Hi,
I'm running 0.3.9.1 (Fedora 20) with the default "public" zone. I'm not running any special rules (riched rules). The only customization I did to the default zone is to remove "mdns" and two or three more services that come enabled out of the box.
Now, when I use firewall-config to modify the public zone:
- switch to permanent - change the default target to DROP - perform a firewalld reload
...I loose all connectivity. When I run "iptables -v -L -n" I see all counters showing 0 packets/bytes. I do notice the DROP lines in their respective *public" chains (as it should after the change). That is, if you take a look at the iptables rules they all make sense (they should work) but somehow, after changing the default target to DROP, it seems packet aren't reaching netfilter at all.
Thanks, Jorge
On 01/17/2014 01:54 PM, Jorge Fábregas wrote:
When I run "iptables -v -L -n" I see all counters showing 0 packets/bytes
My mistake. All counters show 0 except the OUTPUT chain that increases after I perform some tests like pinging my gateway etc. That's the only place I see the counter increasing (OUTPUT chain). The rule for RELATED, ESTABLISHED connections is not being hit and the strange thing is that I don't even see the final DROP counter increasing.
On 01/17/2014 02:36 PM, Jorge Fábregas wrote:
The rule for RELATED, ESTABLISHED connections is not being hit and the strange thing is that I don't even see the final DROP counter increasing.
Ok, I found the root of the problem. I had to remind myself that the *filter* table is not the only one around...
I performed a comparisson of the *mangle* table before & after changing the default target. Here's where returning packets are being dropped (after I source any new connection):
*mangle* chains following: PREROUTING ..PREROUTING_ZONES ....PRE_public ........packets diverted to 3 more custom-chains ........DROP (dropped here as the last 3 chains have no rules)
This is definitely a bug, isn't it?
firewalld-users@lists.fedorahosted.org