Good morning everyone I have a problem with firewalld on any distro I try from debian to ubuntu, including fedora. The problem is this: I configure all the firewalld from terminal I open all the ports I need to test if I surf like ‘https’ http’ and I don't open “dns” and “dns-over-tls” so logically I shouldn't surf the internet and instead, after making the settings permanent and reloading the firewalld, I surf anyway. So I was wondering: is there something I'm missing about how to configure the firewalld, or is there actually some bug in it?
P.S. I have also blocked all incoming and outgoing traffic, but I still surf.
Am 03.10.2024 um 10:39:41 Uhr schrieb Biagio Vittorioso via firewalld-users:
Good morning everyone I have a problem with firewalld on any distro I try from debian to ubuntu, including fedora. The problem is this: I configure all the firewalld from terminal I open all the ports I need to test if I surf like ‘https’ http’ and I don't open “dns” and “dns-over-tls” so logically I shouldn't surf the internet and instead, after making the settings permanent and reloading the firewalld, I surf anyway. So I was wondering: is there something I'm missing about how to configure the firewalld, or is there actually some bug in it?
Browsing the internet needs outgoing traffic and allowing "related" incoming traffic. That is the default.
Post firewall-cmd --list-all
If you don't want to allow port 80/443 and DNS, you have to block that outgoing.
To surf the internet, DNS resolution can be done via normal unicast DNS, but also DNS over HTTPS inside the browser.
Hello then, I have created a ‘bunker’ zone and this is the configuration I made at chatgpt's suggestion: bunker (active) target: DROP icmp-block-inversion: yes interfaces: wlp2s0 sources: services: ports: protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: rule family="ipv6" destination address="::/0" drop rule family="ipv6" source address="::/0" drop rule family="ipv4" source address="0.0.0.0/0" drop rule family="ipv4" destination address="0.0.0.0/0" drop
Am 03.10.2024 um 15:18:01 Uhr schrieb Biagio Vittorioso via firewalld-users:
bunker (active) target: DROP icmp-block-inversion: yes interfaces: wlp2s0 sources: services: ports: protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: rule family="ipv6" destination address="::/0" drop rule family="ipv6" source address="::/0" drop rule family="ipv4" source address="0.0.0.0/0" drop rule family="ipv4" destination address="0.0.0.0/0" drop
Do you have other active interfaces? sudo firewall-cmd --list-interfaces
On Thu, Oct 03, 2024 at 03:18:01PM -0000, Biagio Vittorioso via firewalld-users wrote:
Hello then, I have created a ‘bunker’ zone and this is the configuration I made at chatgpt's suggestion: bunker (active) target: DROP icmp-block-inversion: yes interfaces: wlp2s0 sources: services: ports: protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: rule family="ipv6" destination address="::/0" drop rule family="ipv6" source address="::/0" drop rule family="ipv4" source address="0.0.0.0/0" drop rule family="ipv4" destination address="0.0.0.0/0" drop
These rich rules are redundant with "target: DROP".
The "bunker" zone will drop traffic _incoming_ to the host. To drop outgoing traffic you must use a policy.
Please read the concepts page:
firewalld-users@lists.fedorahosted.org
-
Biagio Vittorioso -
Eric Garver -
Marco Moock