Hi,
I am running into a firewalld behavior again that I cannot understand.
Running firewalld on a Debian 11 box.
The zone file contains the following:
<icmp-block-inversion/> <icmp-block name="echo-reply"/> <icmp-block name="echo-request"/>
A ping from a client results in a reply, but I am still getting the following error message in syslog:
"filter_zone_knet_HOST_ICMP_BLOCK: "IN=enp2s0 OUT= MAC=<ANOM> SRC=192.168.1.9 DST=192.168.1.1 LEN=60 TOS=0x00 PREC=0x00 TTL=128 ID=56385 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=509
What's happening?
Thanks for your help and best regards,
Koen
On 2/8/2022 2:27 PM, Koen Drai wrote:
I am still getting the following error message in syslog:
"filter_zone_knet_HOST_ICMP_BLOCK: "IN=enp2s0 OUT= MAC=<ANOM> SRC=192.168.1.9 DST=192.168.1.1 LEN=60 TOS=0x00 PREC=0x00 TTL=128 ID=56385 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=509
Can you dump the whole nftables rule list to a pastebin and post the link here?
On 2/8/22 20:26, Kenneth Porter wrote:
On 2/8/2022 2:27 PM, Koen Drai wrote:
I am still getting the following error message in syslog:
"filter_zone_knet_HOST_ICMP_BLOCK: "IN=enp2s0 OUT= MAC=<ANOM> SRC=192.168.1.9 DST=192.168.1.1 LEN=60 TOS=0x00 PREC=0x00 TTL=128 ID=56385 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=509
Can you dump the whole nftables rule list to a pastebin and post the link here?
when I was talking to rhel support (different issues), I was told there are some (serious) issues with netfilters, and they advised me to use iptables instead for now. You can change that in the firewall setup
firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
On Tue, Feb 08, 2022 at 11:27:57PM +0100, Koen Drai wrote:
Hi,
I am running into a firewalld behavior again that I cannot understand.
Running firewalld on a Debian 11 box.
The zone file contains the following:
<icmp-block-inversion/> <icmp-block name="echo-reply"/> <icmp-block name="echo-request"/>
A ping from a client results in a reply, but I am still getting the following error message in syslog:
"filter_zone_knet_HOST_ICMP_BLOCK: "IN=enp2s0 OUT= MAC=<ANOM> SRC=192.168.1.9 DST=192.168.1.1 LEN=60 TOS=0x00 PREC=0x00 TTL=128 ID=56385 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=509
What's happening?
This has been fixed.
https://github.com/firewalld/firewalld/issues/696
Fixed in: v0.9.5, v1.0.2
On Tue, Feb 08, 2022 at 09:02:34PM -0700, R C wrote:
On 2/8/22 20:26, Kenneth Porter wrote:
On 2/8/2022 2:27 PM, Koen Drai wrote:
I am still getting the following error message in syslog:
"filter_zone_knet_HOST_ICMP_BLOCK: "IN=enp2s0 OUT= MAC=<ANOM> SRC=192.168.1.9 DST=192.168.1.1 LEN=60 TOS=0x00 PREC=0x00 TTL=128 ID=56385 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=509
Can you dump the whole nftables rule list to a pastebin and post the link here?
when I was talking to rhel support (different issues), I was told there are some (serious) issues with netfilters, and they advised me to use iptables instead for now. You can change that in the firewall setup
I assure you this is a misunderstanding. This statement does not make sense as iptables is part of netfilter.
netfilter is the umbrella term for all of Linux kernel packet filter, mangling, connection tracking, etc.
Netfilter includes (non-exhaustive list):
- iptables - nftables - ebtables - arptables - ipset - conntrack
firewalld-users@lists.fedorahosted.org
-
Eric Garver -
Kenneth Porter -
Koen Drai -
R C