Trusted zone not completely trusted.

John Griffiths fedora.jrg01 at grifent.com
Tue Mar 25 20:51:08 UTC 2014


As far as I can tell, the trusted zone is not being used at all. True?

Any ideas on what I can do to accomplish letting the VPN be totally 
trusted? If that cannot be done, how about totally trusting a host at 
the other end of the VPN?

Regards,
John

On 03/11/2014 10:17 AM, John Griffiths wrote:
>
> On 03/11/2014 09:31 AM, Jiri Popelka wrote:
>> On 03/07/2014 09:42 PM, John Griffiths wrote:
>>> I have a VPN that is in the "trusted" zone. The trusted zone has no
>>> services enabled but has ports 0-65535 TCP and UDP.
>>
>> Could you attach the XML file of your "trusted" zone ?
>>
> <?xml version="1.0" encoding="utf-8"?>
> <zone target="ACCEPT">
>   <short>Trusted</short>
>   <description>All network connections are accepted.</description>
>   <port protocol="tcp" port="0-65535"/>
>   <port protocol="udp" port="0-65535"/>
> </zone>
>
>>> When I bring up the VPN, not all the ports seem to be open.
>>
>> Also iptables-save output would be useful.
> This is with the VPN up.
>
> # Generated by iptables-save v1.4.18 on Tue Mar 11 10:13:32 2014
> *nat
> :PREROUTING ACCEPT [5273:585641]
> :INPUT ACCEPT [4009:381138]
> :OUTPUT ACCEPT [23604:1760232]
> :POSTROUTING ACCEPT [23604:1760232]
> :OUTPUT_direct - [0:0]
> :POSTROUTING_ZONES - [0:0]
> :POSTROUTING_ZONES_SOURCE - [0:0]
> :POSTROUTING_direct - [0:0]
> :POST_home - [0:0]
> :POST_home_allow - [0:0]
> :POST_home_deny - [0:0]
> :POST_home_log - [0:0]
> :PREROUTING_ZONES - [0:0]
> :PREROUTING_ZONES_SOURCE - [0:0]
> :PREROUTING_direct - [0:0]
> :PRE_home - [0:0]
> :PRE_home_allow - [0:0]
> :PRE_home_deny - [0:0]
> :PRE_home_log - [0:0]
> -A PREROUTING -j PREROUTING_direct
> -A PREROUTING -j PREROUTING_ZONES_SOURCE
> -A PREROUTING -j PREROUTING_ZONES
> -A OUTPUT -j OUTPUT_direct
> -A POSTROUTING -j POSTROUTING_direct
> -A POSTROUTING -j POSTROUTING_ZONES_SOURCE
> -A POSTROUTING -j POSTROUTING_ZONES
> -A POSTROUTING_ZONES -o em1 -g POST_home
> -A POSTROUTING_ZONES -g POST_home
> -A POST_home -j POST_home_log
> -A POST_home -j POST_home_deny
> -A POST_home -j POST_home_allow
> -A PREROUTING_ZONES -i em1 -g PRE_home
> -A PREROUTING_ZONES -g PRE_home
> -A PRE_home -j PRE_home_log
> -A PRE_home -j PRE_home_deny
> -A PRE_home -j PRE_home_allow
> COMMIT
> # Completed on Tue Mar 11 10:13:32 2014
> # Generated by iptables-save v1.4.18 on Tue Mar 11 10:13:32 2014
> *mangle
> :PREROUTING ACCEPT [527279:593251824]
> :INPUT ACCEPT [527279:593251824]
> :FORWARD ACCEPT [0:0]
> :OUTPUT ACCEPT [481339:480231494]
> :POSTROUTING ACCEPT [482918:480524178]
> :FORWARD_direct - [0:0]
> :INPUT_direct - [0:0]
> :OUTPUT_direct - [0:0]
> :POSTROUTING_direct - [0:0]
> :PREROUTING_ZONES - [0:0]
> :PREROUTING_ZONES_SOURCE - [0:0]
> :PREROUTING_direct - [0:0]
> :PRE_home - [0:0]
> :PRE_home_allow - [0:0]
> :PRE_home_deny - [0:0]
> :PRE_home_log - [0:0]
> -A PREROUTING -j PREROUTING_direct
> -A PREROUTING -j PREROUTING_ZONES_SOURCE
> -A PREROUTING -j PREROUTING_ZONES
> -A INPUT -j INPUT_direct
> -A FORWARD -j FORWARD_direct
> -A OUTPUT -j OUTPUT_direct
> -A POSTROUTING -j POSTROUTING_direct
> -A PREROUTING_ZONES -i em1 -g PRE_home
> -A PREROUTING_ZONES -g PRE_home
> -A PRE_home -j PRE_home_log
> -A PRE_home -j PRE_home_deny
> -A PRE_home -j PRE_home_allow
> COMMIT
> # Completed on Tue Mar 11 10:13:32 2014
> # Generated by iptables-save v1.4.18 on Tue Mar 11 10:13:32 2014
> *security
> :INPUT ACCEPT [525887:593042099]
> :FORWARD ACCEPT [0:0]
> :OUTPUT ACCEPT [481341:480231594]
> :FORWARD_direct - [0:0]
