Switching from raw iptables to firewalld

Jason 'XenoPhage' Frisvold xenophage at godshell.com
Thu Dec 4 13:14:42 UTC 2014


Does anyone have any thoughts on this?

- Friz

> On Nov 28, 2014, at 21:41, Jason Frisvold <xenophage at godshell.com> wrote:
> 
> Greetings,
> 
>    I'm working on setting up a shiny new CentOS 7.0 box and trying to wrap
> my head around firewalld.  Generally speaking, firewalld is pretty
> straightforward for simple allow/deny, but I can't figure out how to
> handle the more complex rules I've been using.  I'm hoping someone can
> point me in the right direction.
> 
>    For starters, how do I create a simple spoofing filter?  For my current
> firewalls, I check source and destination addresses, rejecting anything
> that isn't valid.  For instance, reject anything sourced from RFC-1918
> space that isn't in use in the network, reject anything destined for
> broadcast addresses, multicast, etc.
> 
>    Next up, checking flags.  Is this possible with firewalld?  Part of my
> source address checking includes checks for invalid flags.  For
> instance, TCP stealth scan checking :
> 
>   # All of the bits are clear
>   $IPTABLES -A tcp-state-flags -p tcp --tcp-flags ALL NONE -j log-tcp-state
>   # Both SYN and FIN are set
>   $IPTABLES -A tcp-state-flags -p tcp --tcp-flags SYN,FIN SYN,FIN -j
> log-tcp-state
>   # Both SYN and RST are set
>   $IPTABLES -A tcp-state-flags -p tcp --tcp-flags SYN,RST SYN,RST -j
> log-tcp-state
>   # Both FIN and RST are set
>   $IPTABLES -A tcp-state-flags -p tcp --tcp-flags FIN,RST FIN,RST -j
> log-tcp-state
>   # FIN bit set, but no ACK
>   $IPTABLES -A tcp-state-flags -p tcp --tcp-flags ACK,FIN FIN -j
> log-tcp-state
>   # PSH bit set, but no ACK
>   $IPTABLES -A tcp-state-flags -p tcp --tcp-flags ACK,PSH PSH -j
> log-tcp-state
>   # URG bit set, but no ACK
>   $IPTABLES -A tcp-state-flags -p tcp --tcp-flags ACK,URG URG -j
> log-tcp-state
> 
>    And finally, ordering.  I currently use individual chains for
> organization of rulesets.  Management chains cover all of the rules
> allowing management tools access to the server, chains for source and
> destination checks, and a special chain for dropping known
> spammer/attacker IPs.  Again, it doesn't appear that firewalld handles
> this yet.  Am I missing something?
> 
>    I'd like to use firewalld if that's the intended standard, but I don't
> want to compromise the ruleset I've built to do so.  Can firewalld
> handle what I want to throw at it. or should I stick with iptables for now?
> 
> Thanks,
> 
> -- 
> ---------------------------
> Jason 'XenoPhage' Frisvold
> xenophage at godshell.com
> ---------------------------
> 
> "Any sufficiently advanced magic is indistinguishable from technology.\"
> - Niven's Inverse of Clarke's Third Law
> _______________________________________________
> firewalld-users mailing list
> firewalld-users at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/firewalld-users


More information about the firewalld-users mailing list