Hi everyone,
I'm trying to setup a firewall so one of my VMs is barred from accessing the LAN (if saddr = VM Address and daddr = 192.168.0.0/16, deny input and forward). I was able to do this in nftables here:
table inet ext_only { chain input { type filter hook input priority filter - 10; policy accept; ct state new ip saddr 192.168.100.100 drop }
chain forward { type filter hook forward priority filter - 10; policy accept; ct state new ip saddr 192.168.100.100 ip daddr 192.168.0.0/16 drop } }
However, I've been having trouble trying to figure out the correct way to do this for firewalld. I know I can move the VM IP to its own zone, and I can then block input, but I couldn't figure out how to write a forward deny rule.
What is the recommended way to handle dropping forwarded packets?
Thank you for any help with this.
Regards, Sean