On Sat, Jan 20, 2024 at 05:55:44PM +0100, Django [Bastard Operator from Hell] wrote:
HI Eric,
Thanx a lot for your help!
Now, I think it works as designed!
O.K., what have I done?
- activate logging:
# firewall-cmd --set-log-denied=all
monitor syslog: (Best in a second terminator section or shell window) # journalctl -f
create firewall zones: # firewall-cmd --permanent --new-zone=edmz # firewall-cmd --permanent --new-zone=idmz # firewall-cmd --reload
assign network interfaces to the zones: # firewall-cmd --permanent --zone=edmz --add-interface=eth0 # firewall-cmd --permanent --zone=idmz --add-interface=eth1 # firewall-cmd --reload
activate masquerading for zone edmz: # firewall-cmd --permanent --zone=edmz --add-masquerade # firewall-cmd --reload
additionally set up NAT for the traffic IDMZ → EDMZ: # firewall-cmd --permanent --new-policy idmz-2-edmz # firewall-cmd --permanent --policy idmz-2-edmz \ --add-ingress-zone idmz # firewall-cmd --permanent --policy idmz-2-edmz \ --add-egress-zone edmz # firewall-cmd --permanent --policy idmz-2-edmz \ --set-target ACCEPT # firewall-cmd --reload
You could move the masquerade from above edmz zone to this policy. IMO, it's more correct. Adding it to the zone means it will masquerade all traffic egressing zone edmz regardless of where it originates, e.g. idmz, public, internal, etc. Using this policy means only traffic from idmz will be masqueraded.
activate SSH for the zone idmz: # firewall-cmd --permanent --zone=idmz --add-service=ssh # firewall-cmd --reload
activate SSH for the edmz zone for access from the EDMZ (192.168.0.0/24 and 2003:a:b:c0::/64) itself: # firewall-cmd --permanent --zone=edmz --add-rich-rule='rule \ family="ipv4" source address="192.168.0.0/24" \ service name="ssh" accept' # firewall-cmd --permanent --zone=edmz --add-rich-rule='rule \ family="ipv6" source address="2003:a:b:c0::/64" \ service name="ssh" accept' # firewall-cmd --reload
allow SSH from the Internet only via port 41022: # firewall-cmd --permanent --zone=edmz --add-rich-rule='rule \ family="ipv4" forward-port port=41022 to-port=22 \ protocol=tcp' # firewall-cmd --permanent --zone=edmz --add-rich-rule='rule \ family="ipv6" forward-port port=41022 to-port=22 \ protocol=tcp' # firewall-cmd --reload
forward port 25 of the firewall host to a host in the IDMZ. # firewall-cmd --permanent --zone=edmz \ --add-forward-port=port=25:proto=tcp:toaddr=10.0.0.110 # firewall-cmd --permanent --zone=edmz \ --add-forward-port=25:proto=tcp:toaddr=2003:a:b:c1:10::110 # firewall-cmd --reload
forward MX ports 25, 465 and 587 to target_MX host: # firewall-cmd --permanent --new-policy edmz-2-idmz # firewall-cmd --permanent --policy edmz-2-idmz \ --add-ingress-zone edmz # firewall-cmd --permanent --policy edmz-2-idmz \ --add-egress-zone idmz # firewall-cmd --permanent --policy edmz-2-idmz \ --set-target REJECT # firewall-cmd --permanent --policy edmz-2-idmz \ --add-rich-rule='rule family="ipv6" \ destination address="2003:a:b:c1:10::110" \ service name="smtp" accept' # firewall-cmd --permanent --policy edmz-2-idmz \ --add-rich-rule='rule family="ipv6" \ destination address="2003:a:b:c1:10::110" \ port port=465 protocol=tcp accept' # firewall-cmd --permanent --policy edmz-2-idmz \ --add-rich-rule='rule family="ipv6" \ destination address="2003:a:b:c1:10::110" \ port port=587 protocol=tcp accept' # firewall-cmd --reload Proceed accordingly for other services and service hosts ...
Do you still see a need for optimization? Or do you have any suggestions for improvement? If so, let us know! I always want to learn more! :)
This looks good to me based on how I understand your topology. That being said, every network is a snowflake. :)
I'm glad you got it sorted out.
Eric.