On Tue, Mar 14, 2023 at 3:29 PM GAMBINI Gilian gilian.gambini@dsi.cnrs.fr wrote:
Hello
Im looking for a firewalld equivalent of iptables option "-m state --state ESTABLISHED,RELATED". I use firewalld 0.9.3 on a RHEL8.7 with
This is default and is always implicitly added to the configured rules.
nftables backend. nftables support conntrack state (like "ct state { established, related }") but i dont find this in firewalld rich rules documentation. Documentation talk about helpers associate to services but i just dont understand how it work.
Explicitly configured rules apply to the initial connection, firewalld implicitly enables connection tracking and allows packets belonging to existing flow.
If i accept some INPUT connexion on a specific port and want to allow tcp response on OUTPUT (ie with established or related state), can you confirm me i need to bypass firewalld and add directly a nft rules on the right chain ?
By default all OUTPUT packets are allowed. There is nothing to explicitly allow here.