Trusted zone not completely trusted.

Thomas Woerner twoerner at redhat.com
Wed Mar 26 15:31:59 UTC 2014


Hello John,

On 03/25/2014 09:51 PM, John Griffiths wrote:
> As far as I can tell, the trusted zone is not being used at all. True?
>
the trusted zone is only used if you are binding something to it. Like 
for example an interface or a source address (range).

The VPNs handled by NM are currently not bound to a firewall zone. This 
is something that should be fixed soon in NM. The needed parts in 
firewalld are there, but there is no source binding requested by NM so far.

> Any ideas on what I can do to accomplish letting the VPN be totally
> trusted? If that cannot be done, how about totally trusting a host at
> the other end of the VPN?
>
For now you can bind the addresses or address ranges of your VPN 
connection to the trusted zone.
Please have a look at the firewall.cmd man page or use the config tool..

For testing (runtime only):
firewall-cmd [--zone=zone] --add-source=source[/mask]

For permanent change:
firewall-cmd --permanent [--zone=zone] --add-source=source[/mask]

> Regards,
> John
>
Regards,
Thomas


> On 03/11/2014 10:17 AM, John Griffiths wrote:
>>
>> On 03/11/2014 09:31 AM, Jiri Popelka wrote:
>>> On 03/07/2014 09:42 PM, John Griffiths wrote:
>>>> I have a VPN that is in the "trusted" zone. The trusted zone has no
>>>> services enabled but has ports 0-65535 TCP and UDP.
>>>
>>> Could you attach the XML file of your "trusted" zone ?
>>>
>> <?xml version="1.0" encoding="utf-8"?>
>> <zone target="ACCEPT">
>>   <short>Trusted</short>
>>   <description>All network connections are accepted.</description>
>>   <port protocol="tcp" port="0-65535"/>
>>   <port protocol="udp" port="0-65535"/>
>> </zone>
>>
>>>> When I bring up the VPN, not all the ports seem to be open.
>>>
>>> Also iptables-save output would be useful.
>> This is with the VPN up.
>>
>> # Generated by iptables-save v1.4.18 on Tue Mar 11 10:13:32 2014
>> *nat
>> :PREROUTING ACCEPT [5273:585641]
>> :INPUT ACCEPT [4009:381138]
>> :OUTPUT ACCEPT [23604:1760232]
>> :POSTROUTING ACCEPT [23604:1760232]
>> :OUTPUT_direct - [0:0]
>> :POSTROUTING_ZONES - [0:0]
>> :POSTROUTING_ZONES_SOURCE - [0:0]
>> :POSTROUTING_direct - [0:0]
>> :POST_home - [0:0]
>> :POST_home_allow - [0:0]
>> :POST_home_deny - [0:0]
>> :POST_home_log - [0:0]
>> :PREROUTING_ZONES - [0:0]
>> :PREROUTING_ZONES_SOURCE - [0:0]
>> :PREROUTING_direct - [0:0]
>> :PRE_home - [0:0]
>> :PRE_home_allow - [0:0]
>> :PRE_home_deny - [0:0]
>> :PRE_home_log - [0:0]
>> -A PREROUTING -j PREROUTING_direct
>> -A PREROUTING -j PREROUTING_ZONES_SOURCE
>> -A PREROUTING -j PREROUTING_ZONES
>> -A OUTPUT -j OUTPUT_direct
>> -A POSTROUTING -j POSTROUTING_direct
>> -A POSTROUTING -j POSTROUTING_ZONES_SOURCE
>> -A POSTROUTING -j POSTROUTING_ZONES
>> -A POSTROUTING_ZONES -o em1 -g POST_home
>> -A POSTROUTING_ZONES -g POST_home
>> -A POST_home -j POST_home_log
>> -A POST_home -j POST_home_deny
>> -A POST_home -j POST_home_allow
>> -A PREROUTING_ZONES -i em1 -g PRE_home
>> -A PREROUTING_ZONES -g PRE_home
>> -A PRE_home -j PRE_home_log
>> -A PRE_home -j PRE_home_deny
>> -A PRE_home -j PRE_home_allow
>> COMMIT
>> # Completed on Tue Mar 11 10:13:32 2014
>> # Generated by iptables-save v1.4.18 on Tue Mar 11 10:13:32 2014
>> *mangle
>> :PREROUTING ACCEPT [527279:593251824]
>> :INPUT ACCEPT [527279:593251824]
>> :FORWARD ACCEPT [0:0]
>> :OUTPUT ACCEPT [481339:480231494]
>> :POSTROUTING ACCEPT [482918:480524178]
>> :FORWARD_direct - [0:0]
>> :INPUT_direct - [0:0]
>> :OUTPUT_direct - [0:0]
>> :POSTROUTING_direct - [0:0]
>> :PREROUTING_ZONES - [0:0]
>> :PREROUTING_ZONES_SOURCE - [0:0]
>> :PREROUTING_direct - [0:0]
>> :PRE_home - [0:0]
>> :PRE_home_allow - [0:0]
>> :PRE_home_deny - [0:0]
