many questions migrating from iptables/firewall-2.4-stronger

David Andrew Michael Noelle dave at straylight.org
Wed Aug 6 07:45:07 UTC 2014


My trusty old heavily customized firewall-2.4-stronger script doesn't 
like systemd, so I think firewalld is probably the way to go, but it 
doesn't seem to support some of the things I need to do without 
resorting to direct rules, which seems to be undermining the whole 
"dynamic" idea.  Maybe I missed something and there are better ways to 
do this.  This is for a small office that I can't really replicate the 
setup of, so I can't test it properly without them being offline for a 
while.  Maybe someone could tell me if I'm on the right track before I 
do that.

There are three relevant ethernet interfaces:
0) cable modem in bridge mode (p35p1) - "external" zone
1) office lan (p2p1) - "work" zone - 192.168.10.0/24 segment
2) dmz for testing client machines (p3p1) - "dmz" zone 192.168.20.0/24

question 1

Internet traffic is being routed successfully from both internal 
networks out to the world and back.  I used to have rules dropping 
packets between the two localnets, just to keep the customer machines 
from spreading viruses to the office.  Even without those rules, the few 
tests I was able to try without their network to test on didn't connect. 
  Did I miss something?  Do I have to do something more to /enable/ 
routing between the two localnets?  Or is this a 
fluke/misconfiguration/bad test I need to be concerned about?

question 2

How exactly are zones applied?  When a packet wants to be routed from 
the "work" localnet to the masquerading "external", which zone applies? 
  Both of them?  What if the packet is coming from an interface with one 
zone, from an address with another zone, routed to an interface with a 
third zone?  How do zone rules translate to incoming, outgoing, and 
forwarding traffic?

question 3

What are the recommended methods of blocking specific localnet addresses 
or the whole "work" zone from connecting to specific ports on external 
host ranges, i.e. no FaceBook at work?  Would rich rules in the "work" 
zone be the proper way?  It's kinda messy not being able to note the 
purpose of blocking a specific address when you have 20 or so different 
address ranges blocked and keep adding more.

question 4

Is there a way to specify classes of destinations, like a destination 
zone?  It would be nice to bundle up the ip ranges or even domains of 
FaceBook and Twitter and Tumblr and whatnot into a "SocialMedia" class 
and just block any traffic to those destinations, either from the "work" 
zone or from specific localnet IPs.  Lists of IPs with no notes are 
pretty unwieldy and not very reliable.  Although, the xml file does 
allow notes, so that's what I'm doing so far.  It works, I think, but 
it's ugly.

question 5

If I want to allow the dmz to only call out to the internet on specific 
services, like http/https, but no smtp or ftp, is it sufficient to just 
enable the services I want in the dmz zone?  Does that affect 
connections that would just be masqueraded and forwarded out the 
external zone?  What if I want to temporarily enable ftp from the dmz to 
one specific address, like a server on the work localnet?  Would a rich 
rule for FTP service with an accept action do it?  Would it have to be 
passive FTP only?

That's a bit more question than I thought I had when I started writing 
this, but hopefully someone's still reading.  Thanks in advance for any 
guidance you can offer.

-- 
             -Dave Noelle,                 dave at Straylight.org


More information about the firewalld-users mailing list