HI,
almost two years ago, the mailing list and Eric Garver in particular
provided me with valuable informations and advices.
I have a virtual machine running here that separates the two network
segments IDMZ and EDMZ from each other. The net0 interface points
“outwards towards EDMZ” and net1 towards IDMZ.
# firewall-cmd --zone=edmz --list-all
edmz (default, active)
target: default
ingress-priority: 0
egress-priority: 0
icmp-block-inversion: no
interfaces: net0
sources:
services:
ports:
protocols:
forward: no
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family="ipv4" forward-port port="41022" protocol="tcp" to-port="22"
rule family="ipv6" forward-port port="587" protocol="tcp" to-port="587"
to-addr="2003:abc:def:7603:10::110"
rule family="ipv4" forward-port port="25" protocol="tcp" to-port="25"
to-addr="10.0.0.110"
rule family="ipv4" source address="172.17.2.0/24" service name="ssh" accept
rule family="ipv6" forward-port port="25" protocol="tcp" to-port="25"
to-addr="2003:abc:def:7603:10::110"
rule family="ipv4" forward-port port="465" protocol="tcp" to-port="465"
to-addr="10.0.0.110"
rule family="ipv6" forward-port port="41022" protocol="tcp" to-port="22"
rule family="ipv6" source address="2003:abc:def:7600::/64" service
name="ssh" accept
rule family="ipv4" forward-port port="587" protocol="tcp" to-port="587"
to-addr="10.0.0.110"
rule family="ipv6" forward-port port="465" protocol="tcp" to-port="465"
to-addr="2003:abc:def:7603:10::110"
rule family="ipv6" icmp-type name="echo-request" accept
# firewall-cmd --zone=idmz --list-all
idmz (active)
target: default
ingress-priority: 0
egress-priority: 0
icmp-block-inversion: no
interfaces: net1
sources:
services: ssh
ports:
protocols:
forward: no
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family="ipv6" forward-port port="41022" protocol="tcp" to-port="22"
rule family="ipv4" forward-port port="41022" protocol="tcp" to-port="22"
rule family="ipv6" icmp-type name="echo-request" accept
# firewall-cmd --policy=edmz_2_idmz --list-all
edmz_2_idmz (active)
disable: no
priority: -1
target: REJECT
ingress-zones: edmz
egress-zones: idmz
services:
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family="ipv4" destination address="10.0.0.110" port port="25"
protocol="tcp" accept
rule family="ipv4" destination address="10.0.0.110" port port="465"
protocol="tcp" accept
rule family="ipv4" destination address="10.0.0.110" port port="53"
protocol="tcp" accept
rule family="ipv4" destination address="10.0.0.110" port port="53"
protocol="udp" accept
rule family="ipv4" destination address="10.0.0.110" port port="587"
protocol="tcp" accept
rule family="ipv6" icmp-type name="echo-request" accept
rule family="ipv6" destination address="2003:abc:def:7603:10::110" port
port="25" protocol="tcp" accept
rule family="ipv6" destination address="2003:abc:def:7603:10::110" port
port="465" protocol="tcp" accept
rule family="ipv6" destination address="2003:abc:def:7603:10::110" port
port="53" protocol="tcp" accept
rule family="ipv6" destination address="2003:abc:def:7603:10::110" port
port="53" protocol="udp" accept
rule family="ipv6" destination address="2003:abc:def:7603:10::110" port
port="587" protocol="tcp" accept
rule family="ipv6" destination address="fd00::3:10:0:0:110" port
port="53" protocol="tcp" accept
rule family="ipv6" destination address="fd00::3:10:0:0:110" port
port="53" protocol="udp" accept
# firewall-cmd --policy=idmz_2_edmz --list-all
idmz_2_edmz (active)
disable: no
priority: -1
target: ACCEPT
ingress-zones: idmz
egress-zones: edmz
services:
ports:
protocols:
masquerade: yes
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family="ipv6" icmp-type name="echo-request" accept
# sysctl net.ipv6.conf.all.forwarding
net.ipv6.conf.all.forwarding = 1
# sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1
Almost two years ago, everything worked perfectly. After a long absence
due to illness, I am now back to working on the installation. I noticed
the following. IPv4 traffic from the IDMZ zone is forwarded as usual.
BUT:
IPv6 traffic from the IDMZ to the EDMZ is suddenly no longer being
forwarded! :(
If I add a rich-rule like that:
# firewall-cmd --policy=idmz_2_edmz --add-rich-rule='rule family=ipv6
masquerade'
success
Now, the hosts from the IDMZ can once again reach machines in the EDMZ
or beyond, but externally, the IPv6 of the firewall host is used and
transmitted. OK, at least it would work again, but machines in front of
the firewall should see the IPv6 address of the originating hosts and
not that of the firewall!
Eric, I have absolutely no idea what's going wrong and I hope you cann
help me once again. ;)
I use firewalld-2.4.0-2 on my ArchLinux host.
Best regards
--
Django (Bastard Operator from Hell [BOfH])
aka Michael Nausch
Gänsbrunnenweg 6
85652 Pliening
Tel.: 08121 883176
Fax.: 08121 883179
Mail: <mailto:django@nausch.org>
https://wetterstation-pliening.infohttps://ebersberger-liedersammlung.dehttps://dokuwiki.nausch.org