many questions migrating from iptables/firewall-2.4-stronger

Jiri Popelka jpopelka at redhat.com
Wed Aug 13 11:14:41 UTC 2014


On 08/13/2014 10:19 AM, David Andrew Michael Noelle wrote:
> On 08/12/2014 08:37 AM, Jiri Popelka wrote:
>> On 08/06/2014 09:45 AM, David Andrew Michael Noelle wrote:
>>> question 3
>>> What are the recommended methods of blocking specific localnet addresses
>>> or the whole "work" zone from connecting to specific ports on external
>>> host ranges, i.e. no FaceBook at work? Would rich rules in the "work"
>>> zone be the proper way?
>>
>> We AFAIK don't have a way how to restrict outbound traffic, so I guess
>> 'direct' rules are the only way.
>
> Okay.  It's not very dynamic, but neither was our old solution.  This is
> a mite more complicated to edit, though.  I see something on the Fedora
> wiki about "planned" saving of direct rules?  Does that mean that there
> are plans to write direct.xml from firewall-cmd, but it's not available
> yet?

This was added in 0.3.6, see 'Direct Options' in firewall-cmd man page.
The wiki page https://fedoraproject.org/wiki/FirewallD#Direct_options
was outdated, I've just fixed it. Or you've seen it somewhere else ?

> If I were to write a script to read lists of external IPs and
> ports to block traffic to, I suppose I should have it invoke
> firewall-cmd to set the direct rules after firewalld is running rather
> than have it overwrite direct.xml before firewalld starts.  That way
> wouldn't interfere with future direct rule saving, right?

I don't understand the question. You can add the direct rules into both 
runtime & permanent configuration where the permanent change just 
modifies direct.xml.

--
Jiri



More information about the firewalld-users mailing list