On 20.10.2023 02:54, Mai Ling wrote:
On Mon, Oct 16, 2023 at 12:17 PM Andrei Borzenkov
<arvidjaar(a)gmail.com> wrote:
>
> On Sun, Oct 15, 2023 at 9:34 PM Mai Ling <mailinglists35(a)gmail.com> wrote:
>>
>> On Sun, Oct 15, 2023 at 9:04 PM Andrei Borzenkov <arvidjaar(a)gmail.com>
wrote:
>>>
>>> On 15.10.2023 20:31, Mai Ling wrote:
[...]
>>>> 2) Why does web can initiate outgoing to anywhere?
>>>>
>>>
>>> Educated guess - because source address does not match your zone definition.
>>
>> but the tcpdump shows the source address and the zone definition shows
>> the same address.
>
> From the host (and firewalld running on thi shost) point of view there
> is no forwarding. All packets originated from the local host. The
> rules for forwarding between two zones are never involved here. So the
> only option I see is to use rich rules in HOST -> ANY policy (which
> maps to OUTPUT hook).
So I did create a policy, but traffic still passes. I then removed the
policy and created "--direct" rules: traffic does not pass, as
expected.
What am I doing wrong?
I probably misunderstood what you intended. I assumed you wanted to
block traffic to/from external hosts.
...
[user@el9 ~]$ http_proxy='' ALL_PROXY='' curl
--interface 192.168.1.22
-m1 -v 192.168.1.44:8080
* Trying 192.168.1.44:8080...
* Name '192.168.1.22' family 2 resolved to '192.168.1.22' family 2
* Local port: 0
* Connected to 192.168.1.44 (192.168.1.44) port 8080 (#0)
> GET / HTTP/1.1
> Host: 192.168.1.44:8080
> User-Agent: curl/7.76.1
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Content-Type: text/plain
* no chunk, no close, no size. Assume close to signal end
<
this is 192.168.1.44 port 8080
* Closing connection 0
[user@el9 ~]$ tcpdump -qnnr firewalld.pcap
reading from file firewalld.pcap, link-type LINUX_SLL2 (Linux cooked
v2), snapshot length 1024
Warning: interface names might be incorrect
02:25:46.893238 enp3s0 M IP 192.168.1.30.25353 > 224.0.0.249.25353:
UDP, length 41
02:25:46.893372 enp3s0 M IP 192.168.1.30.25353 > 224.0.0.249.25353:
UDP, length 477
02:25:52.353101 lo In IP 192.168.1.22.59448 > 192.168.1.55.8080: tcp 0
02:25:52.353122 lo In IP 192.168.1.55.8080 > 192.168.1.22.59448: tcp 0
02:25:52.353138 lo In IP 192.168.1.22.59448 > 192.168.1.55.8080: tcp 0
02:25:52.353482 lo In IP 192.168.1.22.59448 > 192.168.1.55.8080: tcp 82
...
All your traffic is on loopback interface. If you look at rules
generated by firewalld, it shortcuts loopback and always allows traffic
here. So it never comes to checking other rules you added. When you use
direct rules, you add *another* netfilter hook that runs *in addition*
to nftables rules generated by firewalld, and both must allow the
packet. That explains why adding direct rules works.
I do not think firewalld can be used to control traffic between
different processes on the host itself without some serious redesign.