On Thu, Jun 07, 2018 at 04:38:16PM -0500, Michael Crider - HOEC wrote:
I am trying to recreate an existing firewall configuration created in Firewall Builder using Firewalld. It runs on a router that controls traffic in and out of our company network. The existing configuration has rules that permit traffic to be relayed out on specified ports for specified addresses on the internal network. For example: a list of addresses are allowed to get out on ports 80 and 443 for http and https traffic, any other internal machines are denied. I currently have the external interface in the external zone, and the internal interface in the public zone, with the following configuration: external (active) target: DROP icmp-block-inversion: no interfaces: ens2f1 sources: services: ports: protocols: masquerade: yes forward-ports: source-ports: icmp-blocks: rich rules: public (active) target: %%REJECT%% icmp-block-inversion: no interfaces: ens2f0 sources: services: ports: protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules:
I have found examples of direct interface rules for allowing traffic out, but is there any other way (rich rule or something else I'm overlooking) to unblock traffic like the log excerpt below? As far as I can tell a rich rule with an element of service and an action of accept only allows traffic to the router, not passing through the router.
No. Currently, firewalld is more of an end-station firewall. There are RFEs to implement OUTPUT [0] and FORWARD [1] filtering. I suspect these will be implemented via rich rules.
Right now the only option is to use direct rules.
[0] https://github.com/firewalld/firewalld/issues/32 [1] https://github.com/firewalld/firewalld/issues/2