On Fri, Sep 11, 2020 at 08:27:54PM -0000, Jason Long wrote:
Hello,
I have a web server that port 22,80 and 443 of it is opened in firewalld, I added below
rules and lost everything:
# firewall-cmd --permanent --direct --add-rule \
ipv4 filter INPUT 0 -j NFQUEUE
# firewall-cmd --permanent --direct --add-rule \
ipv4 filter OUTPUT 0 -j NFQUEUE
AFAIK, NFQUEUE action holds the packet and sends a copy to userspace.
Userspace must issue a verdict. If no userspace is listening to NF_QUEUE
then the packets will be dropped. So your traffic being dropped makes
sense.
Maybe add the `--queue-bypass` options. With this if no userspace is
listening the packet will be accepted instead of dropped.
# firewall-cmd --reload
I can't connect to my server and my web site take down too. How can I correct or
delete these rules?
Two options:
1. Use firewall-offline-cmd
```
# firewall-offline-cmd --direct --remove-rule ipv4 filter INPUT 0 -j NFQUEUE
# firewall-offline-cmd --direct --remove-rule ipv4 filter OUTPUT 0 -j NFQUEUE
```
2. manually edit `/etc/firewalld/direct.xml`
- remove the direct XML elements that correspond to your direct
rules above