>> :PRE_home_log - [0:0]
>> -A PREROUTING -j PREROUTING_direct
>> -A PREROUTING -j PREROUTING_ZONES_SOURCE
>> -A PREROUTING -j PREROUTING_ZONES
>> -A INPUT -j INPUT_direct
>> -A FORWARD -j FORWARD_direct
>> -A OUTPUT -j OUTPUT_direct
>> -A POSTROUTING -j POSTROUTING_direct
>> -A PREROUTING_ZONES -i em1 -g PRE_home
>> -A PREROUTING_ZONES -g PRE_home
>> -A PRE_home -j PRE_home_log
>> -A PRE_home -j PRE_home_deny
>> -A PRE_home -j PRE_home_allow
>> COMMIT
>> # Completed on Tue Mar 11 10:13:32 2014
>> # Generated by iptables-save v1.4.18 on Tue Mar 11 10:13:32 2014
>> *security
>> :INPUT ACCEPT [525887:593042099]
>> :FORWARD ACCEPT [0:0]
>> :OUTPUT ACCEPT [481341:480231594]
>> :FORWARD_direct - [0:0]
>> :INPUT_direct - [0:0]
>> :OUTPUT_direct - [0:0]
>> -A INPUT -j INPUT_direct
>> -A FORWARD -j FORWARD_direct
>> -A OUTPUT -j OUTPUT_direct
>> COMMIT
>> # Completed on Tue Mar 11 10:13:32 2014
>> # Generated by iptables-save v1.4.18 on Tue Mar 11 10:13:32 2014
>> *raw
>> :PREROUTING ACCEPT [527281:593251924]
>> :OUTPUT ACCEPT [481341:480231594]
>> :OUTPUT_direct - [0:0]
>> :PREROUTING_direct - [0:0]
>> -A PREROUTING -j PREROUTING_direct
>> -A OUTPUT -j OUTPUT_direct
>> COMMIT
>> # Completed on Tue Mar 11 10:13:32 2014
>> # Generated by iptables-save v1.4.18 on Tue Mar 11 10:13:32 2014
>> *filter
>> :INPUT ACCEPT [0:0]
>> :FORWARD ACCEPT [0:0]
>> :OUTPUT ACCEPT [481339:480231494]
>> :FORWARD_IN_ZONES - [0:0]
>> :FORWARD_IN_ZONES_SOURCE - [0:0]
>> :FORWARD_OUT_ZONES - [0:0]
>> :FORWARD_OUT_ZONES_SOURCE - [0:0]
>> :FORWARD_direct - [0:0]
>> :FWDI_home - [0:0]
>> :FWDI_home_allow - [0:0]
>> :FWDI_home_deny - [0:0]
>> :FWDI_home_log - [0:0]
>> :FWDO_home - [0:0]
>> :FWDO_home_allow - [0:0]
>> :FWDO_home_deny - [0:0]
>> :FWDO_home_log - [0:0]
>> :INPUT_ZONES - [0:0]
>> :INPUT_ZONES_SOURCE - [0:0]
>> :INPUT_direct - [0:0]
>> :IN_home - [0:0]
>> :IN_home_allow - [0:0]
>> :IN_home_deny - [0:0]
>> :IN_home_log - [0:0]
>> :OUTPUT_direct - [0:0]
>> -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
>> -A INPUT -i lo -j ACCEPT
>> -A INPUT -j INPUT_direct
>> -A INPUT -j INPUT_ZONES_SOURCE
>> -A INPUT -j INPUT_ZONES
>> -A INPUT -p icmp -j ACCEPT
>> -A INPUT -j REJECT --reject-with icmp-host-prohibited
>> -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
>> -A FORWARD -i lo -j ACCEPT
>> -A FORWARD -j FORWARD_direct
>> -A FORWARD -j FORWARD_IN_ZONES_SOURCE
>> -A FORWARD -j FORWARD_IN_ZONES
>> -A FORWARD -j FORWARD_OUT_ZONES_SOURCE
>> -A FORWARD -j FORWARD_OUT_ZONES
>> -A FORWARD -p icmp -j ACCEPT
>> -A FORWARD -j REJECT --reject-with icmp-host-prohibited
>> -A OUTPUT -j OUTPUT_direct
>> -A FORWARD_IN_ZONES -i em1 -g FWDI_home
>> -A FORWARD_IN_ZONES -g FWDI_home
>> -A FORWARD_OUT_ZONES -o em1 -g FWDO_home
>> -A FORWARD_OUT_ZONES -g FWDO_home
>> -A FWDI_home -j FWDI_home_log
>> -A FWDI_home -j FWDI_home_deny
>> -A FWDI_home -j FWDI_home_allow
>> -A FWDO_home -j FWDO_home_log
>> -A FWDO_home -j FWDO_home_deny
>> -A FWDO_home -j FWDO_home_allow
>> -A INPUT_ZONES -i em1 -g IN_home
>> -A INPUT_ZONES -g IN_home
>> -A IN_home -j IN_home_log
>> -A IN_home -j IN_home_deny
>> -A IN_home -j IN_home_allow
>> -A IN_home_allow -d 224.0.0.251/32 -p udp -m udp --dport 5353 -m
>> conntrack --ctstate NEW -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 137 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 138 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 139 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 445 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 80 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 443 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 631 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 5900:5903 -m conntrack
