Hello Andrej,
On 18.01.24 um 18:31 Andrei Borzenkov wrote:
Zones are by definition for local (destination is local host, INPUT chain) packets. You need to define policy between two zones, ingress zone edmz and egress zone whatever is assigned to the interface connected to FWC and use your rule there. Policies are for forwarded packets.
OK, if I have understood the concept of policies correctly, then I will summarize it:
I've already one policy called NAT_idmz_to_edmz:
root@vml000210:~# cat /etc/firewalld/policies/NAT_idmz_to_edmz.xml <?xml version="1.0" encoding="utf-8"?> <policy target="ACCEPT"> <ingress-zone name="idmz"/> <egress-zone name="edmz"/> </policy>
This now means the following: Input-channel is the ingress-zone with name idmz. Output-channel is egress-zone with name edmz. Policy-target means, that all traffic is allow from zone idmz to zone edmz.
Have I understood that correctly, or am I completely wrong?
If I have understood this correctly, it should work now, right? 1) I create a new zone with the name smtp-access 2) In the zone, I allow for IPv6 from everywhere → source address="::/0" to the destination address 2003:a:b:c1:10::110 traffic for the SMTP service
root@vml000210:~# cat /etc/firewalld/zones/smtp-access.xml <?xml version="1.0" encoding="utf-8"?> <zone> <rule family="ipv6"> <source address="::/0"/> <destination address="2003:a:b:c1:10::110"/> <service name="smtp"/> <accept/> </rule> </zone>
I then define a new policy with the name SMTPT_edmz_to_idmz and define smtp-access as the inbound zone and idmz as the outbound zone:
root@vml000210:~# cat /etc/firewalld/policies/SMTPT_edmz_to_idmz.xml <?xml version="1.0" encoding="utf-8"?> <policy target="CONTINUE"> <ingress-zone name="smtp-access"/> <egress-zone name="idmz"/> </policy>
Is that really the case? So I think something is still wrong! Why I mean that, now after a reload of the firewalld on the host FWB (vml000210) ...
root@vml000210:~# firewall-cmd --reload
success
... nothing happens! :(
It is still not possible to access port 25 of host FWC (vml000110) from outside via host FWB (vml000210).
So either I'm stupid or old or a combination of both, so hard to understand ...
Or how the hell do I define a policy between the zone smtp-in as input and the destination zone idmz, where only traffic from the source ::/0 to the destination 2003:a:b:c1:10::110 on port 25 is allowed.
ttyl Django