Hi, I'm struggling to set up firewalld to pass traffic between 2 networks. Is this
possible with firewalld?
My lab setup is:
Server (ens192:192.168.3.2) <-> (ens224:192.168.3.1) firewall (ens192:192.168.110.8)
<-> (ens192:192.168.110.9) client
Freshly installed CentOS 8.2 (2004), server installation with no GUI on all 3 VMs.
[root@firewall ~]# sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1
Client can ping Server
[root@client ~]# ping -c 3 192.168.3.2
PING 192.168.3.2 (192.168.3.2) 56(84) bytes of data.
64 bytes from 192.168.3.2: icmp_seq=1 ttl=63 time=0.530 ms
64 bytes from 192.168.3.2: icmp_seq=2 ttl=63 time=0.552 ms
64 bytes from 192.168.3.2: icmp_seq=3 ttl=63 time=0.444 ms
Client can't get to the server's ssh port.
[root@client ~]# nc 192.168.3.2 22
Ncat: No route to host.
[root@firewall ~]# systemctl stop firewalld
[root@client ~]# nc 192.168.3.2 22
SSH-2.0-OpenSSH_8.0
So far things are working as expected.
I configure firewalld as follows:
[root@firewall ~]# systemctl start firewalld
[root@firewall ~]# firewall-cmd --version
0.8.0
[root@firewall ~]# firewall-cmd --zone=public --remove-interface=ens192
success
[root@firewall ~]# firewall-cmd --zone=public --remove-interface=ens224
success
[root@firewall ~]# firewall-cmd --zone=dmz --add-interface=ens224
success
[root@firewall ~]# firewall-cmd --zone=internal --add-interface=ens192
success
[root@firewall ~]# firewall-cmd --zone=internal --add-rich-rule='rule family=ipv4
source address=192.168.110.9/32 destination address=192.168.3.2/32 service name=ssh
accept'
success
[root@firewall ~]# firewall-cmd --zone=internal --list-all
internal (active)
target: default
icmp-block-inversion: no
interfaces: ens192
sources:
services: cockpit dhcpv6-client mdns samba-client ssh
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family="ipv4" source address="192.168.110.9/32" destination
address="192.168.3.2/32" service name="ssh" accept
[root@firewall ~]# firewall-cmd --zone=dmz --list-all
dmz (active)
target: default
icmp-block-inversion: no
interfaces: ens224
sources:
services: ssh
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
[root@client ~]# nc 192.168.3.2 22
Ncat: No route to host.
Shouldn't this work? What am I missing?