Hello,
On 03/22/2012 01:45 PM, dobu wrote:
Hi,
I'm using Fedora 17 (alpha) at the moment and was interested in testing out the firewalld. It works so far, but I still have a few questions and couldn't find much documentation (except for Developers).
*) Why should I change from ip*tables (with the system-config-firewall front-end) to firewalld as an end-user? So far it seems to me, that without a GUI (I wouldn't count the firewall-applet as a proper GUI) it is way harder to configure.
system-config-firewall is more or less a static firewall. Any change to the firewall requires to recreate the firewall with restarting of the ip*tables services. This results in loss of connection tracking information and also connection break. Firewalld is providing a dynamic firewall service with a daemon, that is capable of enabling and disabling firewall settings without the need to restart the while firewall. It has states internally for the firewall settings. It also adds network/firewall zone support.
Also several services and applications are adding firewall rules directly which sometimes results in conflicts either in the firewall settings or at firewall access level.
I am working on the GUI configuration tool.
*) My home network consists of 2 laptops with fedora and one Macbook. I've placed my laptops into the 'home' zone. Now I wanted to share some files and used samba. I added the service, but next day it didn't work anymore. Do I really have to enable samba everytime I reboot the system with 'firewall-cmd --add --zone=home --service=samba'? How can I add a service permanently to a zone? Sorry if that's a stupid question but I couldn't find anything about that.
This is not properly documented, yet.
For now you have to manuylly copy the zone you want to modify from /usr/lib/firewalld/zones to /etc/firewalld/zones.
If you want to enable samba instead of samba-client just change the line <service name="samba-client"/> to <service name="samba"/> in the copy of the home zone in /etc/firewalld/zones.
The files in /usr/lib/firewalld are the default files. Files in /etc/firewalld/zones will overload the default files in /usr/lib/firewalld. There are three immutable zones in /usr/lib/firewalld/zones that can not be overloaded, though: block, drop and trusted. These zones are special, because they are either allowing or limiting everything.
More documentation is on the way.
*) I really, really love the zone idea. I hope the firewall-config tool, that is mentioned in the Fedora Feature Page, will be in the repository soon.
*) The firewall-applet doesn't do much at the moment, does it? Shouldn't the .desktop file be hidden, so it doesn't show up in the Applications (that's more a package maintainer problem, I guess)?
The desktop file should be removed, correct.
Well, that's it for now. I will be using it for a while and report bugs if I stumble over one. So far no problems in standard usage (that means no network printer, just casual home-user).
Thanks for testing.
dobu
Thomas