Specifying allowed source ports

Sergio Villar Senin svillar at igalia.com
Wed Sep 11 17:13:25 UTC 2013


On 11/09/13 18:52, poma wrote:
> On 11.09.2013 17:55, Sergio Villar Senin wrote:
>> On 11/09/13 13:37, poma wrote:
>>> On 11.09.2013 12:18, Sergio Villar Senin wrote:
>>>> Hi,
>>>>
>>>> sometimes is useful to allow connections from a specific combination of
>>>> of source_address:source_port. For example if you want to allow the
>>>> icecream[1] autodiscovery service in your local network you would likely
>>>> want to allow connections coming from:
>>>>
>>>> 192.168.1.0/24:8765 udp
>>>>
>>>> I think this is a very common use case in local networks where you have
>>>> services running in well-known ports that use random ports in your local
>>>> machine to setup connections.
>>>>
>>>> Is there any way to do that in firewalled?
>>>>
>>>
>>> It would be awkward if it can't. :)
>>> man 5 firewalld.richlanguage
>>
>> I've read the richlanguage syntax and still I cannot find the way to
>> specify the source port, because the <port> element is translated to the
>> destination port in the iptables rule and the <source> element only
>> allows to specify the address, not the port.
>>
> 
> firewall-cmd --permanent --add-rich-rule='rule port port="8765"
> protocol="udp" family="ipv4" source address="192.168.1.0/24" accept'
> firewall-cmd --reload
> firewall-cmd --list-rich-rules

As I said in my previous email, and if I understand the language
correctly, what you are saying in that rule is that you want to allow
udp traffic from _any_ port from 192.168.1.0/24 to my local port 8765.

That's confirmed by iptables:

$ iptables -L IN_work_allow
Chain IN_work_allow (1 references)
target     prot opt source               destination
ACCEPT     udp  --  192.168.1.0/24         anywhere             udp
dpt:8765 ctstate NEW

As you can see the port that is set is the destination port (dpt:8765),
but I want to allow communications _only_ from that port, i.e, I want to
specify the source port, I don't care about the destination port.

Using again iptables terminology, I want to set the "--sport" not the
"--dport"

BR


More information about the firewalld-users mailing list