Hello,
Would someone tell me to what the 'forward:' line in the 'firewall-cmd --list- all' output refers:
services: dhcpv6-client mdns ssh ports: protocols: forward: no masquerade: no forward-ports:
I have a server with this set to 'yes', so would like to know what it means.
Thanks,
John.
-- John Horne | Senior Operations Analyst | Technology and Information Services University of Plymouth | Drake Circus | Plymouth | Devon | PL4 8AA | UK ________________________________ [https://www.plymouth.ac.uk/images/email_footer.gif]http://www.plymouth.ac.uk/worldclass
This email and any files with it are confidential and intended solely for the use of the recipient to whom it is addressed. If you are not the intended recipient then copying, distribution or other use of the information contained is strictly prohibited and you should not rely on it. If you have received this email in error please let the sender know immediately and delete it from your system(s). Internet emails are not necessarily secure. While we take every care, University of Plymouth accepts no responsibility for viruses and it is your responsibility to scan emails and their attachments. University of Plymouth does not accept responsibility for any changes made after it was sent. Nothing in this email or its attachments constitutes an order for goods or services unless accompanied by an official order form.
On 8/7/23 10:29, John Horne wrote:
Hello,
Would someone tell me to what the 'forward:' line in the 'firewall-cmd --list- all' output refers:
It indicates whether or not intra zone forwarding is enabled -> https://firewalld.org/2020/04/intra-zone-forwarding
On Mon, 2023-08-07 at 10:50 -0400, David King wrote:
On 8/7/23 10:29, John Horne wrote:
Hello,
Would someone tell me to what the 'forward:' line in the 'firewall-cmd -- list-all' output refers:
It indicates whether or not intra zone forwarding is enabled -> https://firewalld.org/2020/04/intra-zone-forwarding
Okay, thanks for that. A slightly more descriptive name than just 'forward:' might have helped :-)
John.
-- John Horne | Senior Operations Analyst | Technology and Information Services University of Plymouth | Drake Circus | Plymouth | Devon | PL4 8AA | UK ________________________________ [https://www.plymouth.ac.uk/images/email_footer.gif]http://www.plymouth.ac.uk/worldclass
This email and any files with it are confidential and intended solely for the use of the recipient to whom it is addressed. If you are not the intended recipient then copying, distribution or other use of the information contained is strictly prohibited and you should not rely on it. If you have received this email in error please let the sender know immediately and delete it from your system(s). Internet emails are not necessarily secure. While we take every care, University of Plymouth accepts no responsibility for viruses and it is your responsibility to scan emails and their attachments. University of Plymouth does not accept responsibility for any changes made after it was sent. Nothing in this email or its attachments constitutes an order for goods or services unless accompanied by an official order form.
On Mon, 2023-08-07 at 15:05 +0000, John Horne wrote:
A slightly more descriptive name than just 'forward:' might have helped :-)
Going back to the older firewalls, there were input, output, and forward rules. Input was incoming to this machine, output was outgoing from this machine, and forward was going through/around/bypassing this machine. In the same vein as with NAT rules, forwarding passed traffic through to a new destination. That's how I would have interpreted that.
e.g. If I have incoming traffic for a webserver, but this particular machine wasn't the webserver. Traffic is sent through to where the webserver actually is. Which could be another machine on the network, or a virtual machine hosted within the same PC. I don't actually want to accept that traffic going into the machine it has to skip past, so the incoming rules are the wrong ones to fiddle with. In essence, the firewall is between the network interfaces and the rest of the OS.
On 8/7/23 07:29, John Horne wrote:
Hello,
Would someone tell me to what the 'forward:' line in the 'firewall-cmd --list- all' output refers:
services: dhcpv6-client mdns ssh ports: protocols: forward: no masquerade: no forward-ports:
I have a server with this set to 'yes', so would like to know what it means.
Forwarding is used in multi-homed hosts i.e. hosts with more than one network interface. It allows traffic to be routed between them.
-
David King -
John Horne -
Mike Wright -
Tim