Ways to limit outgoing traffic?

Jiri Popelka jpopelka at redhat.com
Mon Oct 13 11:25:47 UTC 2014


On 10/06/2014 07:41 PM, Rufe Glick wrote:
> While skimming through this mailing list's archives I saw that this
> question was raised a couple of times. And last time in August of this
> year Jiri reiterated that "So far we don't handle outbound traffic in
> firewalld".
>
> So if I still need to limit outgoing traffic what is the best way to
> proceed? I could probably use the direct interface. But then I'll have
> to write a daemon that'll handle reload\reboot events of firewalld to
> re-add the rules. That sounds a bit complicated.

Have you known that 'direct' configuration can be stored in
/etc/firewalld/direct.xml ?
see firewalld.direct man page.
Or you can use firewall-cmd like for example:
$ firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 -p 
tcp -m tcp --sport 1234 -j DROP

Or perhaps I don't understand your use case.

> The only solution I see is to disable the firewalld service altogether
> and fall back to iptables service.
>
> Any other ideas?
>
> Also in my opinion a full value firewall solution has to have an
> ability to limit outgoing traffic. Are there plans to incorporate this
> functionality any time soon?

None that I know of.

--
Jiri



More information about the firewalld-users mailing list