Hi,

please help me configure DMZ for my network. Used about half an hour to look for detailed docs and/or good examples, but failed. Either I need to improve my search skills, or firewalld+dmz is not very common thing or widely documented.

Router/server is a Fedora box running firewalld, with interfaces - eth0 (DHCP) towards public internet - eth1 (192.168.111.1/24): DMZ - eth2 (192.168.222.1/24): trusted network for trusted devices

firewall-cmd --list-all-zones for relevant zones ... dmz (active) target: ACCEPT ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: eth1 sources: services: ports: protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: ... private (default, active) target: ACCEPT ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: eth2 sources: services: ports: protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: ... public (active) target: default ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: eth0 sources: services: dhcpv6-client ports: protocols: forward: no masquerade: yes forward-ports: source-ports: icmp-blocks: rich rules: ...

Now everything works, but the problem is that devices in DMZ can access devices in trusted network. When dmz zone target was default, then devices in DMZ could not access the internet.

The basic goals for the network architecture is to - allow devices in DMZ access internet - allow devices in DMZ access chosen or all services in the router/server - deny devices in DMZ accessing devices in trusted network - allow devices in trusted network access internet - allow devices in trusted network access other devices in trusted network - allow devices in trusted network access devices in DMZ (ideally, not must have)

Any help appreciated.

-Paavo