many questions migrating from iptables/firewall-2.4-stronger
Jiri Popelka
jpopelka at redhat.com
Tue Aug 12 12:37:24 UTC 2014
On 08/06/2014 09:45 AM, David Andrew Michael Noelle wrote:
> question 1
> Do I have to do something more to /enable/
> routing between the two localnets?
Does it change if you add masquerade into 'work' or 'dmz' ?
> question 2
> How exactly are zones applied?
https://bugzilla.redhat.com/show_bug.cgi?id=1097960#c1
might shed some light on this.
> question 3
> What are the recommended methods of blocking specific localnet addresses
> or the whole "work" zone from connecting to specific ports on external
> host ranges, i.e. no FaceBook at work? Would rich rules in the "work"
> zone be the proper way?
We AFAIK don't have a way how to restrict outbound traffic, so I guess
'direct' rules are the only way.
> question 4
>
> Is there a way to specify classes of destinations, like a destination
> zone? It would be nice to bundle up the ip ranges or even domains of
> FaceBook and Twitter and Tumblr and whatnot into a "SocialMedia" class
> and just block any traffic to those destinations, either from the "work"
> zone or from specific localnet IPs.
Sounds like ipsets might come in handy here:
https://lists.fedorahosted.org/pipermail/firewalld-users/2014-July/000201.html
> question 5
I'd rather not answer this as I'm not sure.
--
Jiri
More information about the firewalld-users
mailing list