Hello firewalld Community,
I'm trying to understand how the to-addr feature works in firewalld. I haven’t found much information in the documentation.We use RHEL 9 and have firewalld version 1.2.1.We have an interface with a primary IP and other secondary IPs. The scenario is as follows: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 50:6b:8d:d8:2d:84 brd ff:ff:ff:ff:ff:ff altname enp0s3 inet 10.104.112.5/24 brd 10.104.112.255 scope global noprefixroute ens3 valid_lft forever preferred_lft forever inet 10.104.112.8/32 brd 10.104.112.255 scope global ens3 valid_lft forever preferred_lft forever
10.104.112.5 is the machine's primary IP, while 10.104.112.8 is a floating IP managed by Pacemaker.
We tried adding a rule like this: rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
By doing this, we noticed that the request is always forwarded to the machine’s primary IP, i.e., 10.104.112.5.However, I expected it to be forwarded to the IP 10.104.112.9.
How is the IP to forward the request to actually decided?The only way I see to force it to 10.104.112.9 is by specifying to-addr=10.104.112.9.
In CentOS 7 with firewalld version 0.6, by specifying only the rule: rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
without specifying to-addr, the request is correctly forwarded to IP 10.104.112.9.
Could anyone provide me with more information?
Thanks in advance.
Hamado Dene
On Wed, Oct 30, 2024 at 1:09 PM Hamado Dene via firewalld-users firewalld-users@lists.fedorahosted.org wrote:
Hello firewalld Community,
I'm trying to understand how the to-addr feature works in firewalld. I haven’t found much information in the documentation. We use RHEL 9 and have firewalld version 1.2.1. We have an interface with a primary IP and other secondary IPs. The scenario is as follows:
ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 50:6b:8d:d8:2d:84 brd ff:ff:ff:ff:ff:ff altname enp0s3 inet 10.104.112.5/24 brd 10.104.112.255 scope global noprefixroute ens3 valid_lft forever preferred_lft forever inet 10.104.112.8/32 brd 10.104.112.255 scope global ens3 valid_lft forever preferred_lft forever
10.104.112.5 is the machine's primary IP, while 10.104.112.8 is a floating IP managed by Pacemaker.
We tried adding a rule like this:
rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
By doing this, we noticed that the request is always forwarded to the machine’s primary IP, i.e., 10.104.112.5. However, I expected it to be forwarded to the IP 10.104.112.9.
"destination address" is used to match packets to which rule is applied, not to set address to forward packets to.
How is the IP to forward the request to actually decided? The only way I see to force it to 10.104.112.9 is by specifying to-addr=10.104.112.9.
In CentOS 7 with firewalld version 0.6, by specifying only the rule:
rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
without specifying to-addr, the request is correctly forwarded to IP 10.104.112.9.
Could anyone provide me with more information?
Thanks in advance.
Hamado Dene
firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Yet, it makes sense. But, ff to-addr is not specified, how is it decided which IP on the interface the request is forwarded to (considering the interface has multiple IP addresses)?
Hamado Dene
Il mercoledì 30 ottobre 2024 alle ore 11:35:29 CET, Andrei Borzenkov via firewalld-users firewalld-users@lists.fedorahosted.org ha scritto:
On Wed, Oct 30, 2024 at 1:09 PM Hamado Dene via firewalld-users firewalld-users@lists.fedorahosted.org wrote:
Hello firewalld Community,
I'm trying to understand how the to-addr feature works in firewalld. I haven’t found much information in the documentation. We use RHEL 9 and have firewalld version 1.2.1. We have an interface with a primary IP and other secondary IPs. The scenario is as follows:
ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 50:6b:8d:d8:2d:84 brd ff:ff:ff:ff:ff:ff altname enp0s3 inet 10.104.112.5/24 brd 10.104.112.255 scope global noprefixroute ens3 valid_lft forever preferred_lft forever inet 10.104.112.8/32 brd 10.104.112.255 scope global ens3 valid_lft forever preferred_lft forever
10.104.112.5 is the machine's primary IP, while 10.104.112.8 is a floating IP managed by Pacemaker.
We tried adding a rule like this:
rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
By doing this, we noticed that the request is always forwarded to the machine’s primary IP, i.e., 10.104.112.5. However, I expected it to be forwarded to the IP 10.104.112.9.
