Hello
Im looking for a firewalld equivalent of iptables option "-m state --state ESTABLISHED,RELATED". I use firewalld 0.9.3 on a RHEL8.7 with nftables backend. nftables support conntrack state (like "ct state { established, related }") but i dont find this in firewalld rich rules documentation. Documentation talk about helpers associate to services but i just dont understand how it work.
If i accept some INPUT connexion on a specific port and want to allow tcp response on OUTPUT (ie with established or related state), can you confirm me i need to bypass firewalld and add directly a nft rules on the right chain ? Thank you, Gilian.
On Tue, Mar 14, 2023 at 3:29 PM GAMBINI Gilian gilian.gambini@dsi.cnrs.fr wrote:
Hello
Im looking for a firewalld equivalent of iptables option "-m state --state ESTABLISHED,RELATED". I use firewalld 0.9.3 on a RHEL8.7 with
This is default and is always implicitly added to the configured rules.
nftables backend. nftables support conntrack state (like "ct state { established, related }") but i dont find this in firewalld rich rules documentation. Documentation talk about helpers associate to services but i just dont understand how it work.
Explicitly configured rules apply to the initial connection, firewalld implicitly enables connection tracking and allows packets belonging to existing flow.
If i accept some INPUT connexion on a specific port and want to allow tcp response on OUTPUT (ie with established or related state), can you confirm me i need to bypass firewalld and add directly a nft rules on the right chain ?
By default all OUTPUT packets are allowed. There is nothing to explicitly allow here.
Hello Andrei and Eric,
Thank for fast replying. I would like set up two policies, one for input (ingress ANY/egress HOST) and one for output (ingress HOST/egress ANY), both have REJECT target.
I have made some research on nftable side and i see "implicit" accept packet when ctstate is established or related on INPUT chain : #nft -a list table inet firewalld
chain filter_INPUT { # handle 9 type filter hook input priority filter + 10; policy accept; ct state { established, related } accept # handle 13 ct status dnat accept # handle 14 iifname "lo" accept # handle 15 jump filter_INPUT_POLICIES_pre # handle 17 jump filter_INPUT_ZONES # handle 19 jump filter_INPUT_POLICIES_post # handle 21 ct state { invalid } drop # handle 23 reject with icmpx type admin-prohibited # handle 24 }
But no implicit accept is present in OUTPUT chain :
chain filter_OUTPUT { # handle 11 type filter hook output priority filter + 10; policy accept; oifname "lo" accept # handle 40 ip6 daddr { ::/96, ::ffff:0.0.0.0/96, 2002::/24, 2002:a00::/24, 2002:7f00::/24, 2002:a9fe::/32, 2002:ac10::/28, 2002:c0a8::/32, 2002:e000::/19 } reject with icmpv6 type addr-unreachable # handle 49 jump filter_OUTPUT_POLICIES_pre # handle 42 jump filter_OUTPUT_POLICIES_post # handle 44 }
If a port is open in input policy, responses are blocked by the output policy. If i manually add a nft rule to accept established/related packets, its work :
nft add rule inet firewalld filter_OUTPUT position 40 ct state { established, related } accept
Of course, if i reload firewalld configuration, this rule is flushed. How can i make it permanent ? Is not recommanded to use firewalld and nftable together, i need to use only nft command ?
Thank you, Gilian.
Le 14/03/2023 à 13:34, Andrei Borzenkov a écrit :
On Tue, Mar 14, 2023 at 3:29 PM GAMBINI Gilian gilian.gambini@dsi.cnrs.fr wrote:
Hello
Im looking for a firewalld equivalent of iptables option "-m state --state ESTABLISHED,RELATED". I use firewalld 0.9.3 on a RHEL8.7 with
This is default and is always implicitly added to the configured rules.
nftables backend. nftables support conntrack state (like "ct state { established, related }") but i dont find this in firewalld rich rules documentation. Documentation talk about helpers associate to services but i just dont understand how it work.
Explicitly configured rules apply to the initial connection, firewalld implicitly enables connection tracking and allows packets belonging to existing flow.
If i accept some INPUT connexion on a specific port and want to allow tcp response on OUTPUT (ie with established or related state), can you confirm me i need to bypass firewalld and add directly a nft rules on the right chain ?
By default all OUTPUT packets are allowed. There is nothing to explicitly allow here.
On Tue, Mar 14, 2023 at 03:17:24PM +0100, GAMBINI Gilian wrote:
Hello Andrei and Eric,
Thank for fast replying. I would like set up two policies, one for input (ingress ANY/egress HOST) and one for output (ingress HOST/egress ANY), both have REJECT target.
I have made some research on nftable side and i see "implicit" accept packet when ctstate is established or related on INPUT chain :
Correct. firewalld is stateful.
But no implicit accept is present in OUTPUT chain :
That was fixed in firewalld 0.9.5.
See this RHEL bug: https://bugzilla.redhat.com/show_bug.cgi?id=2156831
If a port is open in input policy, responses are blocked by the output policy. If i manually add a nft rule to accept established/related packets, its work :
nft add rule inet firewalld filter_OUTPUT position 40 ct state { established, related } accept
Of course, if i reload firewalld configuration, this rule is flushed. How can i make it permanent ? Is not recommanded to use firewalld and nftable together, i need to use only nft command ?
You can't easily make it permanent. You would have to re-add it after a firewalld reload/restart.
On Tue, Mar 14, 2023 at 11:00:45AM +0100, GAMBINI Gilian wrote:
Hello
Im looking for a firewalld equivalent of iptables option "-m state --state ESTABLISHED,RELATED". I use firewalld 0.9.3 on a RHEL8.7 with nftables backend. nftables support conntrack state (like "ct state { established, related }") but i dont find this in firewalld rich rules documentation. Documentation talk about helpers associate to services but i just dont understand how it work.
If i accept some INPUT connexion on a specific port and want to allow tcp response on OUTPUT (ie with established or related state), can you confirm me i need to bypass firewalld and add directly a nft rules on the right chain ? Thank you, Gilian.
Andrei did a good job of answering you questions. I'd like to also point you to the concepts page.
firewalld-users@lists.fedorahosted.org