Is there a way to inherit config from one zone to another? For a simple example, lets say I have a "public" zone that allows services http/https. Now I want some developers to have access to mysql from a static IP/subnet. I can make a new "developer" zone that allows service mysql and add their IPs/subnets as sources, but unless I also http/https, they'll lose web access.
I know I can do this with rich rules in "public", but that's harder to manage (and feels more like short-circuiting firewalld). I can add the same services as "public" to "developer", but now I have to manage that service list in each zone.
It'd be nice to be able to have "developer" inherit services from "public", or make it a sub-zone of "public", or something like that. That way, managing developer IPs is just add/remove on the "developer" zone, while managing general services is still just add/remove on the "public" zone.
On Sat, Jul 13, 2024 at 10:18:03AM -0500, Chris Adams wrote:
Is there a way to inherit config from one zone to another?
Not with only zones. This is by design [1]. Traffic ingress one and only one zone. Traffic never "falls through" to another zone.
If you want to "share" rules then you can do that with a policy.
This example creates a policy that applies for traffic that is destined to the host and originates from either zoneA or zoneB. It's functionally equivalent to doing "--add-service ssh" to both zones.
# firewall-cmd --permanent --new-policy foobar # firewall-cmd --permanent --policy foobar --add-ingress-zone zoneA # firewall-cmd --permanent --policy foobar --add-ingress-zone zoneB # firewall-cmd --permanent --policy foobar --add-egress-zone HOST # firewall-cmd --permanent --policy foobar --add-service ssh # firewall-cmd --permanent --reload
[1]: https://firewalld.org/documentation/concepts.html
For a simple example, lets say I have a "public" zone that allows services http/https. Now I want some developers to have access to mysql from a static IP/subnet. I can make a new "developer" zone that allows service mysql and add their IPs/subnets as sources, but unless I also http/https, they'll lose web access.
I know I can do this with rich rules in "public", but that's harder to manage (and feels more like short-circuiting firewalld). I can add the same services as "public" to "developer", but now I have to manage that service list in each zone.
I think it's fair to have a "public" and "developer" zone. Then use a policy for the common services. You could use policies for everything you want to allow. That is, zone are only used to logically separate the network and policies are for adding rules.
It'd be nice to be able to have "developer" inherit services from "public", or make it a sub-zone of "public", or something like that. That way, managing developer IPs is just add/remove on the "developer" zone, while managing general services is still just add/remove on the "public" zone.
I think policies allow everything that you're asking for.
firewalld-users@lists.fedorahosted.org
-
Chris Adams -
Eric Garver