"destination address" is used to match packets to which rule is applied, not to set address to forward packets to.
How is the IP to forward the request to actually decided? The only way I see to force it to 10.104.112.9 is by specifying to-addr=10.104.112.9.
In CentOS 7 with firewalld version 0.6, by specifying only the rule:
rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
without specifying to-addr, the request is correctly forwarded to IP 10.104.112.9.
Could anyone provide me with more information?
Thanks in advance.
Hamado Dene
firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
On Wed, Oct 30, 2024 at 1:53 PM Hamado Dene hamadodene@yahoo.com wrote:
Yet, it makes sense. But, ff to-addr is not specified, how is it decided which IP on the interface the request is forwarded to
Destination address in packets is not changed, so whatever destination address this packet has.
(considering the interface has multiple IP addresses)?
Hamado Dene
Il mercoledì 30 ottobre 2024 alle ore 11:35:29 CET, Andrei Borzenkov via firewalld-users firewalld-users@lists.fedorahosted.org ha scritto:
On Wed, Oct 30, 2024 at 1:09 PM Hamado Dene via firewalld-users firewalld-users@lists.fedorahosted.org wrote:
Hello firewalld Community,
I'm trying to understand how the to-addr feature works in firewalld. I haven’t found much information in the documentation. We use RHEL 9 and have firewalld version 1.2.1. We have an interface with a primary IP and other secondary IPs. The scenario is as follows:
ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 50:6b:8d:d8:2d:84 brd ff:ff:ff:ff:ff:ff altname enp0s3 inet 10.104.112.5/24 brd 10.104.112.255 scope global noprefixroute ens3 valid_lft forever preferred_lft forever inet 10.104.112.8/32 brd 10.104.112.255 scope global ens3 valid_lft forever preferred_lft forever
10.104.112.5 is the machine's primary IP, while 10.104.112.8 is a floating IP managed by Pacemaker.
We tried adding a rule like this:
rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
By doing this, we noticed that the request is always forwarded to the machine’s primary IP, i.e., 10.104.112.5. However, I expected it to be forwarded to the IP 10.104.112.9.
"destination address" is used to match packets to which rule is applied, not to set address to forward packets to.
How is the IP to forward the request to actually decided? The only way I see to force it to 10.104.112.9 is by specifying to-addr=10.104.112.9.
In CentOS 7 with firewalld version 0.6, by specifying only the rule:
rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
without specifying to-addr, the request is correctly forwarded to IP 10.104.112.9.
Could anyone provide me with more information?
Thanks in advance.
Hamado Dene
firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
-- _______________________________________________ firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
From the tests I've done, with destination 10.104.112.8, the packet was routed through the primary IP 10.104.112.5.
The same rule without to-addr on CentOS 7 with firewalld 0.6 is not forwarded correctly, while in version 1.2.1 it isn’t. I'll try to debug further.
As a workaround, I forced it with to-addr
Hamado Dene
Il mercoledì 30 ottobre 2024 alle ore 12:07:34 CET, Andrei Borzenkov via firewalld-users firewalld-users@lists.fedorahosted.org ha scritto:
On Wed, Oct 30, 2024 at 1:53 PM Hamado Dene hamadodene@yahoo.com wrote:
Yet, it makes sense. But, ff to-addr is not specified, how is it decided which IP on the interface the request is forwarded to
Destination address in packets is not changed, so whatever destination address this packet has.
(considering the interface has multiple IP addresses)?
Hamado Dene
Il mercoledì 30 ottobre 2024 alle ore 11:35:29 CET, Andrei Borzenkov via firewalld-users firewalld-users@lists.fedorahosted.org ha scritto:
On Wed, Oct 30, 2024 at 1:09 PM Hamado Dene via firewalld-users firewalld-users@lists.fedorahosted.org wrote:
Hello firewalld Community,
I'm trying to understand how the to-addr feature works in firewalld. I haven’t found much information in the documentation. We use RHEL 9 and have firewalld version 1.2.1. We have an interface with a primary IP and other secondary IPs. The scenario is as follows:
ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 50:6b:8d:d8:2d:84 brd ff:ff:ff:ff:ff:ff altname enp0s3 inet 10.104.112.5/24 brd 10.104.112.255 scope global noprefixroute ens3 valid_lft forever preferred_lft forever inet 10.104.112.8/32 brd 10.104.112.255 scope global ens3 valid_lft forever preferred_lft forever
10.104.112.5 is the machine's primary IP, while 10.104.112.8 is a floating IP managed by Pacemaker.
