Actions only enforced in certain zones?

Chris Bell alostengineer at gmail.com
Fri Jul 24 18:44:36 UTC 2015


Hi all,

I'm having an incredibly frustrating time getting firewalld to function
properly, and it seems to come down to peculiar behavior regarding rules
and zones.

My box is connected to 3 networks: two internal and one public. The two
internal networks are bridged and routed properly: with firewalld
completely disabled, all traffic back-and-forth across the networks is
properly routed. When I enabled firewalld and added the bridge (and both
actual interfaces) to the 'trusted' zone, routing suddenly broke. All ssh
connections were being forwarded to one specific machine on the network for
any address in either internal subnet. I tried various fixes, but nothing
worked until: I moved the interfaces from 'trusted' to 'internal'. Now they
route properly, and internet traffic is correctly routed via the public
network (via NAT/masquerade).

Then the second quirk: I wanted to block ICMP echo requests from the
external network. At the time, I had the NIC connected to the public
network in the 'external' zone. When I added the icmp-block for
echo-request and echo-reply, and tried pinging that IP, the pings returned
fine. I added every single supported ICMP block, and even tried blocking
them with rich rules, but nothing worked. Until: I moved the interface from
'external' to 'public'.

So, my question is, what gives? The documentation is... very vague about
how, exactly, these zones are treated by firewalld's internal mechanics.
Inter-NIC routing doesn't work in TRUSTED. ICMP blocks only work in PUBLIC.
I've tested this extensively on my box, with consistent results. Am I
missing something?

$ firewall-cmd --version
0.3.14.2

Thanks in advance!

Chris
-- 
Chris Bell

PGP Key ID: 63949CD7

Ph.D. Candidate, Teaching Assistant, Gentleman, Scholar, Penguin Wrangler
University of South Florida
College of Engineering
Department of Computer Science and Engineering
NarMOS Research Team, Official Daemon Charmer

PGP Public Key: http://narmos.org/~cwbell/63949CD7.pub.gpg.asc
Fingerprint: 26EB C946 AAB6 76BE 476E  F96D FF34 7DC9 6394 9CD7
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/firewalld-users/attachments/20150724/4ef89b35/attachment.html>


More information about the firewalld-users mailing list