many questions migrating from iptables/firewall-2.4-stronger

Jiri Popelka jpopelka at redhat.com
Tue Aug 12 12:37:24 UTC 2014


On 08/06/2014 09:45 AM, David Andrew Michael Noelle wrote:
> question 1
> Do I have to do something more to /enable/
> routing between the two localnets?

Does it change if you add masquerade into 'work' or 'dmz' ?

> question 2
> How exactly are zones applied?

https://bugzilla.redhat.com/show_bug.cgi?id=1097960#c1
might shed some light on this.

> question 3
> What are the recommended methods of blocking specific localnet addresses
> or the whole "work" zone from connecting to specific ports on external
> host ranges, i.e. no FaceBook at work?  Would rich rules in the "work"
> zone be the proper way?

We AFAIK don't have a way how to restrict outbound traffic, so I guess 
'direct' rules are the only way.

> question 4
>
> Is there a way to specify classes of destinations, like a destination
> zone?  It would be nice to bundle up the ip ranges or even domains of
> FaceBook and Twitter and Tumblr and whatnot into a "SocialMedia" class
> and just block any traffic to those destinations, either from the "work"
> zone or from specific localnet IPs.

Sounds like ipsets might come in handy here:
https://lists.fedorahosted.org/pipermail/firewalld-users/2014-July/000201.html

> question 5

I'd rather not answer this as I'm not sure.

--
Jiri


More information about the firewalld-users mailing list