We tried adding a rule like this:
rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
By doing this, we noticed that the request is always forwarded to the machine’s primary IP, i.e., 10.104.112.5. However, I expected it to be forwarded to the IP 10.104.112.9.
"destination address" is used to match packets to which rule is applied, not to set address to forward packets to.
How is the IP to forward the request to actually decided? The only way I see to force it to 10.104.112.9 is by specifying to-addr=10.104.112.9.
In CentOS 7 with firewalld version 0.6, by specifying only the rule:
rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
without specifying to-addr, the request is correctly forwarded to IP 10.104.112.9.
Could anyone provide me with more information?
Thanks in advance.
Hamado Dene
firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
-- _______________________________________________ firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
On Wed, Oct 30, 2024 at 11:33:50AM +0000, Hamado Dene via firewalld-users wrote:
From the tests I've done, with destination 10.104.112.8, the packet was routed through the primary IP 10.104.112.5.
The same rule without to-addr on CentOS 7 with firewalld 0.6 is not forwarded correctly, while in version 1.2.1 it isn’t. I'll try to debug further.
Without "to-addr" the packet will be redirected to the local host. It will not be forwarded.
Quoting the nft man page:
The redirect statement is a special form of dnat which always translates the destination address to the local host’s one. It comes in handy if one only wants to alter the destination port of incoming traffic on different interfaces.
As a workaround, I forced it with to-addr
Hamado Dene
Il mercoledì 30 ottobre 2024 alle ore 12:07:34 CET, Andrei Borzenkov via firewalld-users <firewalld-users@lists.fedorahosted.org> ha scritto:On Wed, Oct 30, 2024 at 1:53 PM Hamado Dene hamadodene@yahoo.com wrote:
Yet, it makes sense. But, ff to-addr is not specified, how is it decided which IP on the interface the request is forwarded to
Destination address in packets is not changed, so whatever destination address this packet has.
(considering the interface has multiple IP addresses)?
Hamado Dene
Il mercoledì 30 ottobre 2024 alle ore 11:35:29 CET, Andrei Borzenkov via firewalld-users firewalld-users@lists.fedorahosted.org ha scritto:
On Wed, Oct 30, 2024 at 1:09 PM Hamado Dene via firewalld-users firewalld-users@lists.fedorahosted.org wrote:
Hello firewalld Community,
I'm trying to understand how the to-addr feature works in firewalld. I haven’t found much information in the documentation. We use RHEL 9 and have firewalld version 1.2.1. We have an interface with a primary IP and other secondary IPs. The scenario is as follows:
ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 50:6b:8d:d8:2d:84 brd ff:ff:ff:ff:ff:ff altname enp0s3 inet 10.104.112.5/24 brd 10.104.112.255 scope global noprefixroute ens3 valid_lft forever preferred_lft forever inet 10.104.112.8/32 brd 10.104.112.255 scope global ens3 valid_lft forever preferred_lft forever
10.104.112.5 is the machine's primary IP, while 10.104.112.8 is a floating IP managed by Pacemaker.
We tried adding a rule like this:
rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
By doing this, we noticed that the request is always forwarded to the machine’s primary IP, i.e., 10.104.112.5. However, I expected it to be forwarded to the IP 10.104.112.9.
"destination address" is used to match packets to which rule is applied, not to set address to forward packets to.
How is the IP to forward the request to actually decided? The only way I see to force it to 10.104.112.9 is by specifying to-addr=10.104.112.9.
In CentOS 7 with firewalld version 0.6, by specifying only the rule:
rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
without specifying to-addr, the request is correctly forwarded to IP 10.104.112.9.
Could anyone provide me with more information?
Thanks in advance.
Hamado Dene
firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
-- _______________________________________________ firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
-- _______________________________________________ firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
-- _______________________________________________ firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
On Wed, Oct 30, 2024 at 2:51 PM Eric Garver egarver@redhat.com wrote:
On Wed, Oct 30, 2024 at 11:33:50AM +0000, Hamado Dene via firewalld-users wrote:
From the tests I've done, with destination 10.104.112.8, the packet was routed through the primary IP 10.104.112.5.
