On Thu, May 04, 2023 at 01:18:27PM +0000, Will Furnell - STFC UKRI wrote:
[..]
Is there a way to get firewalld to evaluate rules in multiple zones
in
a chain like icinga -> public -> DENY?
No. But you can use a policy to common-ize some things. The below policy
applies to both zones, icinga and public.
e.g.
# firewall-cmd --permanent --new-policy mypolicy
# firewall-cmd --permanent --policy mypolicy --add-ingress-zone icinga
# firewall-cmd --permanent --policy mypolicy --add-ingress-zone public
# firewall-cmd --permanent --policy mypolicy --add-egress-zone HOST
# firewall-cmd --permanent --policy mypolicy --add-service cinga
# firewall-cmd --reload
Then you could add your unique services, e.g. https, to the public zone
or a separate policy.
Hope that helps.
Eric.
https://firewalld.org/documentation/concepts.html
https://firewalld.org/2020/09/policy-objects-introduction