Trusted zone not completely trusted. [was Re: Exporting Changes]

John Griffiths fedora.jrg01 at grifent.com
Wed Mar 26 16:12:18 UTC 2014


Thanks Thomas. I removed the additional allow of the tcp and udp ports.

On 03/26/2014 11:57 AM, Thomas Woerner wrote:
> On 03/11/2014 03:17 PM, John Griffiths wrote:
>>
>> On 03/11/2014 09:31 AM, Jiri Popelka wrote:
>>> On 03/07/2014 09:42 PM, John Griffiths wrote:
>>>> I have a VPN that is in the "trusted" zone. The trusted zone has no
>>>> services enabled but has ports 0-65535 TCP and UDP.
>>>
>>> Could you attach the XML file of your "trusted" zone ?
>>>
>> <?xml version="1.0" encoding="utf-8"?>
>> <zone target="ACCEPT">
>>    <short>Trusted</short>
>>    <description>All network connections are accepted.</description>
>>    <port protocol="tcp" port="0-65535"/>
>>    <port protocol="udp" port="0-65535"/>
>> </zone>
>>
> With the target=ACCEPT everything in the zone is accepted that is not 
> configured to be rejected or dropped.
>
> There is no need to additionally allow tcp and udp ports 0-65535.
>
> Regards,
> Thomas
>
>>>> When I bring up the VPN, not all the ports seem to be open.
>>>
>>> Also iptables-save output would be useful.
>> This is with the VPN up.
>>
>> # Generated by iptables-save v1.4.18 on Tue Mar 11 10:13:32 2014
>> *nat
>> :PREROUTING ACCEPT [5273:585641]
>> :INPUT ACCEPT [4009:381138]
>> :OUTPUT ACCEPT [23604:1760232]
>> :POSTROUTING ACCEPT [23604:1760232]
>> :OUTPUT_direct - [0:0]
>> :POSTROUTING_ZONES - [0:0]
>> :POSTROUTING_ZONES_SOURCE - [0:0]
>> :POSTROUTING_direct - [0:0]
>> :POST_home - [0:0]
>> :POST_home_allow - [0:0]
>> :POST_home_deny - [0:0]
>> :POST_home_log - [0:0]
>> :PREROUTING_ZONES - [0:0]
>> :PREROUTING_ZONES_SOURCE - [0:0]
>> :PREROUTING_direct - [0:0]
>> :PRE_home - [0:0]
>> :PRE_home_allow - [0:0]
>> :PRE_home_deny - [0:0]
>> :PRE_home_log - [0:0]
>> -A PREROUTING -j PREROUTING_direct
>> -A PREROUTING -j PREROUTING_ZONES_SOURCE
>> -A PREROUTING -j PREROUTING_ZONES
>> -A OUTPUT -j OUTPUT_direct
>> -A POSTROUTING -j POSTROUTING_direct
>> -A POSTROUTING -j POSTROUTING_ZONES_SOURCE
>> -A POSTROUTING -j POSTROUTING_ZONES
>> -A POSTROUTING_ZONES -o em1 -g POST_home
>> -A POSTROUTING_ZONES -g POST_home
>> -A POST_home -j POST_home_log
>> -A POST_home -j POST_home_deny
>> -A POST_home -j POST_home_allow
>> -A PREROUTING_ZONES -i em1 -g PRE_home
>> -A PREROUTING_ZONES -g PRE_home
>> -A PRE_home -j PRE_home_log
>> -A PRE_home -j PRE_home_deny
>> -A PRE_home -j PRE_home_allow
>> COMMIT
>> # Completed on Tue Mar 11 10:13:32 2014
>> # Generated by iptables-save v1.4.18 on Tue Mar 11 10:13:32 2014
>> *mangle
>> :PREROUTING ACCEPT [527279:593251824]
>> :INPUT ACCEPT [527279:593251824]
>> :FORWARD ACCEPT [0:0]
>> :OUTPUT ACCEPT [481339:480231494]
>> :POSTROUTING ACCEPT [482918:480524178]
>> :FORWARD_direct - [0:0]
>> :INPUT_direct - [0:0]
>> :OUTPUT_direct - [0:0]
>> :POSTROUTING_direct - [0:0]
>> :PREROUTING_ZONES - [0:0]
>> :PREROUTING_ZONES_SOURCE - [0:0]
>> :PREROUTING_direct - [0:0]
>> :PRE_home - [0:0]
>> :PRE_home_allow - [0:0]
>> :PRE_home_deny - [0:0]
>> :PRE_home_log - [0:0]
>> -A PREROUTING -j PREROUTING_direct
>> -A PREROUTING -j PREROUTING_ZONES_SOURCE
>> -A PREROUTING -j PREROUTING_ZONES
>> -A INPUT -j INPUT_direct
>> -A FORWARD -j FORWARD_direct
>> -A OUTPUT -j OUTPUT_direct
>> -A POSTROUTING -j POSTROUTING_direct
>> -A PREROUTING_ZONES -i em1 -g PRE_home
>> -A PREROUTING_ZONES -g PRE_home
>> -A PRE_home -j PRE_home_log
>> -A PRE_home -j PRE_home_deny
>> -A PRE_home -j PRE_home_allow
>> COMMIT
>> # Completed on Tue Mar 11 10:13:32 2014
>> # Generated by iptables-save v1.4.18 on Tue Mar 11 10:13:32 2014
>> *security
>> :INPUT ACCEPT [525887:593042099]
>> :FORWARD ACCEPT [0:0]
>> :OUTPUT ACCEPT [481341:480231594]
>> :FORWARD_direct - [0:0]
>> :INPUT_direct - [0:0]
