On 08/06/2014 09:45 AM, David Andrew Michael Noelle wrote:
question 1 Do I have to do something more to /enable/ routing between the two localnets?
Does it change if you add masquerade into 'work' or 'dmz' ?
question 2 How exactly are zones applied?
https://bugzilla.redhat.com/show_bug.cgi?id=1097960#c1 might shed some light on this.
question 3 What are the recommended methods of blocking specific localnet addresses or the whole "work" zone from connecting to specific ports on external host ranges, i.e. no FaceBook at work? Would rich rules in the "work" zone be the proper way?
We AFAIK don't have a way how to restrict outbound traffic, so I guess 'direct' rules are the only way.
question 4
Is there a way to specify classes of destinations, like a destination zone? It would be nice to bundle up the ip ranges or even domains of FaceBook and Twitter and Tumblr and whatnot into a "SocialMedia" class and just block any traffic to those destinations, either from the "work" zone or from specific localnet IPs.
Sounds like ipsets might come in handy here: https://lists.fedorahosted.org/pipermail/firewalld-users/2014-July/000201.ht...
question 5
I'd rather not answer this as I'm not sure.
-- Jiri