The same rule without to-addr on CentOS 7 with firewalld 0.6 is not forwarded correctly, while in version 1.2.1 it isn’t. I'll try to debug further.
Without "to-addr" the packet will be redirected to the local host. It will not be forwarded.
Quoting the nft man page:
The redirect statement is a special form of dnat which always translates the destination address to the local host’s one. It comes in handy if one only wants to alter the destination port of incoming traffic on different interfaces.
That explicitly breaks compatibility with iptables backend. Discussing nftables behavior is out of scope on this list, but then firewalld should not use nft redirect because its semantic is different from iptables DNAT. Quoting iptables-extensions DNAT man page
If no IP address is specified then *only the destination port will be modified*.
I would say it is a bug in firewalld. It should be using something different. Apparently nftables dnat requires destination IP, the only way to rewrite port without changing destination (as DNAT iptables did) is
nft add rule raw prerouting tcp dport 8080 tcp dport set 80
If it is not feasible, then this needs a big read warning in manual and release notes.
Explanation how "destination address of the local host" is determined in case of multiple addresses would not hurt as well.
As a workaround, I forced it with to-addr
Hamado Dene
Il mercoledì 30 ottobre 2024 alle ore 12:07:34 CET, Andrei Borzenkov via firewalld-users <firewalld-users@lists.fedorahosted.org> ha scritto:On Wed, Oct 30, 2024 at 1:53 PM Hamado Dene hamadodene@yahoo.com wrote:
Yet, it makes sense. But, ff to-addr is not specified, how is it decided which IP on the interface the request is forwarded to
Destination address in packets is not changed, so whatever destination address this packet has.
(considering the interface has multiple IP addresses)?
Hamado Dene
Il mercoledì 30 ottobre 2024 alle ore 11:35:29 CET, Andrei Borzenkov via firewalld-users firewalld-users@lists.fedorahosted.org ha scritto:
On Wed, Oct 30, 2024 at 1:09 PM Hamado Dene via firewalld-users firewalld-users@lists.fedorahosted.org wrote:
Hello firewalld Community,
I'm trying to understand how the to-addr feature works in firewalld. I haven’t found much information in the documentation. We use RHEL 9 and have firewalld version 1.2.1. We have an interface with a primary IP and other secondary IPs. The scenario is as follows:
ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 50:6b:8d:d8:2d:84 brd ff:ff:ff:ff:ff:ff altname enp0s3 inet 10.104.112.5/24 brd 10.104.112.255 scope global noprefixroute ens3 valid_lft forever preferred_lft forever inet 10.104.112.8/32 brd 10.104.112.255 scope global ens3 valid_lft forever preferred_lft forever
10.104.112.5 is the machine's primary IP, while 10.104.112.8 is a floating IP managed by Pacemaker.
We tried adding a rule like this:
rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
By doing this, we noticed that the request is always forwarded to the machine’s primary IP, i.e., 10.104.112.5. However, I expected it to be forwarded to the IP 10.104.112.9.
"destination address" is used to match packets to which rule is applied, not to set address to forward packets to.
How is the IP to forward the request to actually decided? The only way I see to force it to 10.104.112.9 is by specifying to-addr=10.104.112.9.
In CentOS 7 with firewalld version 0.6, by specifying only the rule:
rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
without specifying to-addr, the request is correctly forwarded to IP 10.104.112.9.
Could anyone provide me with more information?
Thanks in advance.
Hamado Dene
firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
-- _______________________________________________ firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
-- _______________________________________________ firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
-- _______________________________________________ firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
I agree with Andrei... The most logical thing, in my opinion, would be to add a warning to the documentation that specifies this behavior so that users are aware of it.
I am new to this mailing list. In this case, how do we proceed? Should we open an issue on GitHub or start a thread on the dev mailing list to address this case?
Hamado Dene
Il mercoledì 30 ottobre 2024 alle ore 13:59:52 CET, Andrei Borzenkov via firewalld-users firewalld-users@lists.fedorahosted.org ha scritto:
On Wed, Oct 30, 2024 at 2:51 PM Eric Garver egarver@redhat.com wrote:
On Wed, Oct 30, 2024 at 11:33:50AM +0000, Hamado Dene via firewalld-users wrote:
From the tests I've done, with destination 10.104.112.8, the packet was routed through the primary IP 10.104.112.5.
