Hello,

On 01/17/2013 10:35 PM, Philippe Marcovici wrote:

Hi.

I try to change the value of the default target by DROP. But change does not seem to have any effect. And after stop / start of firewall-config default target is ACCEPT, again. I tried with an existing zone and a new zone.

please explain what exactly you have done. Where have you changed the default target?

Thanks, Philippe. _______________________________________________ firewalld-users mailing list firewalld-users@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/firewalld-users

Thanks, Thomas

On 01/23/2013 11:57 PM, Philippe Marcovici wrote:

Hello.

Ok, i use a french tuto to explain it (i am working on it).

With firewall-config :

• I change for "permanent configuration" :

http://doc.fedora-fr.org/wiki/Parefeu_-_firewall_-_FirewallD#Vue_en_cours_-_...

• I select "public zone"
• And there,

http://doc.fedora-fr.org/wiki/Parefeu_-_firewall_-_FirewallD#Ic.C3.B4nes_zon...,

• i click on the second icon (modify a zone),
• i uncheck "target" (default target),
• i change "ACCEPT" by "DROP".
• i check "target" (default target) (or not, it's the same),
• i click on "validation".
• I do "File>Quit".

Nothing is changed (iptables -v -n -L).

Permanent changes become active after reload/restart, but yes, there seems to be a bug, I can see the following lines in log:

DEBUG1: Loading zone file '/etc/firewalld/zones/public.xml' DEBUG1: Overloads zone 'public' ('/usr/lib/firewalld/zones/public.xml') ... DEBUG2: firewall.core.ipXtables.ip4tables: /sbin/iptables -A DROP_allow -t filter -m udp -p udp --dport 5353 -d 224.0.0.251 -m conntrack --ctstate NEW -j ACCEPT ERROR: '/sbin/iptables -A DROP_allow -t filter -m udp -p udp --dport 5353 -d 224.0.0.251 -m conntrack --ctstate NEW -j ACCEPT' failed: iptables: No chain/target/match by that name.

-- Jiri

Thanks.

Philippe.

----- Mail original ----- De: "Jiri Popelka" jpopelka@redhat.com À: "Firewalld users discussion list" firewalld-users@lists.fedorahosted.org Envoyé: Jeudi 24 Janvier 2013 17:58:33 Objet: Re: how to use the default target?

On 01/24/2013 10:43 AM, Jiri Popelka wrote:

ERROR: '/sbin/iptables -A DROP_allow -t filter -m udp -p udp --dport 5353 -d 224.0.0.251 -m conntrack --ctstate NEW -j ACCEPT' failed: iptables: No chain/target/match by that name.

I've just fixed this upstream, thanks for the report. http://git.fedorahosted.org/cgit/firewalld.git/commit/?id=be2be66d3d68ed1737...

-- Jiri _______________________________________________ firewalld-users mailing list firewalld-users@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/firewalld-users