On Tue, Mar 14, 2023 at 03:17:24PM +0100, GAMBINI Gilian wrote:
Hello Andrei and Eric,
Thank for fast replying. I would like set up two policies, one for input (ingress ANY/egress HOST) and one for output (ingress HOST/egress ANY), both have REJECT target.
I have made some research on nftable side and i see "implicit" accept packet when ctstate is established or related on INPUT chain :
Correct. firewalld is stateful.
But no implicit accept is present in OUTPUT chain :
That was fixed in firewalld 0.9.5.
See this RHEL bug: https://bugzilla.redhat.com/show_bug.cgi?id=2156831
If a port is open in input policy, responses are blocked by the output policy. If i manually add a nft rule to accept established/related packets, its work :
nft add rule inet firewalld filter_OUTPUT position 40 ct state { established, related } accept
Of course, if i reload firewalld configuration, this rule is flushed. How can i make it permanent ? Is not recommanded to use firewalld and nftable together, i need to use only nft command ?
You can't easily make it permanent. You would have to re-add it after a firewalld reload/restart.