On Wed, Nov 10, 2021 at 04:45:52PM +0100, Freek de Kruijf wrote:
Op woensdag 10 november 2021 14:57:24 CET schreef Eric Garver:
> On Tue, Nov 09, 2021 at 08:48:57PM -0000, Freek de Kruijf wrote:
> > There are no firewall messages in dmesg.
> >
> > I can't use LogDenied in the .conf file because I need to control the
> > prefix text.
> Can you verify the log rule is in the firewall backend (nftables)?
>
> # firewall-cmd --zone public --add-rich-rule='rule protocol value=tcp log
> prefix="FOOBAR: " reject' success
>
> # nft list ruleset |grep -C5 tcp
> [..]
> chain filter_IN_public_log {
> meta l4proto tcp ct state { new, untracked } log prefix
> "FOOBAR: " }
>
> chain filter_IN_public_deny {
> meta l4proto tcp ct state { new, untracked } reject
> }
>
> Here you can see a log rule and a reject rule.
>
>
> Are you sure the test traffic is ingressing the public zone? It should be
> received on eth0 based on the details you gave.
>
> Eric.
I repeated the test using iptables as the backend, and got the same result.
Entries in the firewall log when packages come from the internal IP address,
and nothing when packages come from an external address. tcpdump always shows
incoming tcp packages.
> Are you sure the test traffic is ingressing the public zone? It
should be
> received on eth0 based on the details you gave.
Can you answer this? I expect your test traffic is originating from a
different zone. Your original email said you're also using the
"internal" zone.
In that case, you need to also open the ports in the internal zone. In
firewalld, packets ingress one and only one zone.