New to firewalld, Questions about getting started.

Joe Lawrence joe.lawrence at stratus.com
Sun Jun 7 17:59:50 UTC 2015


On 06/07/2015 07:44 AM, Jorge Fábregas wrote:
> This doesn't make sense. Are you *sure* that you are unable to connect
> when using "UseDNS yes"? If the server doesn't have DNS properly
> configured what you should experience is a *very long delay* before
> getting the login prompt.  I believe that, perhaps, you're not waiting
> enough & thus you're believing that you aren't able to connect?

Eventually the login prompt appears (minutes later), but the login
always ends up timing out from the long delay.  But it turns out that
UseDNS was a very important clue!  Something popped into my head on
Friday -- we're applying additional configuration to nsswitch.conf in
order to set up the box as an NIS client (yes, in 2015! :(

If "nis" was removed from the hosts line of nsswitch.conf, then logins
proceeded normally, even with the firewall up.  Put it back in and a
simple "gethostbyname()" test program failed.

Turning off firewalld and then applying the following iptables rule:

% iptables -I INPUT -m state --state NEW -j LOG

we could see the NIS server attempting to connect back to our box on
several UDP ports (anywhere from 600 to 1000) upon ssh login.

so I added a rich-rule to the default zone:

...
  <rule family="ipv4">
    <source address="www.xxx.yyy.zzz"/>
    <port protocol="udp" port="512-1023"/>
    <accept/>
  </rule>
...

to allow these connections to the machine.  Logins appear to be
functioning now.

It would be great if firewalld (or firewall-config) provided a logging
mechanism to help examine dropped packets.  Even nicer would be a
"learning mode" that could be enabled while various services are
exercised and a summary of ports/protocols/sources suggested for the
firewall exclusion. Easier said than done perhaps.

Anyway, thanks everyone for the help and suggestions along the way!

-- Joe


More information about the firewalld-users mailing list