>> --ctstate NEW -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 25 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 993 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 631 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 631 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 1194 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 53 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 53 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 3306 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 5432 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 123 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 995 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 137 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 138 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 51413 -m conntrack --ctstate
>> NEW -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 5059:5061 -m conntrack
>> --ctstate NEW -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 1998 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 54925 -m conntrack --ctstate
>> NEW -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 5269 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 5900:5999 -m conntrack
>> --ctstate NEW -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 5298 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 587 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 1998 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 8181 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 5222:5223 -m conntrack
>> --ctstate NEW -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 1099 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 6881:6999 -m conntrack
>> --ctstate NEW -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 6566 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 8080 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 9090:9091 -m conntrack
>> --ctstate NEW -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 4000:4050 -m conntrack
>> --ctstate NEW -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 5900:5999 -m conntrack
>> --ctstate NEW -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 5059:5061 -m conntrack
>> --ctstate NEW -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 3551 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 4848 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 5298 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 5222:5223 -m conntrack
>> --ctstate NEW -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 6881:6999 -m conntrack
>> --ctstate NEW -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 5280:5281 -m conntrack
>> --ctstate NEW -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 4000:4050 -m conntrack
>> --ctstate NEW -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 587 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 5800:5899 -m conntrack
>> --ctstate NEW -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 3551 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 6566 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 9090:9091 -m conntrack
>> --ctstate NEW -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 4848 -m conntrack --ctstate NEW
>> -j ACCEPT
>> COMMIT
>> # Completed on Tue Mar 11 10:13:32 2014
>>
>>>
>>>> What am I missing?
>>>
>>> No idea.
>>>
>>> --
>>> Jiri
>>>
>>>
>>> _______________________________________________
>>> firewalld-users mailing list
>>> firewalld-users at lists.fedorahosted.org
>>> https://lists.fedorahosted.org/mailman/listinfo/firewalld-users
>>
>
> _______________________________________________
> firewalld-users mailing list
> firewalld-users at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/firewalld-users


More information about the firewalld-users mailing list