many questions migrating from iptables/firewall-2.4-stronger

David Andrew Michael Noelle dave at straylight.org
Thu Aug 14 07:04:14 UTC 2014


On 08/13/2014 07:14 AM, Jiri Popelka wrote:
> On 08/13/2014 10:19 AM, David Andrew Michael Noelle wrote:
>> On 08/12/2014 08:37 AM, Jiri Popelka wrote:
>>> On 08/06/2014 09:45 AM, David Andrew Michael Noelle wrote:
>>>> question 3
>>>> What are the recommended methods of blocking specific localnet
>>>> addresses
>>>> or the whole "work" zone from connecting to specific ports on external
>>>> host ranges, i.e. no FaceBook at work? Would rich rules in the "work"
>>>> zone be the proper way?
>>>
>>> We AFAIK don't have a way how to restrict outbound traffic, so I guess
>>> 'direct' rules are the only way.
>>
>> Okay. It's not very dynamic, but neither was our old solution. This is
>> a mite more complicated to edit, though. I see something on the Fedora
>> wiki about "planned" saving of direct rules? Does that mean that there
>> are plans to write direct.xml from firewall-cmd, but it's not available
>> yet?
>
> This was added in 0.3.6, see 'Direct Options' in firewall-cmd man page.
> The wiki page https://fedoraproject.org/wiki/FirewallD#Direct_options
> was outdated, I've just fixed it. Or you've seen it somewhere else ?

Oh, sorry.  I must have missed it.  I see it now and it works fine.  And 
yes, I believe that's exactly where I saw the "planned" bit.


>> If I were to write a script to read lists of external IPs and
>> ports to block traffic to, I suppose I should have it invoke
>> firewall-cmd to set the direct rules after firewalld is running rather
>> than have it overwrite direct.xml before firewalld starts. That way
>> wouldn't interfere with future direct rule saving, right?
>
> I don't understand the question. You can add the direct rules into both
> runtime & permanent configuration where the permanent change just
> modifies direct.xml.

That's exactly what I was asking.  It overwrites direct.xml by 
outputting the permanent rules as xml, so having my own script also 
overwrite direct.xml from some other annotated list the machine's owner 
can add IPs to would conflict with that function.  Maybe I can script 
something with queries and adds, though.

It also outputs none of the comments that might previously have been in 
that file, so if I want to comment my rules to keep track of why I'm 
blocking which IPs, I have to keep my notes elsewhere or not use 
--permanent --direct --add-rule.  I can live with that.  I just needed 
to know what I was working with.

Thanks for the replies.  I think I've got a handle on this now.

-- 
             -Dave Noelle,                 dave at Straylight.org


More information about the firewalld-users mailing list