The same rule without to-addr on CentOS 7 with firewalld 0.6 is not forwarded correctly, while in version 1.2.1 it isn’t. I'll try to debug further.
Without "to-addr" the packet will be redirected to the local host. It will not be forwarded.
Quoting the nft man page:
The redirect statement is a special form of dnat which always translates the destination address to the local host’s one. It comes in handy if one only wants to alter the destination port of incoming traffic on different interfaces.
That explicitly breaks compatibility with iptables backend. Discussing nftables behavior is out of scope on this list, but then firewalld should not use nft redirect because its semantic is different from iptables DNAT. Quoting iptables-extensions DNAT man page
If no IP address is specified then *only the destination port will be modified*.
I would say it is a bug in firewalld. It should be using something different. Apparently nftables dnat requires destination IP, the only way to rewrite port without changing destination (as DNAT iptables did) is
nft add rule raw prerouting tcp dport 8080 tcp dport set 80
If it is not feasible, then this needs a big read warning in manual and release notes.
Explanation how "destination address of the local host" is determined in case of multiple addresses would not hurt as well.
As a workaround, I forced it with to-addr
Hamado Dene
Il mercoledì 30 ottobre 2024 alle ore 12:07:34 CET, Andrei Borzenkov via firewalld-users firewalld-users@lists.fedorahosted.org ha scritto:
On Wed, Oct 30, 2024 at 1:53 PM Hamado Dene hamadodene@yahoo.com wrote:
Yet, it makes sense. But, ff to-addr is not specified, how is it decided which IP on the interface the request is forwarded to
Destination address in packets is not changed, so whatever destination address this packet has.
(considering the interface has multiple IP addresses)?
Hamado Dene
Il mercoledì 30 ottobre 2024 alle ore 11:35:29 CET, Andrei Borzenkov via firewalld-users firewalld-users@lists.fedorahosted.org ha scritto:
On Wed, Oct 30, 2024 at 1:09 PM Hamado Dene via firewalld-users firewalld-users@lists.fedorahosted.org wrote:
Hello firewalld Community,
I'm trying to understand how the to-addr feature works in firewalld. I haven’t found much information in the documentation. We use RHEL 9 and have firewalld version 1.2.1. We have an interface with a primary IP and other secondary IPs. The scenario is as follows:
ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 50:6b:8d:d8:2d:84 brd ff:ff:ff:ff:ff:ff altname enp0s3 inet 10.104.112.5/24 brd 10.104.112.255 scope global noprefixroute ens3 valid_lft forever preferred_lft forever inet 10.104.112.8/32 brd 10.104.112.255 scope global ens3 valid_lft forever preferred_lft forever
10.104.112.5 is the machine's primary IP, while 10.104.112.8 is a floating IP managed by Pacemaker.
We tried adding a rule like this:
rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
By doing this, we noticed that the request is always forwarded to the machine’s primary IP, i.e., 10.104.112.5. However, I expected it to be forwarded to the IP 10.104.112.9.
"destination address" is used to match packets to which rule is applied, not to set address to forward packets to.
How is the IP to forward the request to actually decided? The only way I see to force it to 10.104.112.9 is by specifying to-addr=10.104.112.9.
In CentOS 7 with firewalld version 0.6, by specifying only the rule:
rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
without specifying to-addr, the request is correctly forwarded to IP 10.104.112.9.
Could anyone provide me with more information?
Thanks in advance.
Hamado Dene
firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
-- _______________________________________________ firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
-- _______________________________________________ firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
-- _______________________________________________ firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
On Wed, Oct 30, 2024 at 01:29:27PM +0000, Hamado Dene wrote:
I agree with Andrei... The most logical thing, in my opinion, would be to add a warning to the documentation that specifies this behavior so that users are aware of it.
I am new to this mailing list. In this case, how do we proceed? Should we open an issue on GitHub or start a thread on the dev mailing list to address this case?
Please open an issue on github. We can discuss and make a decision there.
Hamado Dene
Il mercoledì 30 ottobre 2024 alle ore 13:59:52 CET, Andrei Borzenkov via firewalld-users <firewalld-users@lists.fedorahosted.org> ha scritto:On Wed, Oct 30, 2024 at 2:51 PM Eric Garver egarver@redhat.com wrote:
On Wed, Oct 30, 2024 at 11:33:50AM +0000, Hamado Dene via firewalld-users wrote:
From the tests I've done, with destination 10.104.112.8, the packet was routed through the primary IP 10.104.112.5.
