many questions migrating from iptables/firewall-2.4-stronger

David Andrew Michael Noelle dave at straylight.org
Wed Aug 13 08:19:35 UTC 2014


On 08/12/2014 08:37 AM, Jiri Popelka wrote:
> On 08/06/2014 09:45 AM, David Andrew Michael Noelle wrote:
>> question 1
>> Do I have to do something more to /enable/
>> routing between the two localnets?
>
> Does it change if you add masquerade into 'work' or 'dmz' ?

Indeed, adding Masquerade to 'work' allows anything in 'dmz', or subnets 
off of 'dmz', to browse the web server on a machine in 'work'.  This 
does not look particularly secure to me.  Does it not also allow the 
same forwarding, potentially, from 'external' to 'work'?

I found that direct rules in the FORWARD_direct chain also work, but are 
rather a hassle.  Given the choice between all, nothing, or a bit of 
work to get one port open now and then, I'll be sticking with nothing 
until individual needs rise.  Fortunately, in this case, not allowing 
communication between the localnets was the whole point of separating 
them in the first place.


>> question 2
>> How exactly are zones applied?
>
> https://bugzilla.redhat.com/show_bug.cgi?id=1097960#c1
> might shed some light on this.

Thanks.  That does help.  And I see Scott Shambarger had similar 
concerns about allowing too much forwarding.


>> question 3
>> What are the recommended methods of blocking specific localnet addresses
>> or the whole "work" zone from connecting to specific ports on external
>> host ranges, i.e. no FaceBook at work? Would rich rules in the "work"
>> zone be the proper way?
>
> We AFAIK don't have a way how to restrict outbound traffic, so I guess
> 'direct' rules are the only way.

Okay.  It's not very dynamic, but neither was our old solution.  This is 
a mite more complicated to edit, though.  I see something on the Fedora 
wiki about "planned" saving of direct rules?  Does that mean that there 
are plans to write direct.xml from firewall-cmd, but it's not available 
yet?  If I were to write a script to read lists of external IPs and 
ports to block traffic to, I suppose I should have it invoke 
firewall-cmd to set the direct rules after firewalld is running rather 
than have it overwrite direct.xml before firewalld starts.  That way 
wouldn't interfere with future direct rule saving, right?


>> question 4
>>
>> Is there a way to specify classes of destinations, like a destination
>> zone? It would be nice to bundle up the ip ranges or even domains of
>> FaceBook and Twitter and Tumblr and whatnot into a "SocialMedia" class
>> and just block any traffic to those destinations, either from the "work"
>> zone or from specific localnet IPs.
>
> Sounds like ipsets might come in handy here:
> https://lists.fedorahosted.org/pipermail/firewalld-users/2014-July/000201.html

Hmm.  That does look like what I was looking for.  Thanks.  I'll read up 
on that.

-- 
             -Dave Noelle,                 dave at Straylight.org


More information about the firewalld-users mailing list