On Sun, Nov 08, 2020 at 02:03:37AM -0000, Robert Smuhar wrote:
Hi, I'm struggling to set up firewalld to pass traffic between 2 networks. Is this possible with firewalld?
Until v0.9.0 firewalld was effectively an end station firewall. This means it did not support FORWARD filtering.
My lab setup is: Server (ens192:192.168.3.2) <-> (ens224:192.168.3.1) firewall (ens192:192.168.110.8) <-> (ens192:192.168.110.9) client Freshly installed CentOS 8.2 (2004), server installation with no GUI on all 3 VMs.
[root@firewall ~]# sysctl net.ipv4.ip_forward net.ipv4.ip_forward = 1
Client can ping Server [root@client ~]# ping -c 3 192.168.3.2 PING 192.168.3.2 (192.168.3.2) 56(84) bytes of data. 64 bytes from 192.168.3.2: icmp_seq=1 ttl=63 time=0.530 ms 64 bytes from 192.168.3.2: icmp_seq=2 ttl=63 time=0.552 ms 64 bytes from 192.168.3.2: icmp_seq=3 ttl=63 time=0.444 ms
ICMP works because zones with a target of "default" will explicitly allow FORWARDed ICMP packets.
Client can't get to the server's ssh port. [root@client ~]# nc 192.168.3.2 22 Ncat: No route to host.
However, SSH is dropped because there are on FORWARD rules to allow it. Older firewalld versions do _not_ support FORWARD filtering.
[root@firewall ~]# systemctl stop firewalld
[root@client ~]# nc 192.168.3.2 22 SSH-2.0-OpenSSH_8.0
So far things are working as expected.
I configure firewalld as follows: [root@firewall ~]# systemctl start firewalld [root@firewall ~]# firewall-cmd --version 0.8.0 [root@firewall ~]# firewall-cmd --zone=public --remove-interface=ens192 success [root@firewall ~]# firewall-cmd --zone=public --remove-interface=ens224 success [root@firewall ~]# firewall-cmd --zone=dmz --add-interface=ens224 success [root@firewall ~]# firewall-cmd --zone=internal --add-interface=ens192 success [root@firewall ~]# firewall-cmd --zone=internal --add-rich-rule='rule family=ipv4 source address=192.168.110.9/32 destination address=192.168.3.2/32 service name=ssh accept' success
rich rules added to a zone will filter on the INPUT. It will _not_ filter FORWARDed packets.
[root@firewall ~]# firewall-cmd --zone=internal --list-all internal (active) target: default icmp-block-inversion: no interfaces: ens192 sources: services: cockpit dhcpv6-client mdns samba-client ssh ports: protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: rule family="ipv4" source address="192.168.110.9/32" destination address="192.168.3.2/32" service name="ssh" accept [root@firewall ~]# firewall-cmd --zone=dmz --list-all dmz (active) target: default icmp-block-inversion: no interfaces: ens224 sources: services: ssh ports: protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules:
[root@client ~]# nc 192.168.3.2 22 Ncat: No route to host.
Shouldn't this work? What am I missing?
No. Newer firewalld version have native support for FORWARD and OUTPUT filtering.
See these posts:
- https://firewalld.org/2020/09/policy-objects-introduction - https://firewalld.org/2020/09/policy-objects-filtering-container-and-vm-traf...