=80 TC=184 HOPLIMIT=57 FLOWLBL=0 PROTO=UDP SPT=13211 DPT=58422 LEN=40 I can set static dst ports for that, if that is a way. -- kind regards Marco

2 2

allow all forwarded traffic to dst
by Marco Moock 07 Aug '24

07 Aug '24

Hello! I tried to allow all traffic to a certain net via a rich-rule, but the stuff is still being rejected. firewalld runs on the system that forwards (routes, not NAT/PAT) that traffic. My goal is the following: Have SPI for the system itself and parts of the VPN interface and have no FW at all for a certain address range. sudo firewall-cmd --add-rich-rule="rule family=ipv6 destination address=2001:db8::/56 accept" Is being accepted, but doesn't allow the traffic. It works for traffic that targets the firewalld system itself, but does not work for the forwarded (routed) traffic to machines connected to the VPN interface. -- kind regards Marco

3 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

firewalld-users August 2024