The same rule without to-addr on CentOS 7 with firewalld 0.6 is not forwarded correctly, while in version 1.2.1 it isn’t. I'll try to debug further.
Without "to-addr" the packet will be redirected to the local host. It will not be forwarded.
Quoting the nft man page:
The redirect statement is a special form of dnat which always translates the destination address to the local host’s one. It comes in handy if one only wants to alter the destination port of incoming traffic on different interfaces.
That explicitly breaks compatibility with iptables backend. Discussing nftables behavior is out of scope on this list, but then firewalld should not use nft redirect because its semantic is different from iptables DNAT. Quoting iptables-extensions DNAT man page
If no IP address is specified then *only the destination port will be modified*.
I would say it is a bug in firewalld. It should be using something different. Apparently nftables dnat requires destination IP, the only way to rewrite port without changing destination (as DNAT iptables did) is
nft add rule raw prerouting tcp dport 8080 tcp dport set 80
If it is not feasible, then this needs a big read warning in manual and release notes.
Explanation how "destination address of the local host" is determined in case of multiple addresses would not hurt as well.
As a workaround, I forced it with to-addr
Hamado Dene
Il mercoledì 30 ottobre 2024 alle ore 12:07:34 CET, Andrei Borzenkov via firewalld-users firewalld-users@lists.fedorahosted.org ha scritto:
On Wed, Oct 30, 2024 at 1:53 PM Hamado Dene hamadodene@yahoo.com wrote:
Yet, it makes sense. But, ff to-addr is not specified, how is it decided which IP on the interface the request is forwarded to
Destination address in packets is not changed, so whatever destination address this packet has.
(considering the interface has multiple IP addresses)?
Hamado Dene
Il mercoledì 30 ottobre 2024 alle ore 11:35:29 CET, Andrei Borzenkov via firewalld-users firewalld-users@lists.fedorahosted.org ha scritto:
On Wed, Oct 30, 2024 at 1:09 PM Hamado Dene via firewalld-users firewalld-users@lists.fedorahosted.org wrote:
Hello firewalld Community,
I'm trying to understand how the to-addr feature works in firewalld. I haven’t found much information in the documentation. We use RHEL 9 and have firewalld version 1.2.1. We have an interface with a primary IP and other secondary IPs. The scenario is as follows:
ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 50:6b:8d:d8:2d:84 brd ff:ff:ff:ff:ff:ff altname enp0s3 inet 10.104.112.5/24 brd 10.104.112.255 scope global noprefixroute ens3 valid_lft forever preferred_lft forever inet 10.104.112.8/32 brd 10.104.112.255 scope global ens3 valid_lft forever preferred_lft forever
10.104.112.5 is the machine's primary IP, while 10.104.112.8 is a floating IP managed by Pacemaker.
We tried adding a rule like this:
rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
By doing this, we noticed that the request is always forwarded to the machine’s primary IP, i.e., 10.104.112.5. However, I expected it to be forwarded to the IP 10.104.112.9.
"destination address" is used to match packets to which rule is applied, not to set address to forward packets to.
How is the IP to forward the request to actually decided? The only way I see to force it to 10.104.112.9 is by specifying to-addr=10.104.112.9.
In CentOS 7 with firewalld version 0.6, by specifying only the rule:
rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
without specifying to-addr, the request is correctly forwarded to IP 10.104.112.9.
Could anyone provide me with more information?
Thanks in advance.
Hamado Dene
firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
-- _______________________________________________ firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
-- _______________________________________________ firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
-- _______________________________________________ firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
-- _______________________________________________ firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
I open issue github.com/firewalld/firewalld/issues/1413
Thanks,
Hamado Dene
Il mercoledì 30 ottobre 2024 alle ore 17:55:29 CET, Eric Garver via firewalld-users firewalld-users@lists.fedorahosted.org ha scritto:
On Wed, Oct 30, 2024 at 01:29:27PM +0000, Hamado Dene wrote:
I agree with Andrei... The most logical thing, in my opinion, would be to add a warning to the documentation that specifies this behavior so that users are aware of it.