>> :OUTPUT_direct - [0:0]
>> -A INPUT -j INPUT_direct
>> -A FORWARD -j FORWARD_direct
>> -A OUTPUT -j OUTPUT_direct
>> COMMIT
>> # Completed on Tue Mar 11 10:13:32 2014
>> # Generated by iptables-save v1.4.18 on Tue Mar 11 10:13:32 2014
>> *raw
>> :PREROUTING ACCEPT [527281:593251924]
>> :OUTPUT ACCEPT [481341:480231594]
>> :OUTPUT_direct - [0:0]
>> :PREROUTING_direct - [0:0]
>> -A PREROUTING -j PREROUTING_direct
>> -A OUTPUT -j OUTPUT_direct
>> COMMIT
>> # Completed on Tue Mar 11 10:13:32 2014
>> # Generated by iptables-save v1.4.18 on Tue Mar 11 10:13:32 2014
>> *filter
>> :INPUT ACCEPT [0:0]
>> :FORWARD ACCEPT [0:0]
>> :OUTPUT ACCEPT [481339:480231494]
>> :FORWARD_IN_ZONES - [0:0]
>> :FORWARD_IN_ZONES_SOURCE - [0:0]
>> :FORWARD_OUT_ZONES - [0:0]
>> :FORWARD_OUT_ZONES_SOURCE - [0:0]
>> :FORWARD_direct - [0:0]
>> :FWDI_home - [0:0]
>> :FWDI_home_allow - [0:0]
>> :FWDI_home_deny - [0:0]
>> :FWDI_home_log - [0:0]
>> :FWDO_home - [0:0]
>> :FWDO_home_allow - [0:0]
>> :FWDO_home_deny - [0:0]
>> :FWDO_home_log - [0:0]
>> :INPUT_ZONES - [0:0]
>> :INPUT_ZONES_SOURCE - [0:0]
>> :INPUT_direct - [0:0]
>> :IN_home - [0:0]
>> :IN_home_allow - [0:0]
>> :IN_home_deny - [0:0]
>> :IN_home_log - [0:0]
>> :OUTPUT_direct - [0:0]
>> -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
>> -A INPUT -i lo -j ACCEPT
>> -A INPUT -j INPUT_direct
>> -A INPUT -j INPUT_ZONES_SOURCE
>> -A INPUT -j INPUT_ZONES
>> -A INPUT -p icmp -j ACCEPT
>> -A INPUT -j REJECT --reject-with icmp-host-prohibited
>> -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
>> -A FORWARD -i lo -j ACCEPT
>> -A FORWARD -j FORWARD_direct
>> -A FORWARD -j FORWARD_IN_ZONES_SOURCE
>> -A FORWARD -j FORWARD_IN_ZONES
>> -A FORWARD -j FORWARD_OUT_ZONES_SOURCE
>> -A FORWARD -j FORWARD_OUT_ZONES
>> -A FORWARD -p icmp -j ACCEPT
>> -A FORWARD -j REJECT --reject-with icmp-host-prohibited
>> -A OUTPUT -j OUTPUT_direct
>> -A FORWARD_IN_ZONES -i em1 -g FWDI_home
>> -A FORWARD_IN_ZONES -g FWDI_home
>> -A FORWARD_OUT_ZONES -o em1 -g FWDO_home
>> -A FORWARD_OUT_ZONES -g FWDO_home
>> -A FWDI_home -j FWDI_home_log
>> -A FWDI_home -j FWDI_home_deny
>> -A FWDI_home -j FWDI_home_allow
>> -A FWDO_home -j FWDO_home_log
>> -A FWDO_home -j FWDO_home_deny
>> -A FWDO_home -j FWDO_home_allow
>> -A INPUT_ZONES -i em1 -g IN_home
>> -A INPUT_ZONES -g IN_home
>> -A IN_home -j IN_home_log
>> -A IN_home -j IN_home_deny
>> -A IN_home -j IN_home_allow
>> -A IN_home_allow -d 224.0.0.251/32 -p udp -m udp --dport 5353 -m
>> conntrack --ctstate NEW -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 137 -m conntrack --ctstate NEW -j
>> ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 138 -m conntrack --ctstate NEW -j
>> ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 139 -m conntrack --ctstate NEW -j
>> ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 445 -m conntrack --ctstate NEW -j
>> ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 80 -m conntrack --ctstate NEW -j
>> ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 443 -m conntrack --ctstate NEW -j
>> ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 631 -m conntrack --ctstate NEW -j
>> ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 5900:5903 -m conntrack --ctstate
>> NEW -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 25 -m conntrack --ctstate NEW -j
>> ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 993 -m conntrack --ctstate NEW -j
>> ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 631 -m conntrack --ctstate NEW -j
>> ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 631 -m conntrack --ctstate NEW -j
>> ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 1194 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j
>> ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 53 -m conntrack --ctstate NEW -j
>> ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 53 -m conntrack --ctstate NEW -j
>> ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 3306 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 5432 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 123 -m conntrack --ctstate NEW -j
>> ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 995 -m conntrack --ctstate NEW -j
>> ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 137 -m conntrack --ctstate NEW -j
>> ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 138 -m conntrack --ctstate NEW -j
>> ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 51413 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 5059:5061 -m conntrack --ctstate
>> NEW -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 1998 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 54925 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 5269 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 5900:5999 -m conntrack --ctstate
>> NEW -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 5298 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 587 -m conntrack --ctstate NEW -j
>> ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 1998 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 8181 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 5222:5223 -m conntrack --ctstate
>> NEW -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 1099 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 6881:6999 -m conntrack --ctstate
>> NEW -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 6566 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 8080 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 9090:9091 -m conntrack --ctstate
>> NEW -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 4000:4050 -m conntrack --ctstate
>> NEW -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 5900:5999 -m conntrack --ctstate
>> NEW -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 5059:5061 -m conntrack --ctstate
>> NEW -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 3551 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 4848 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 5298 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 5222:5223 -m conntrack --ctstate
>> NEW -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 6881:6999 -m conntrack --ctstate
>> NEW -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 5280:5281 -m conntrack --ctstate
>> NEW -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 4000:4050 -m conntrack --ctstate
>> NEW -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 587 -m conntrack --ctstate NEW -j
>> ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 5800:5899 -m conntrack --ctstate
>> NEW -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 3551 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 6566 -m conntrack --ctstate NEW
>> -j ACCEPT
>> -A IN_home_allow -p udp -m udp --dport 9090:9091 -m conntrack --ctstate
>> NEW -j ACCEPT
>> -A IN_home_allow -p tcp -m tcp --dport 4848 -m conntrack --ctstate NEW
>> -j ACCEPT
>> COMMIT
>> # Completed on Tue Mar 11 10:13:32 2014
>>
>>>
>>>> What am I missing?
>>>
>>> No idea.
>>>
>>> -- 
>>> Jiri
>>>
>>>
>>> _______________________________________________
>>> firewalld-users mailing list
>>> firewalld-users at lists.fedorahosted.org
>>> https://lists.fedorahosted.org/mailman/listinfo/firewalld-users
>>
>> _______________________________________________
>> firewalld-users mailing list
>> firewalld-users at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/firewalld-users
> _______________________________________________
> firewalld-users mailing list
> firewalld-users at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/firewalld-users



More information about the firewalld-users mailing list