On Tue, Jun 29, 2021 at 12:52:42PM -0000, DragonBillow Zhang wrote:
On Tue, Jun 29, 2021 at 06:01:36AM -0000, DragonBillow Zhang wrote:
What do you mean by "set it's zone as home"? Do you mean you set the default zone to home? If so, that's why. All packets not assigned to a zone fall to the default zone.
The default zone of firewalld is Public, but the activated zone is home. Run commands as:
# firewall-cmd --get-default-zone public # firewall-cmd --get-active-zones docker interfaces: br-06ed83c1b88d br-09ee97155bb0 br-828f7b8ffdb4 docker0 home interfaces: wlp2s0I'm now connect to a family WIFI, so I set it's zone to "home".
All packets not assigned to a zone fall to the default zone.
How do I assign packets? I try to set default zone to "block" so reject these ports's packets, but it works as before.
By assigning an interface/source to the zone.
How are you exposing ports to the docker containers? via docker? These are Destination Network Address Translation (DNAT) and get added to the PREROUTING nat chains with no scoping to ingress interface or source addresses.
I think you should be able to use a firewalld policy (v0.9.0+) to restrict the port forwarding. The above mentioned DNAT will still occur, but the policy will block the traffic later on in the pipeline.
This example blocks all traffic to the docker containers except those from 192.168.0.0/16 network. This is just an example. Change the address to whatever you need.
# firewall-cmd --permanent --new-policy worldToDocker # firewall-cmd --permanent --policy worldToDocker --add-ingress-zone ANY # firewall-cmd --permanent --policy worldToDocker --add-egress-zone docker # firewall-cmd --permanent --policy worldToDocker --add-rich-rule='rule family=ipv4 source not address=192.168.0.0/16 drop' # firewall-cmd --reload