firewalld-users August 2015

firewalld-users@lists.fedorahosted.org

9 participants
7 discussions

Errors with dbus
by What you get is Not what you see 01 Sep '15

01 Sep '15

Hi I have been getting error messages on syslog after giving some firewalld commands. This must be about dbus integration of firewalld. Could you help? My system is Centos 7.1 minimal. dbus[125]: [system] Rejected send message, 0 matched rules; type="error", sender=":1.53" (uid=0 pid=6445 comm="/usr/bin/python -Es /usr/sbin/ firewalld --nofork -") interface="(unset)" member="(unset)" error name="org.freedesktop.DBus.Error.ServiceUnknown" requested_reply="0" destination=":1.145" (uid=0 pi d=8803 comm="/usr/bin/python -Es /bin/firewall-cmd --list-all-z

2 1

Services questions
by Robert Moskowitz 01 Sep '15

01 Sep '15

For the past year, I just kind of hacked along with small things with firewalld. But now I am configuring a Samba AD and that means lots of rules. See: https://wiki.samba.org/index.php/Samba_AD_DC_port_usage I am trying really hard to stay with firewalld services and only do ports where I have to. So right away I see a few things: Why is the ldap service tcp only? # cat /usr/lib/firewalld/services/ldap.xml <?xml version="1.0" encoding="utf-8"?> <service> <short>LDAP</short> <description>Lightweight Directory Access Protocol (LDAP) server</description> <port protocol="tcp" port="389"/> </service> Seems this should also include udp. Whereas mDNS is the flip. It has udp, but should also include tcp. Both of these I CAN handle with add-port, but wonder if the service rule is really set up wrong. One would expect these two services to be open for both ucp and tcp. Not one or the other. Finally I am suppose to enable "Dynamic RPC ports" which is 1024 - 5000 and I cannot find any guidance on setting that one up. Otherwise, an interesting service and one I am slooooowly learning. thanks

2 2

firewall-applet-qt debut
by Marcos Alano 24 Aug '15

24 Aug '15

Hello folks! Any idea which version fireawall-applet-qt{5} will come to main branch to become part of a stable version? Cheers. -- Marcos Alano ---------------------------------------------- P: Por que este email é tão curto? R: http://five.sentenc.es ----------------------------------------------

2 1

what are the advantages of firewalld over iptables?
by Patrick Hinkley 24 Aug '15

24 Aug '15

this is probably a silly question, but I haven't been able to find a very good comparison outlining the advantages of firewalld over iptables -- what are they?

5 7

how to block incoming and outgoing connections with IP?
by Patrick Hinkley 17 Aug '15

17 Aug '15

Given an IP address, how can I prevent any connection both to and from that IP? If there are multiple methods, please describe the pros and cons of each. I've found a lot of contradictory and confusing information about this online and in the documentation. Thanks for any help!

2 2

MAC source support in firewalld
by Thomas Woerner 14 Aug '15

14 Aug '15

Hello, here is a new branch that adds MAC source address support to firewalld: https://github.com/t-woerner/firewalld/commits/source_mac MAC sources can be used in rich rules and also as source bindings in zones. There is a limitation though with MAC source bindings in zones: Port forwarding and masquerading rules in the zones do not have an effect for the MAC sources. Please give it a try and report the issues you are running into. Regards, Thomas

1 0

Using firewall-cmd to restrict ICMP echo request and ICMP echo reply to local subnet?
by Tom Leach 12 Aug '15

12 Aug '15

Hello, I'm transitioning over to firewalld from iptables and one of the iptables rules that I had was to allow ICMP pings to/from other systems on my local subnet, but block ICMP pings to/from systems outside of my local subnet. The systems are all clients so I don't have a LAN/WAN dual network port setup. When firewall-cmd translates the old iptables into firewalld rules, the subnet portion is removed and I'm left with a block all/unblock all situation. Is there a way to use either a rich rule or a direct rule to allow full ICMP access to specified subnets and block all others? I'm looking for something like: firewall-cmd --permanent --zone=public --add-rich-rule='rule protocol=icmp source address="192.168.100.0/24" accept' firewall-cmd --permanent --zone=public --add-icmp-block=echo-reply,echo-request which I expect to allow any ICMP packet originating from a host in 192.168.100.0/24 but all others are dropped. Thanks! Tom Leach

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

firewalld-users August 2015