firewalld-users December 2017

firewalld-users@lists.fedorahosted.org

6 participants
5 discussions

Firewalld & IPv6
by Paavo Leinonen 04 Jun '18

04 Jun '18

Hi, I'm running firewalld in a router that connects the devices in my home LAN to internet. I have recently added IPv6 DHCPv6 config to the router, and prefix delegation works, so the devices in my home LAN get proper IPv6 addresses. However, I don't like the idea that all IPv6 enabled devices in my home LAN have public IPv6 addresses. I'd very much prefer simple IPv4 -style NAT approach to protect the devices in home LAN from being accessed from the internet. How do I implement something like this with firewalld in the router? wanif=eth0 lanif=eth1 ip6tables -A FORWARD -m state --state NEW -i $lanif -o $wanif -j ACCEPT ip6tables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT ip6tables -P FORWARD DROP Other ways to protect the devices in my home LAN being accessed from the internet? -Paavo

2 2

question on DNAT or Port forwarding with firewalld
by nitesh sinha 11 Jan '18

11 Jan '18

Hi List, I have a query regarding firewalld configuration. If this is not the correct place to ask, please redirect me to the correct place which is. i am trying to setup Port forwarding from https (443) port to application port (8443). The application runs on non-standard port i am able to DNAT it to the outside world on 443. These are the iptable rules that work for me. #for remote connections iptables -t nat -A PREROUTING -i eno16777984 -p tcp --dport 443 -j DNAT --to-destination 127.0.0.1:8443 iptables -A FORWARD -i eno16777984 -m state --state NEW -m tcp -p tcp -d 127.0.0.1 --dport 8443 -j ACCEPT #for localhost connections iptables -t nat -A OUTPUT -p tcp --dport 443 -d 127.0.0.1 -j DNAT --to-destination 127.0.0.1:8443 Now, with firewalld, i tried the following : added service (https) to public zone added port-forwarding : port=443:proto=tcp:toport=8443:toaddr=127.0.0.1 this did not work, so i tried adding rules using --direct firewall-cmd --direct --add-rule ipv4 nat PREROUTING 0 -i eno16777984 -d 127.0.0.1 -p tcp --dport 443 -j DNAT --to-destination 127.0.0.1:8443 firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i eno16777984 -m state --state NEW -m tcp -p tcp -d 127.0.0.1 --dport 8443 -j ACCEPT firewall-cmd --direct --add-rule ipv4 nat OUTPUT 0 -p tcp --dport 443 -d 127.0.0.1 -j DNAT --to-destination 127.0.0.1:8443 I assume that this will work, since these are exact rules what work with iptables. Working -> https://localhost:443 Not Working -> https://10.211.213.143:443/ (assuming this is the network ip of my machine) [root@jmaster ~]# firewall-cmd --direct --get-all-rule ipv4 nat OUTPUT 0 -p tcp --dport 443 -d 127.0.0.1 -j DNAT --to-destination 127.0.0.1:8443 ipv4 nat OUTPUT 0 -p tcp -o lo --dport 443 -j REDIRECT --to-ports 8443 ipv4 filter FORWARD 0 -i eno16777984 -m state --state NEW -m tcp -p tcp -d 127.0.0.1 --dport 8443 -j ACCEPT ipv4 nat PREROUTING 0 -i eno16777984 -p tcp --dport 443 -j DNAT --to-destination 127.0.0.1:8443 What should i do make the service accessible from outside on 443 ? Thanks in advance. Nitesh

2 1

Re: firewalld and ipsets
by John Griffiths 19 Dec '17

19 Dec '17

I implemented the use of ipsets for a direct rule in firewalld in 2013. The direct.xml is: <?xml version="1.0" encoding="utf-8"?> <direct>  <chain ipv="ipv4" table="raw" chain="PREROUTING_blacklist"/> <passthrough ipv="ipv4">-t raw -A PREROUTING_blacklist -m limit --limit 3/min -j LOG --log-prefix BLACKLIST_DROP: --log-level 6</passthrough> <passthrough ipv="ipv4">-t raw -A PREROUTING_blacklist -j DROP</passthrough> <passthrough ipv="ipv4">-t raw -A PREROUTING -m set --match-set blacklist src -j PREROUTING_blacklist</passthrough> <chain ipv="ipv6" table="raw" chain="PREROUTING_blacklist"/> <passthrough ipv="ipv6">-t raw -A PREROUTING_blacklist -m limit --limit 3/min -j LOG --log-prefix BLACKLIST_DROP: --log-level 6</passthrough> <passthrough ipv="ipv6">-t raw -A PREROUTING_blacklist -j DROP</passthrough> <passthrough ipv="ipv6">-t raw -A PREROUTING -m set --match-set blacklist src -j PREROUTING_blacklist</passthrough> </direct> I have several ipsets that are modified outside of firewalld. blacklist_ipv4_permanent blacklist_ipv4_semipermanent blacklist_ipv4_current blacklist_ipv6_permanent blacklist_ipv6_semipermanent blacklist_ipv6_current These are members of ipset blacklist: Name: blacklist Type: list:set Revision: 3 Header: size 8 Size in memory: 368 References: 0 Number of entries: 6 Members: blacklist_ipv4_permanent blacklist_ipv4_semipermanent blacklist_ipv4_current blacklist_ipv6_permanent blacklist_ipv6_semipermanent blacklist_ipv6_current This was working until I upgraded to Fedora 26 from Fedora 24. Now, even though an IP is in one of the member iplists, blacklist_ipv4_semipermanent or one of the others, firewalld does not block the IP. I do not know if this is an issue with ipsets or firewalld, nor do I know whether this is a "feature" or a bug. Since these ipsets are modified dynamically and need to be accessed from bash scripts, using the internal ipset functionality of firewalld is not my desired choice. Any insight or help in getting the ipsets working again with firewalld would be greatly appreciated. Thanks. John

3 5

Custom log file?
by Paavo Leinonen 19 Dec '17

19 Dec '17

Hi, LogDenied=all (or anything but off) in firewalld.conf; Is there a way to specify a custom log file, now firewalld is flooding dmesg. -Paavo

3 2

cross compiling firewalld
by Tux Mason 11 Dec '17

11 Dec '17

Hello, Is it possible to cross compile firewalld. If so, kindly share how to? Many thanks.

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

firewalld-users December 2017