I am new to this mailing list. In this case, how do we proceed? Should we open an issue on GitHub or start a thread on the dev mailing list to address this case?
Please open an issue on github. We can discuss and make a decision there.
Hamado Dene
Il mercoledì 30 ottobre 2024 alle ore 13:59:52 CET, Andrei Borzenkov via firewalld-users firewalld-users@lists.fedorahosted.org ha scritto: On Wed, Oct 30, 2024 at 2:51 PM Eric Garver egarver@redhat.com wrote:
On Wed, Oct 30, 2024 at 11:33:50AM +0000, Hamado Dene via firewalld-users wrote:
From the tests I've done, with destination 10.104.112.8, the packet was routed through the primary IP 10.104.112.5.
The same rule without to-addr on CentOS 7 with firewalld 0.6 is not forwarded correctly, while in version 1.2.1 it isn’t. I'll try to debug further.
Without "to-addr" the packet will be redirected to the local host. It will not be forwarded.
Quoting the nft man page:
The redirect statement is a special form of dnat which always translates the destination address to the local host’s one. It comes in handy if one only wants to alter the destination port of incoming traffic on different interfaces.
That explicitly breaks compatibility with iptables backend. Discussing nftables behavior is out of scope on this list, but then firewalld should not use nft redirect because its semantic is different from iptables DNAT. Quoting iptables-extensions DNAT man page
If no IP address is specified then *only the destination port will be modified*.
I would say it is a bug in firewalld. It should be using something different. Apparently nftables dnat requires destination IP, the only way to rewrite port without changing destination (as DNAT iptables did) is
nft add rule raw prerouting tcp dport 8080 tcp dport set 80
If it is not feasible, then this needs a big read warning in manual and release notes.
Explanation how "destination address of the local host" is determined in case of multiple addresses would not hurt as well.
As a workaround, I forced it with to-addr
Hamado Dene
Il mercoledì 30 ottobre 2024 alle ore 12:07:34 CET, Andrei Borzenkov via firewalld-users firewalld-users@lists.fedorahosted.org ha scritto:
On Wed, Oct 30, 2024 at 1:53 PM Hamado Dene hamadodene@yahoo.com wrote:
Yet, it makes sense. But, ff to-addr is not specified, how is it decided which IP on the interface the request is forwarded to
Destination address in packets is not changed, so whatever destination address this packet has.
(considering the interface has multiple IP addresses)?
Hamado Dene
Il mercoledì 30 ottobre 2024 alle ore 11:35:29 CET, Andrei Borzenkov via firewalld-users firewalld-users@lists.fedorahosted.org ha scritto:
On Wed, Oct 30, 2024 at 1:09 PM Hamado Dene via firewalld-users firewalld-users@lists.fedorahosted.org wrote:
Hello firewalld Community,
I'm trying to understand how the to-addr feature works in firewalld. I haven’t found much information in the documentation. We use RHEL 9 and have firewalld version 1.2.1. We have an interface with a primary IP and other secondary IPs. The scenario is as follows:
ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 50:6b:8d:d8:2d:84 brd ff:ff:ff:ff:ff:ff altname enp0s3 inet 10.104.112.5/24 brd 10.104.112.255 scope global noprefixroute ens3 valid_lft forever preferred_lft forever inet 10.104.112.8/32 brd 10.104.112.255 scope global ens3 valid_lft forever preferred_lft forever
10.104.112.5 is the machine's primary IP, while 10.104.112.8 is a floating IP managed by Pacemaker.
We tried adding a rule like this:
rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
By doing this, we noticed that the request is always forwarded to the machine’s primary IP, i.e., 10.104.112.5. However, I expected it to be forwarded to the IP 10.104.112.9.
"destination address" is used to match packets to which rule is applied, not to set address to forward packets to.
How is the IP to forward the request to actually decided? The only way I see to force it to 10.104.112.9 is by specifying to-addr=10.104.112.9.
In CentOS 7 with firewalld version 0.6, by specifying only the rule:
rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
without specifying to-addr, the request is correctly forwarded to IP 10.104.112.9.
Could anyone provide me with more information?
Thanks in advance.