> :INPUT_direct - [0:0]
> :OUTPUT_direct - [0:0]
> -A INPUT -j INPUT_direct
> -A FORWARD -j FORWARD_direct
> -A OUTPUT -j OUTPUT_direct
> COMMIT
> # Completed on Tue Mar 11 10:13:32 2014
> # Generated by iptables-save v1.4.18 on Tue Mar 11 10:13:32 2014
> *raw
> :PREROUTING ACCEPT [527281:593251924]
> :OUTPUT ACCEPT [481341:480231594]
> :OUTPUT_direct - [0:0]
> :PREROUTING_direct - [0:0]
> -A PREROUTING -j PREROUTING_direct
> -A OUTPUT -j OUTPUT_direct
> COMMIT
> # Completed on Tue Mar 11 10:13:32 2014
> # Generated by iptables-save v1.4.18 on Tue Mar 11 10:13:32 2014
> *filter
> :INPUT ACCEPT [0:0]
> :FORWARD ACCEPT [0:0]
> :OUTPUT ACCEPT [481339:480231494]
> :FORWARD_IN_ZONES - [0:0]
> :FORWARD_IN_ZONES_SOURCE - [0:0]
> :FORWARD_OUT_ZONES - [0:0]
> :FORWARD_OUT_ZONES_SOURCE - [0:0]
> :FORWARD_direct - [0:0]
> :FWDI_home - [0:0]
> :FWDI_home_allow - [0:0]
> :FWDI_home_deny - [0:0]
> :FWDI_home_log - [0:0]
> :FWDO_home - [0:0]
> :FWDO_home_allow - [0:0]
> :FWDO_home_deny - [0:0]
> :FWDO_home_log - [0:0]
> :INPUT_ZONES - [0:0]
> :INPUT_ZONES_SOURCE - [0:0]
> :INPUT_direct - [0:0]
> :IN_home - [0:0]
> :IN_home_allow - [0:0]
> :IN_home_deny - [0:0]
> :IN_home_log - [0:0]
> :OUTPUT_direct - [0:0]
> -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
> -A INPUT -i lo -j ACCEPT
> -A INPUT -j INPUT_direct
> -A INPUT -j INPUT_ZONES_SOURCE
> -A INPUT -j INPUT_ZONES
> -A INPUT -p icmp -j ACCEPT
> -A INPUT -j REJECT --reject-with icmp-host-prohibited
> -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
> -A FORWARD -i lo -j ACCEPT
> -A FORWARD -j FORWARD_direct
> -A FORWARD -j FORWARD_IN_ZONES_SOURCE
> -A FORWARD -j FORWARD_IN_ZONES
> -A FORWARD -j FORWARD_OUT_ZONES_SOURCE
> -A FORWARD -j FORWARD_OUT_ZONES
> -A FORWARD -p icmp -j ACCEPT
> -A FORWARD -j REJECT --reject-with icmp-host-prohibited
> -A OUTPUT -j OUTPUT_direct
> -A FORWARD_IN_ZONES -i em1 -g FWDI_home
> -A FORWARD_IN_ZONES -g FWDI_home
> -A FORWARD_OUT_ZONES -o em1 -g FWDO_home
> -A FORWARD_OUT_ZONES -g FWDO_home
> -A FWDI_home -j FWDI_home_log
> -A FWDI_home -j FWDI_home_deny
> -A FWDI_home -j FWDI_home_allow
> -A FWDO_home -j FWDO_home_log
> -A FWDO_home -j FWDO_home_deny
> -A FWDO_home -j FWDO_home_allow
> -A INPUT_ZONES -i em1 -g IN_home
> -A INPUT_ZONES -g IN_home
> -A IN_home -j IN_home_log
> -A IN_home -j IN_home_deny
> -A IN_home -j IN_home_allow
> -A IN_home_allow -d 224.0.0.251/32 -p udp -m udp --dport 5353 -m 
> conntrack --ctstate NEW -j ACCEPT
> -A IN_home_allow -p udp -m udp --dport 137 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p udp -m udp --dport 138 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p tcp -m tcp --dport 139 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p tcp -m tcp --dport 445 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p tcp -m tcp --dport 80 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p tcp -m tcp --dport 443 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p udp -m udp --dport 631 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p tcp -m tcp --dport 5900:5903 -m conntrack 
> --ctstate NEW -j ACCEPT
