HI Eric,
Thanx a lot for your help!
Now, I think it works as designed!
O.K., what have I done?
1) activate logging: # firewall-cmd --set-log-denied=all
2) monitor syslog: (Best in a second terminator section or shell window) # journalctl -f
3) create firewall zones: # firewall-cmd --permanent --new-zone=edmz # firewall-cmd --permanent --new-zone=idmz # firewall-cmd --reload
4) assign network interfaces to the zones: # firewall-cmd --permanent --zone=edmz --add-interface=eth0 # firewall-cmd --permanent --zone=idmz --add-interface=eth1 # firewall-cmd --reload
5) activate masquerading for zone edmz: # firewall-cmd --permanent --zone=edmz --add-masquerade # firewall-cmd --reload
6) additionally set up NAT for the traffic IDMZ → EDMZ: # firewall-cmd --permanent --new-policy idmz-2-edmz # firewall-cmd --permanent --policy idmz-2-edmz \ --add-ingress-zone idmz # firewall-cmd --permanent --policy idmz-2-edmz \ --add-egress-zone edmz # firewall-cmd --permanent --policy idmz-2-edmz \ --set-target ACCEPT # firewall-cmd --reload
7) activate SSH for the zone idmz: # firewall-cmd --permanent --zone=idmz --add-service=ssh # firewall-cmd --reload
8) activate SSH for the edmz zone for access from the EDMZ (192.168.0.0/24 and 2003:a:b:c0::/64) itself: # firewall-cmd --permanent --zone=edmz --add-rich-rule='rule \ family="ipv4" source address="192.168.0.0/24" \ service name="ssh" accept' # firewall-cmd --permanent --zone=edmz --add-rich-rule='rule \ family="ipv6" source address="2003:a:b:c0::/64" \ service name="ssh" accept' # firewall-cmd --reload
9) allow SSH from the Internet only via port 41022: # firewall-cmd --permanent --zone=edmz --add-rich-rule='rule \ family="ipv4" forward-port port=41022 to-port=22 \ protocol=tcp' # firewall-cmd --permanent --zone=edmz --add-rich-rule='rule \ family="ipv6" forward-port port=41022 to-port=22 \ protocol=tcp' # firewall-cmd --reload
10) forward port 25 of the firewall host to a host in the IDMZ. # firewall-cmd --permanent --zone=edmz \ --add-forward-port=port=25:proto=tcp:toaddr=10.0.0.110 # firewall-cmd --permanent --zone=edmz \ --add-forward-port=25:proto=tcp:toaddr=2003:a:b:c1:10::110 # firewall-cmd --reload
11) forward MX ports 25, 465 and 587 to target_MX host: # firewall-cmd --permanent --new-policy edmz-2-idmz # firewall-cmd --permanent --policy edmz-2-idmz \ --add-ingress-zone edmz # firewall-cmd --permanent --policy edmz-2-idmz \ --add-egress-zone idmz # firewall-cmd --permanent --policy edmz-2-idmz \ --set-target REJECT # firewall-cmd --permanent --policy edmz-2-idmz \ --add-rich-rule='rule family="ipv6" \ destination address="2003:a:b:c1:10::110" \ service name="smtp" accept' # firewall-cmd --permanent --policy edmz-2-idmz \ --add-rich-rule='rule family="ipv6" \ destination address="2003:a:b:c1:10::110" \ port port=465 protocol=tcp accept' # firewall-cmd --permanent --policy edmz-2-idmz \ --add-rich-rule='rule family="ipv6" \ destination address="2003:a:b:c1:10::110" \ port port=587 protocol=tcp accept' # firewall-cmd --reload Proceed accordingly for other services and service hosts ...
Do you still see a need for optimization? Or do you have any suggestions for improvement? If so, let us know! I always want to learn more! :)
cul8r, Django