Hamado Dene
firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
-- _______________________________________________ firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
-- _______________________________________________ firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
-- _______________________________________________ firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
-- _______________________________________________ firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
On Wed, Oct 30, 2024 at 03:59:31PM +0300, Andrei Borzenkov wrote:
On Wed, Oct 30, 2024 at 2:51 PM Eric Garver egarver@redhat.com wrote:
On Wed, Oct 30, 2024 at 11:33:50AM +0000, Hamado Dene via firewalld-users wrote:
From the tests I've done, with destination 10.104.112.8, the packet was routed through the primary IP 10.104.112.5.
The same rule without to-addr on CentOS 7 with firewalld 0.6 is not forwarded correctly, while in version 1.2.1 it isn’t. I'll try to debug further.
Without "to-addr" the packet will be redirected to the local host. It will not be forwarded.
Quoting the nft man page:
The redirect statement is a special form of dnat which always translates the destination address to the local host’s one. It comes in handy if one only wants to alter the destination port of incoming traffic on different interfaces.
That explicitly breaks compatibility with iptables backend. Discussing nftables behavior is out of scope on this list, but then firewalld should not use nft redirect because its semantic is different from iptables DNAT. Quoting iptables-extensions DNAT man page
That presumes firewalld wants to behave like iptables. The iptables backend is deprecated so matching the behavior of the iptables backend is not necessary.
The question should be: what behavior do we want?
Then we need to document it better.
If no IP address is specified then *only the destination port will be modified*.
I would say it is a bug in firewalld. It should be using something different. Apparently nftables dnat requires destination IP, the only way to rewrite port without changing destination (as DNAT iptables did) is
nft add rule raw prerouting tcp dport 8080 tcp dport set 80
If it is not feasible, then this needs a big read warning in manual and release notes.
Explanation how "destination address of the local host" is determined in case of multiple addresses would not hurt as well.
As a workaround, I forced it with to-addr
Hamado Dene
Il mercoledì 30 ottobre 2024 alle ore 12:07:34 CET, Andrei Borzenkov via firewalld-users <firewalld-users@lists.fedorahosted.org> ha scritto:On Wed, Oct 30, 2024 at 1:53 PM Hamado Dene hamadodene@yahoo.com wrote:
Yet, it makes sense. But, ff to-addr is not specified, how is it decided which IP on the interface the request is forwarded to
Destination address in packets is not changed, so whatever destination address this packet has.
(considering the interface has multiple IP addresses)?
Hamado Dene
Il mercoledì 30 ottobre 2024 alle ore 11:35:29 CET, Andrei Borzenkov via firewalld-users firewalld-users@lists.fedorahosted.org ha scritto:
On Wed, Oct 30, 2024 at 1:09 PM Hamado Dene via firewalld-users firewalld-users@lists.fedorahosted.org wrote:
Hello firewalld Community,
I'm trying to understand how the to-addr feature works in firewalld. I haven’t found much information in the documentation. We use RHEL 9 and have firewalld version 1.2.1. We have an interface with a primary IP and other secondary IPs. The scenario is as follows:
ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 50:6b:8d:d8:2d:84 brd ff:ff:ff:ff:ff:ff altname enp0s3 inet 10.104.112.5/24 brd 10.104.112.255 scope global noprefixroute ens3 valid_lft forever preferred_lft forever inet 10.104.112.8/32 brd 10.104.112.255 scope global ens3 valid_lft forever preferred_lft forever
10.104.112.5 is the machine's primary IP, while 10.104.112.8 is a floating IP managed by Pacemaker.
We tried adding a rule like this:
rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
By doing this, we noticed that the request is always forwarded to the machine’s primary IP, i.e., 10.104.112.5. However, I expected it to be forwarded to the IP 10.104.112.9.
"destination address" is used to match packets to which rule is applied, not to set address to forward packets to.
How is the IP to forward the request to actually decided? The only way I see to force it to 10.104.112.9 is by specifying to-addr=10.104.112.9.
In CentOS 7 with firewalld version 0.6, by specifying only the rule:
rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
without specifying to-addr, the request is correctly forwarded to IP 10.104.112.9.
Could anyone provide me with more information?
Thanks in advance.
Hamado Dene
firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
-- _______________________________________________ firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
-- _______________________________________________ firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
-- _______________________________________________ firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
firewalld-users@lists.fedorahosted.org
-
Andrei Borzenkov -
Eric Garver -
Hamado Dene