firewalld example gateway
Andrus, Brian Contractor
bdandrus at nps.edu
Wed Oct 22 14:55:55 UTC 2014
Igor,
That would be useful. I beat my head all over trying to figure out part of it.
The standard masquerade for a zone makes it possible to NAT outgoing traffic from internal boxes using the firewalld box as a default gateway.
firewall-cmd --permanenet --add-masquerade --zone=internal
You can also use --direct passthrough commands to set up specific forwarding:
firewall-cmd --permanent --direct --passthrough ipv4 -t nat -I PRE_public -d 204.1.8.12 -j DNAT --to 10.1.1.4
firewall-cmd --permanent --direct --passthrough ipv4 -t nat -I POST_public -s 10.1.1.4 -j SNAT --to 204.1.8.12
Now here is the caveat:
If you are doing both, that masquerade command comes first.
You would normally see '-A' in your /etc/sysconfig/iptables file.
BUT, with firewalld, it needs to INSERT it instead of APPEND. THAT is why you need the '-I' instead of '-A' for the rule.
I beat my head on the wall over that for a bit.... o.O
Hope this helps you and at least this will be in the archive now until someone remembers to add it to some example..
Brian Andrus
ITACS/Research Computing
Naval Postgraduate School
Monterey, California
voice: 831-656-6238
-----Original Message-----
From: firewalld-users-bounces at lists.fedorahosted.org [mailto:firewalld-users-bounces at lists.fedorahosted.org] On Behalf Of Igor Gnatenko
Sent: Tuesday, October 21, 2014 11:56 PM
To: Firewalld users discussion list
Subject: firewalld example gateway
Hi,
many people using Fedora/CentOS/RHEL/.. for organizing gateways, with transparent proxy or with many other options. And they using iptables.
I have not seen any examples for organizing gateway with/without transparent proxy using firewalld.
I think would be good if we will have this how-to.
Thoughts?
P.S. I can't write this doc, because I can't set it up =(
--
-Igor Gnatenko
_______________________________________________
firewalld-users mailing list
firewalld-users at lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/firewalld-users
More information about the firewalld-users
mailing list