On 18.01.2024 20:14, Django [Bastard Operator from Hell] wrote:
HI!
My environment:
### Internet ### | | V +-----------+ | | | FWA | | | +-----------+ | --EDMZ--+------------------ [laptop] | V +-----------+ | | 2003:a:b:c0:1920:168:0:210 | FWB | fe80::1921:68ff:fe00:210/64 | | fd00::192:168:0:210/64 +-----------+ | --IDMZ--+------------------ [web, mail ...] | V +-----------+ | | 2003:a:b:c1:10::110/64 | FWC | fe80::1:10:ff:fe00:110/64 | | fd00::1:10:0:0:110/64 +-----------+ | | V ### Intranet ###
Outgoing traffic from intranet, IDMZ, web or mail to internet, works fine either with IPv4 or IPv6 addresses.
With the help of firewalld rules, I can reach the SSH daemon on the host FWB.
ON my host "FWB" I put those two rich-rules: # firewall-cmd --zone=edmz --list-all | grep 41022
rule family="ipv4" forward-port port="41022" protocol="tcp" to-port="22" to-addr="192.168.0.210" rule family="ipv6" forward-port port="41022" protocol="tcp" to-port="22" to-addr="fd00::192:168:0:210"
I can reach the host FWB from the Internet without any problems with the help of:
# ssh -p 41022 2003:a:b:c0:1920:168:0:210
If I now define the following rich rule on my host FWB, I can also reach the host FWC. # firewall-cmd --zone=edmz --list-all | grep 41122
rule family="ipv4" forward-port port="41122" protocol="tcp" to-port="22" to-addr="10.0.0.110" rule family="ipv6" forward-port port="41122" protocol="tcp" to-port="22" to-addr="2003:a:b:c1:10::110"
I can reach SSH daemon on FWC from the internet with: # ssh -p 41122 2003:a:b:c0:1920:168:0:210
For testing purposes, I then installed FWC postfix on the host, which responds to both IPv4 and IPv6 on port 25. I can therefore reach the SMTP daemon listening on port 25 on the host from the host FWB.
root@vml000210:~# telnet 10.0.0.110 25 root@vml000210:~# telnet 2003:a:b:c1:10::110 25
So far so good.
On my host FWB I put these two "forward-ports" rules: # firewall-cmd --zone=edmz --list-all | grep port=25 port=25:proto=tcp:toport=:toaddr=10.0.0.110 port=25:proto=tcp:toport=:toaddr=2003:a:b:c1:10::110
From the Internet, I can now access port 25 at address 2003:a:b:c0:1920:168:0:210 and, thanks to the port-forward rule, end up at the SMTP daemon on the host FWC.
Basically, I'm fine with firewalld and its command syntax, and the routing for IPv4 and IPv6 on the two hosts FWB and FWC should work so far, in my opinion.
But what I actually have in mind is the following scenario:
Traffic from the Internet on port 22, i.e. the SSH daemon, is only permitted on the host FWB (2003:a:b:c0:1920:168:0:210) with the address. The SSH daemon on the host FWC (2003:a:b:c1:10::110) is not directly accessible from the Internet.
Both tasks have now been solved satisfactorily.
!!!***BUT***!!!:
Traffic from the Internet (::/64) may directly reach the SMTP daemon on the host FWC (2003:a:b:c1:10::110), but ONLY if the destination port is 25. To do this, the traffic must of course be allowed through on the host FWB (2003:a:b:c0:1920:168:0:210), but only if the destination port is 25 and the destination address is 2003:a:b:c1:10::110! Other traffic from the Internet which has 2003:a:b:c1:10::110 as the destination address - regardless of which destination port is selected - must be blocked by the firewalld on the host FWB (2003:a:b:c0:1920:168:0:210)!
So I need a firewall rule on the host FWB according to the following scheme:
On FBW (2003:a:b:c0:1920:168:0:210) accept SMTP traffic on port 25 from all senders on the Internet, but only for the destination address 2003:a:b:c1:10::110 and route this traffic on to the host FWC which holds the address 2003:a:b:c1:10::110.
Something like that: # firewall-cmd --zone=edmz \ --add-rich-rule='rule family="ipv6" \ source address="::/0" \ destination address="2003:a:b:c1:10::110" \ service name="smtp" accept'
Well, unfortunately it doesn't work like that or something is still missing or I've taken a completely wrong turn, who knows? :/
Zones are by definition for local (destination is local host, INPUT chain) packets. You need to define policy between two zones, ingress zone edmz and egress zone whatever is assigned to the interface connected to FWC and use your rule there. Policies are for forwarded packets.
Actually, it shouldn't be accept but forward in my naive attempt, but that immediately blows up in my face with the following error message: # firewall-cmd --zone=edmz \ --add-rich-rule='rule family="ipv6" \ source address="::/0" \ destination address="2003:a:b:c1:10::110" \ service name="smtp" forward'
Error: INVALID_RULE: unknown element forward
I currently have absolutely no idea what else I could try to solve my problem!
Maybe someone has enough expertise and patience to explain and show me ;) I am grateful for any advice and would like to take this opportunity to say thank you very much!
Best regards Django -- _______________________________________________ firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue