Hello!
I tried to allow all traffic to a certain net via a rich-rule, but the stuff is still being rejected.
firewalld runs on the system that forwards (routes, not NAT/PAT) that traffic.
My goal is the following: Have SPI for the system itself and parts of the VPN interface and have no FW at all for a certain address range.
sudo firewall-cmd --add-rich-rule="rule family=ipv6 destination address=2001:db8::/56 accept"
Is being accepted, but doesn't allow the traffic. It works for traffic that targets the firewalld system itself, but does not work for the forwarded (routed) traffic to machines connected to the VPN interface.
On 07.08.2024 20:26, Marco Moock wrote:
Hello!
I tried to allow all traffic to a certain net via a rich-rule, but the stuff is still being rejected.
firewalld runs on the system that forwards (routes, not NAT/PAT) that traffic.
My goal is the following: Have SPI for the system itself and parts of the VPN interface and have no FW at all for a certain address range.
sudo firewall-cmd --add-rich-rule="rule family=ipv6 destination address=2001:db8::/56 accept"
Is being accepted, but doesn't allow the traffic. It works for traffic that targets the firewalld system itself, but does not work for the forwarded (routed) traffic to machines connected to the VPN interface.
Assuming routing is enabled in the first place, you need policy to allow forwarding between zones.
On Wed, Aug 07, 2024 at 08:31:25PM +0300, Andrei Borzenkov wrote:
On 07.08.2024 20:26, Marco Moock wrote:
Hello!
I tried to allow all traffic to a certain net via a rich-rule, but the stuff is still being rejected.
firewalld runs on the system that forwards (routes, not NAT/PAT) that traffic.
My goal is the following: Have SPI for the system itself and parts of the VPN interface and have no FW at all for a certain address range.
sudo firewall-cmd --add-rich-rule="rule family=ipv6 destination address=2001:db8::/56 accept"
Is being accepted, but doesn't allow the traffic. It works for traffic that targets the firewalld system itself, but does not work for the forwarded (routed) traffic to machines connected to the VPN interface.
Assuming routing is enabled in the first place, you need policy to allow forwarding between zones.
Or if your interfaces/sources are in the same zone then enabling forward should be enough. This is enabled by default in recent firewalld versions.
# firewall-cmd --zone <your zone> --add-forward
Am Wed, 7 Aug 2024 20:31:25 +0300 schrieb Andrei Borzenkov arvidjaar@gmail.com:
Assuming routing is enabled in the first place, you need policy to allow forwarding between zones.
Routing is enabled and works in both directions. Incoming only for stuff that is being tracked.
I noticed that the LAN interface is in public, but the vpn interface is in no zone. Adding it to public now allowed all traffic.
Is there any problem if the system boots up and the interface doesn't exist when manually added to a zone?
It is only available when at least one client is connected.
On Wed, Aug 07, 2024 at 08:00:02PM +0200, Marco Moock wrote:
Am Wed, 7 Aug 2024 20:31:25 +0300 schrieb Andrei Borzenkov arvidjaar@gmail.com:
Assuming routing is enabled in the first place, you need policy to allow forwarding between zones.
Routing is enabled and works in both directions. Incoming only for stuff that is being tracked.
I noticed that the LAN interface is in public, but the vpn interface is in no zone. Adding it to public now allowed all traffic.
Is there any problem if the system boots up and the interface doesn't exist when manually added to a zone?
No. The dispatch/match is based on the interface name.
It is only available when at least one client is connected.
firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
firewalld-users@lists.fedorahosted.org