On Sun, Nov 08, 2020 at 02:03:37AM -0000, Robert Smuhar wrote:
Hi, I'm struggling to set up firewalld to pass traffic between 2
networks. Is this possible with firewalld?
Until v0.9.0 firewalld was effectively an end station firewall. This
means it did not support FORWARD filtering.
My lab setup is:
Server (ens192:192.168.3.2) <-> (ens224:192.168.3.1) firewall
(ens192:192.168.110.8) <-> (ens192:192.168.110.9) client
Freshly installed CentOS 8.2 (2004), server installation with no GUI on all 3 VMs.
[root@firewall ~]# sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1
Client can ping Server
[root@client ~]# ping -c 3 192.168.3.2
PING 192.168.3.2 (192.168.3.2) 56(84) bytes of data.
64 bytes from 192.168.3.2: icmp_seq=1 ttl=63 time=0.530 ms
64 bytes from 192.168.3.2: icmp_seq=2 ttl=63 time=0.552 ms
64 bytes from 192.168.3.2: icmp_seq=3 ttl=63 time=0.444 ms
ICMP works because zones with a target of "default" will explicitly
allow FORWARDed ICMP packets.
Client can't get to the server's ssh port.
[root@client ~]# nc 192.168.3.2 22
Ncat: No route to host.
However, SSH is dropped because there are on FORWARD rules to allow it.
Older firewalld versions do _not_ support FORWARD filtering.
[root@firewall ~]# systemctl stop firewalld
[root@client ~]# nc 192.168.3.2 22
SSH-2.0-OpenSSH_8.0
So far things are working as expected.
I configure firewalld as follows:
[root@firewall ~]# systemctl start firewalld
[root@firewall ~]# firewall-cmd --version
0.8.0
[root@firewall ~]# firewall-cmd --zone=public --remove-interface=ens192
success
[root@firewall ~]# firewall-cmd --zone=public --remove-interface=ens224
success
[root@firewall ~]# firewall-cmd --zone=dmz --add-interface=ens224
success
[root@firewall ~]# firewall-cmd --zone=internal --add-interface=ens192
success
[root@firewall ~]# firewall-cmd --zone=internal --add-rich-rule='rule family=ipv4
source address=192.168.110.9/32 destination address=192.168.3.2/32 service name=ssh
accept'
success
rich rules added to a zone will filter on the INPUT. It will _not_
filter FORWARDed packets.
[root@firewall ~]# firewall-cmd --zone=internal --list-all
internal (active)
target: default
icmp-block-inversion: no
interfaces: ens192
sources:
services: cockpit dhcpv6-client mdns samba-client ssh
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family="ipv4" source address="192.168.110.9/32" destination
address="192.168.3.2/32" service name="ssh" accept
[root@firewall ~]# firewall-cmd --zone=dmz --list-all
dmz (active)
target: default
icmp-block-inversion: no
interfaces: ens224
sources:
services: ssh
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
[root@client ~]# nc 192.168.3.2 22
Ncat: No route to host.
Shouldn't this work? What am I missing?
No. Newer firewalld version have native support for FORWARD and OUTPUT
filtering.
See these posts:
-
https://firewalld.org/2020/09/policy-objects-introduction
-
https://firewalld.org/2020/09/policy-objects-filtering-container-and-vm-t...