This came as a surprise to me. I was sure that zone is about traffic *to* host. But here is the diff between two configurations differing only in target, where enp0s3 is in the "internal" zone. The first configuration is with target="DROP", the second - target="ACCEPT".
+++ rules.accept 2025-01-07 10:44:24.012374347 +0300 @@ -141,7 +141,7 @@ table inet firewalld { iifname "docker0" accept iifname "enp0s3" jump filter_IN_policy_allow-host-ipv6 iifname "enp0s3" jump filter_IN_internal
iifname "enp0s3" drop
iifname "enp0s2" jump filter_IN_policy_allow-host-ipv6 iifname "enp0s2" jump filter_IN_public iifname "enp0s2" reject with icmpx admin-prohibitediifname "enp0s3" accept
@@ -160,13 +160,13 @@ table inet firewalld { iifname "docker0" jump filter_FWD_docker iifname "docker0" accept iifname "enp0s3" oifname "docker0" jump filter_FWD_internal
iifname "enp0s3" oifname "docker0" drop
iifname "enp0s3" oifname "enp0s3" jump filter_FWD_internaliifname "enp0s3" oifname "docker0" accept
iifname "enp0s3" oifname "enp0s3" drop
iifname "enp0s3" oifname "enp0s2" jump filter_FWD_internaliifname "enp0s3" oifname "enp0s3" accept
iifname "enp0s3" oifname "enp0s2" drop
iifname "enp0s3" jump filter_FWD_internaliifname "enp0s3" oifname "enp0s2" accept
iifname "enp0s3" drop
iifname "enp0s2" oifname "docker0" jump filter_FWD_public iifname "enp0s2" oifname "docker0" reject with icmpx admin-prohibited iifname "enp0s2" oifname "enp0s3" jump filter_FWD_publiciifname "enp0s3" accept
Is it expected? Is it documented anywhere?
On Tue, Jan 07, 2025 at 10:52:41AM +0300, Andrei Borzenkov via firewalld-users wrote:
This came as a surprise to me. I was sure that zone is about traffic *to* host. But here is the diff between two configurations differing only in target, where enp0s3 is in the "internal" zone. The first configuration is with target="DROP", the second - target="ACCEPT".
+++ rules.accept 2025-01-07 10:44:24.012374347 +0300 @@ -141,7 +141,7 @@ table inet firewalld { iifname "docker0" accept iifname "enp0s3" jump filter_IN_policy_allow-host-ipv6 iifname "enp0s3" jump filter_IN_internal
iifname "enp0s3" drop
iifname "enp0s2" jump filter_IN_policy_allow-host-ipv6 iifname "enp0s2" jump filter_IN_public iifname "enp0s2" reject with icmpx admin-prohibitediifname "enp0s3" accept
@@ -160,13 +160,13 @@ table inet firewalld { iifname "docker0" jump filter_FWD_docker iifname "docker0" accept iifname "enp0s3" oifname "docker0" jump filter_FWD_internal
iifname "enp0s3" oifname "docker0" drop
iifname "enp0s3" oifname "enp0s3" jump filter_FWD_internaliifname "enp0s3" oifname "docker0" accept
iifname "enp0s3" oifname "enp0s3" drop
iifname "enp0s3" oifname "enp0s2" jump filter_FWD_internaliifname "enp0s3" oifname "enp0s3" accept
iifname "enp0s3" oifname "enp0s2" drop
iifname "enp0s3" jump filter_FWD_internaliifname "enp0s3" oifname "enp0s2" accept
iifname "enp0s3" drop
iifname "enp0s2" oifname "docker0" jump filter_FWD_public iifname "enp0s2" oifname "docker0" reject with icmpx admin-prohibited iifname "enp0s2" oifname "enp0s3" jump filter_FWD_publiciifname "enp0s3" accept
Is it expected? Is it documented anywhere?
Yes. Permissive zones (those with --set-target=ACCEPT) also allow packets in the forwarding path.
See "The Exceptions" in this blog:
https://firewalld.org/2021/06/the-upcoming-1-0-0
I thought we also had it documented in man pages, but I couldn't find it. Perhaps we should improve the firewall-cmd man page for --set-target.
firewalld-users@lists.fedorahosted.org