> -A IN_home_allow -p tcp -m tcp --dport 25 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p tcp -m tcp --dport 993 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p tcp -m tcp --dport 631 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p udp -m udp --dport 631 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p udp -m udp --dport 1194 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p tcp -m tcp --dport 53 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p udp -m udp --dport 53 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p tcp -m tcp --dport 3306 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p tcp -m tcp --dport 5432 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p udp -m udp --dport 123 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p tcp -m tcp --dport 995 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p udp -m udp --dport 137 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p udp -m udp --dport 138 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p tcp -m tcp --dport 51413 -m conntrack --ctstate 
> NEW -j ACCEPT
> -A IN_home_allow -p tcp -m tcp --dport 5059:5061 -m conntrack 
> --ctstate NEW -j ACCEPT
> -A IN_home_allow -p udp -m udp --dport 1998 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p udp -m udp --dport 54925 -m conntrack --ctstate 
> NEW -j ACCEPT
> -A IN_home_allow -p tcp -m tcp --dport 5269 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p udp -m udp --dport 5900:5999 -m conntrack 
> --ctstate NEW -j ACCEPT
> -A IN_home_allow -p tcp -m tcp --dport 5298 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p udp -m udp --dport 587 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p tcp -m tcp --dport 1998 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p tcp -m tcp --dport 8181 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p tcp -m tcp --dport 5222:5223 -m conntrack 
> --ctstate NEW -j ACCEPT
> -A IN_home_allow -p tcp -m tcp --dport 1099 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p udp -m udp --dport 6881:6999 -m conntrack 
> --ctstate NEW -j ACCEPT
> -A IN_home_allow -p udp -m udp --dport 6566 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p tcp -m tcp --dport 8080 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p tcp -m tcp --dport 9090:9091 -m conntrack 
> --ctstate NEW -j ACCEPT
> -A IN_home_allow -p udp -m udp --dport 4000:4050 -m conntrack 
> --ctstate NEW -j ACCEPT
> -A IN_home_allow -p tcp -m tcp --dport 5900:5999 -m conntrack 
> --ctstate NEW -j ACCEPT
> -A IN_home_allow -p udp -m udp --dport 5059:5061 -m conntrack 
> --ctstate NEW -j ACCEPT
> -A IN_home_allow -p tcp -m tcp --dport 3551 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p udp -m udp --dport 4848 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p udp -m udp --dport 5298 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p udp -m udp --dport 5222:5223 -m conntrack 
> --ctstate NEW -j ACCEPT
> -A IN_home_allow -p tcp -m tcp --dport 6881:6999 -m conntrack 
> --ctstate NEW -j ACCEPT
> -A IN_home_allow -p tcp -m tcp --dport 5280:5281 -m conntrack 
> --ctstate NEW -j ACCEPT
> -A IN_home_allow -p tcp -m tcp --dport 4000:4050 -m conntrack 
> --ctstate NEW -j ACCEPT
> -A IN_home_allow -p tcp -m tcp --dport 587 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p tcp -m tcp --dport 5800:5899 -m conntrack 
> --ctstate NEW -j ACCEPT
> -A IN_home_allow -p udp -m udp --dport 3551 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p tcp -m tcp --dport 6566 -m conntrack --ctstate NEW 
> -j ACCEPT
> -A IN_home_allow -p udp -m udp --dport 9090:9091 -m conntrack 
> --ctstate NEW -j ACCEPT
> -A IN_home_allow -p tcp -m tcp --dport 4848 -m conntrack --ctstate NEW 
> -j ACCEPT
> COMMIT
> # Completed on Tue Mar 11 10:13:32 2014
>
>>
>>> What am I missing?
>>
>> No idea.
>>
>> -- 
>> Jiri
>>
>>
>> _______________________________________________
>> firewalld-users mailing list
>> firewalld-users at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/firewalld-users
>



More information about the firewalld-users mailing list