firewalld-users November 2016

firewalld-users@lists.fedorahosted.org

2 participants
2 discussions

Samba broken after firewalld update
by Giovanni Santini 14 Dec '16

14 Dec '16

Good morning, I am contacting you as I have a weird issue. I upgraded firewalld from 4.1.2 to 4.3.3; in 4.1.2 I never had problems with Samba shares, but, with the last update, I can't access my Samba server. I tried disabling and re-enabling the samba service in the firewalld configuration, but I didn't have success. The only way I can access my Samba server is to disable firewalld... I can't figure out why it won't work using the proper service. Thanks in advance. -- Giovanni Santini My blog: http://giovannisantini.tk My code: https://github.com/ItachiSan My code, again: https://gitlab.com/u/ItachiSan My Twitter: https://twitter.com/santini__gio My Facebook: https://www.facebook.com/giovanni.santini My Google+: https://plus.google.com/+GiovanniSantini/ My GPG: 2FADEBF5

2 13

Please help me to convert these VPN Kill Switch rules to scripts !!
by Yousif Kadom 05 Nov '16

05 Nov '16

Hi. After very hard search online I discover how can we do Internet Kill Switch for VPN. Please see this link starting from my reply (comment 31) & forward: http://www.forums.fedoraforum.org/showthread.php?t=311476&page=3 As you see it working 1000000% but we have couple of annoying points: 1) we have to enter 10 (or 11) commands every time we like to enable this Kill Switch rules 2) we need to reboot PC so as to disable Kill Switch rules or to remove all these 10 (11) rules one by one. 3) these rules does not work on user created zone. If you try to create a zone & applied these rules to this zone then you will not be able to connect to internet whether you use this user created zone or any of default zones of Firewalld like public, I you will never be able to restore ability to connect to internet unless by removing these rules from user created zone that you added these rules to it !! Why ??!!! So, we need to convert them to scripts. Unfortunately I'm not programmer & it is very difficult to me to learn this due to my place where no one can learn me & trying to learn programming by search internet is very difficult. So, can any one help us to convert these rules to scripts ? We need to convert 4 groups of rules as following: A) To build Kill Switch which allow for only out from VPN (maximum security: not allow torrent): A-1) To enable such Kill Switch the following rules needed in separate script: sudo firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -o tun+ -j ACCEPT sudo firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i tun+ -j ACCEPT sudo firewall-cmd --direct --add-rule ipv6 filter INPUT 0 -j DROP sudo firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -i lo -j ACCEPT sudo firewall-cmd --direct --add-rule ipv4 filter INPUT 999 -j DROP sudo firewall-cmd --direct --add-rule ipv6 filter OUTPUT 0 -j DROP sudo firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -o lo -j ACCEPT sudo firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -o tun+ -j ACCEPT sudo firewall-cmd --direct --add-rule ipv4 filter OUTPUT 1 -p udp -m udp --dport 443 -j ACCEPT sudo firewall-cmd --direct --add-rule ipv4 filter OUTPUT 999 -j DROP A-2) To disable such Kill Switch without rebooting PC we need the following rules in seperate script: sudo firewall-cmd --direct --remove-rule ipv4 filter FORWARD 0 -o tun+ -j ACCEPT sudo firewall-cmd --direct --remove-rule ipv4 filter FORWARD 0 -i tun+ -j ACCEPT sudo firewall-cmd --direct --remove-rule ipv6 filter INPUT 0 -j DROP sudo firewall-cmd --direct --remove-rule ipv4 filter INPUT 0 -i lo -j ACCEPT sudo firewall-cmd --direct --remove-rule ipv4 filter INPUT 999 -j DROP sudo firewall-cmd --direct --remove-rule ipv6 filter OUTPUT 0 -j DROP sudo firewall-cmd --direct --remove-rule ipv4 filter OUTPUT 0 -o lo -j ACCEPT sudo firewall-cmd --direct --remove-rule ipv4 filter OUTPUT 0 -o tun+ -j ACCEPT sudo firewall-cmd --direct --remove-rule ipv4 filter OUTPUT 1 -p udp -m udp --dport 443 -j ACCEPT sudo firewall-cmd --direct --remove-rule ipv4 filter OUTPUT 999 -j DROP -------------------------------------- B) To build Kill Switch which allow for both in & out from VPN (allow torrent): B-1) To enable such Kill Switch the following rules needed in separate script: sudo firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -o tun+ -j ACCEPT sudo firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i tun+ -j ACCEPT sudo firewall-cmd --direct --add-rule ipv6 filter INPUT 0 -j DROP sudo firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -i lo -j ACCEPT sudo firewall-cmd --direct --add-rule ipv4 filter INPUT 1 -i tun+ -p udp --dport 443 -j ACCEPT sudo firewall-cmd --direct --add-rule ipv4 filter INPUT 999 -j DROP sudo firewall-cmd --direct --add-rule ipv6 filter OUTPUT 0 -j DROP sudo firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -o lo -j ACCEPT sudo firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -o tun+ -j ACCEPT sudo firewall-cmd --direct --add-rule ipv4 filter OUTPUT 1 -p udp -m udp --dport 443 -j ACCEPT sudo firewall-cmd --direct --add-rule ipv4 filter OUTPUT 999 -j DROP B-2) To disable such Kill Switch without rebooting PC we need the following rules in seperate script: sudo firewall-cmd --direct --remove-rule ipv4 filter FORWARD 0 -o tun+ -j ACCEPT sudo firewall-cmd --direct --remove-rule ipv4 filter FORWARD 0 -i tun+ -j ACCEPT sudo firewall-cmd --direct --remove-rule ipv6 filter INPUT 0 -j DROP sudo firewall-cmd --direct --remove-rule ipv4 filter INPUT 0 -i lo -j ACCEPT sudo firewall-cmd --direct --remove-rule ipv4 filter INPUT 1 -i tun+ -p udp --dport 443 -j ACCEPT sudo firewall-cmd --direct --remove-rule ipv4 filter INPUT 999 -j DROP sudo firewall-cmd --direct --remove-rule ipv6 filter OUTPUT 0 -j DROP sudo firewall-cmd --direct --remove-rule ipv4 filter OUTPUT 0 -o lo -j ACCEPT sudo firewall-cmd --direct --remove-rule ipv4 filter OUTPUT 0 -o tun+ -j ACCEPT sudo firewall-cmd --direct --remove-rule ipv4 filter OUTPUT 1 -p udp -m udp --dport 443 -j ACCEPT sudo firewall-cmd --direct --remove-rule ipv4 filter OUTPUT 999 -j DROP -------------------------------- Any one can convert these 4 sets of rules to 4 corresponding scripts will give great help for many users of Firewalld by making VPN usage with it reliable. VPN without Kill Switch useless.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

firewalld-users November 2016