François Cami via FreeIPA-users wrote:
On Wed, Jan 15, 2020 at 11:48 AM cyrine stambouli via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> wrote:
>
> I have this output :
>
> [root@ipa ~]# firewall-cmd --state
> running
>
> [root@ipa ~]# firewall-cmd --list-all
> public (active)
> target: default
> icmp-block-inversion: no
> interfaces: ens192
> sources:
> services: dhcpv6-client dns freeipa-ldap freeipa-ldaps ssh
> ports:
> protocols:
> masquerade: no
> forward-ports:
> source-ports:
> icmp-blocks:
> rich rules:
The web server is firewalled.
Note: If this server is accessible from the internet, the command
below will expose your httpd server and kerberos KDC to everyone which
is probably not what you want.
With that said, the following command should fix the issue:
# firewall-cmd --runtime-to-permanent
--add-port={80/tcp,443/tcp,88/tcp,88/udp,464/tcp,464/udp,123/udp}
According to /usr/lib/firewalld/services/freeipa-ldap.xml (and
freeipa-ldaps.xml) it should cover those ports already.
It could also be a DNS problem where the machine thinks it knows it's IP
address based on /etc/hosts but the outside world thinks it is a
different machine.
rob