On Thu, Jan 18, 2024 at 09:33:30PM +0100, Django [Bastard Operator from Hell] wrote:
Hello Andrej,
On 18.01.24 um 18:31 Andrei Borzenkov wrote:
Zones are by definition for local (destination is local host, INPUT chain) packets. You need to define policy between two zones, ingress zone edmz and egress zone whatever is assigned to the interface connected to FWC and use your rule there. Policies are for forwarded packets.
OK, if I have understood the concept of policies correctly, then I will summarize it:
I've already one policy called NAT_idmz_to_edmz:
root@vml000210:~# cat /etc/firewalld/policies/NAT_idmz_to_edmz.xml
<?xml version="1.0" encoding="utf-8"?>
<policy target="ACCEPT"> <ingress-zone name="idmz"/> <egress-zone name="edmz"/> </policy>
This now means the following: Input-channel is the ingress-zone with name idmz. Output-channel is egress-zone with name edmz. Policy-target means, that all traffic is allow from zone idmz to zone edmz.
Have I understood that correctly, or am I completely wrong?
That's correct.
If I have understood this correctly, it should work now, right?
- I create a new zone with the name smtp-access
- In the zone, I allow for IPv6 from everywhere → source address="::/0" to
the destination address 2003:a:b:c1:10::110 traffic for the SMTP service
root@vml000210:~# cat /etc/firewalld/zones/smtp-access.xml
<?xml version="1.0" encoding="utf-8"?>
<zone> <rule family="ipv6"> <source address="::/0"/>
This rich rule further filters traffic assigned to the zone. So saying "all IPv6" here doesn't make sense as right now you have no interface/source. The zone doesn't get any traffic assigned to it!
A "source" inside a rich rule refers to a source address match, e.g. you want to enable something for a single IP address.
A "source" in a zone means assign traffic with that source address/CIDR to the zone, e.g. a subnet (10.10.10.0/24).
<destination address="2003:a:b:c1:10::110"/> <service name="smtp"/> <accept/></rule> </zone>
This zone does not have an interface or source binding [*]. Meaning no traffic will be assigned to it. You need to do --zone smtp-access --add-interface or --zone smtp-access --add-source.
[*]: That is, unless you're using NetworkManager and did the assignment there.
I then define a new policy with the name SMTPT_edmz_to_idmz and define smtp-access as the inbound zone and idmz as the outbound zone:
root@vml000210:~# cat /etc/firewalld/policies/SMTPT_edmz_to_idmz.xml
<?xml version="1.0" encoding="utf-8"?>
<policy target="CONTINUE"> <ingress-zone name="smtp-access"/> <egress-zone name="idmz"/> </policy>
Is that really the case? So I think something is still wrong! Why I mean that, now after a reload of the firewalld on the host FWB (vml000210) ...
root@vml000210:~# firewall-cmd --reload
success
... nothing happens! :(
It is still not possible to access port 25 of host FWC (vml000110) from outside via host FWB (vml000210).
So either I'm stupid or old or a combination of both, so hard to understand
Maybe it would help to start over. Start from scratch, describe your topology, then tell us what you'd like to do. From what I can glean your goals aren't too complex.
Please include interfaces and subnet addressing in your description. You can obfuscate them.
...
Or how the hell do I define a policy between the zone smtp-in as input and the destination zone idmz, where only traffic from the source ::/0 to the destination 2003:a:b:c1:10::110 on port 25 is allowed.
Your policy is correct. I think where it's failing is that these zones and policies are not active because you haven't done --add-interface or --add-source.
I also think you missed a key point about zones. Traffic ingresses one and only one zone. Traffic egresses one and only one zone.