Hello Andrei and Eric,
Thank for fast replying. I would like set up two policies, one for input
(ingress ANY/egress HOST) and one for output (ingress HOST/egress ANY),
both have REJECT target.
I have made some research on nftable side and i see "implicit" accept
packet when ctstate is established or related on INPUT chain :
#nft -a list table inet firewalld
chain filter_INPUT { # handle 9
type filter hook input priority filter + 10; policy
accept;
ct state { established, related } accept # handle 13
ct status dnat accept # handle 14
iifname "lo" accept # handle 15
jump filter_INPUT_POLICIES_pre # handle 17
jump filter_INPUT_ZONES # handle 19
jump filter_INPUT_POLICIES_post # handle 21
ct state { invalid } drop # handle 23
reject with icmpx type admin-prohibited # handle 24
}
But no implicit accept is present in OUTPUT chain :
chain filter_OUTPUT { # handle 11
type filter hook output priority filter + 10; policy
accept;
oifname "lo" accept # handle 40
ip6 daddr { ::/96, ::ffff:0.0.0.0/96, 2002::/24,
2002:a00::/24, 2002:7f00::/24, 2002:a9fe::/32, 2002:ac10::/28,
2002:c0a8::/32, 2002:e000::/19 } reject with icmpv6 type
addr-unreachable # handle 49
jump filter_OUTPUT_POLICIES_pre # handle 42
jump filter_OUTPUT_POLICIES_post # handle 44
}
If a port is open in input policy, responses are blocked by the output
policy. If i manually add a nft rule to accept established/related
packets, its work :
nft add rule inet firewalld filter_OUTPUT position 40 ct state {
established, related } accept
Of course, if i reload firewalld configuration, this rule is flushed.
How can i make it permanent ? Is not recommanded to use firewalld and
nftable together, i need to use only nft command ?
Thank you, Gilian.
Le 14/03/2023 à 13:34, Andrei Borzenkov a écrit :
> On Tue, Mar 14, 2023 at 3:29 PM GAMBINI Gilian
> <gilian.gambini(a)dsi.cnrs.fr> wrote:
>> Hello
>>
>> Im looking for a firewalld equivalent of iptables option "-m state
>> --state ESTABLISHED,RELATED". I use firewalld 0.9.3 on a RHEL8.7 with
> This is default and is always implicitly added to the configured rules.
>
>> nftables backend. nftables support conntrack state (like "ct state {
>> established, related }") but i dont find this in firewalld rich rules
>> documentation. Documentation talk about helpers associate to services
>> but i just dont understand how it work.
>>
> Explicitly configured rules apply to the initial connection, firewalld
> implicitly enables connection tracking and allows packets belonging to
> existing flow.
>
>> If i accept some INPUT connexion on a specific port and want to allow
>> tcp response on OUTPUT (ie with established or related state), can you
>> confirm me i need to bypass firewalld and add directly a nft rules on
>> the right chain ?
> By default all OUTPUT packets are allowed. There is nothing to
> explicitly allow here.