firewalld-users January 2018

firewalld-users@lists.fedorahosted.org

1 participants
2 discussions

Firewalld & IPv6
by Paavo Leinonen 04 Jun '18

04 Jun '18

Hi, I'm running firewalld in a router that connects the devices in my home LAN to internet. I have recently added IPv6 DHCPv6 config to the router, and prefix delegation works, so the devices in my home LAN get proper IPv6 addresses. However, I don't like the idea that all IPv6 enabled devices in my home LAN have public IPv6 addresses. I'd very much prefer simple IPv4 -style NAT approach to protect the devices in home LAN from being accessed from the internet. How do I implement something like this with firewalld in the router? wanif=eth0 lanif=eth1 ip6tables -A FORWARD -m state --state NEW -i $lanif -o $wanif -j ACCEPT ip6tables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT ip6tables -P FORWARD DROP Other ways to protect the devices in my home LAN being accessed from the internet? -Paavo

2 2

question on DNAT or Port forwarding with firewalld
by nitesh sinha 11 Jan '18

11 Jan '18

Hi List, I have a query regarding firewalld configuration. If this is not the correct place to ask, please redirect me to the correct place which is. i am trying to setup Port forwarding from https (443) port to application port (8443). The application runs on non-standard port i am able to DNAT it to the outside world on 443. These are the iptable rules that work for me. #for remote connections iptables -t nat -A PREROUTING -i eno16777984 -p tcp --dport 443 -j DNAT --to-destination 127.0.0.1:8443 iptables -A FORWARD -i eno16777984 -m state --state NEW -m tcp -p tcp -d 127.0.0.1 --dport 8443 -j ACCEPT #for localhost connections iptables -t nat -A OUTPUT -p tcp --dport 443 -d 127.0.0.1 -j DNAT --to-destination 127.0.0.1:8443 Now, with firewalld, i tried the following : added service (https) to public zone added port-forwarding : port=443:proto=tcp:toport=8443:toaddr=127.0.0.1 this did not work, so i tried adding rules using --direct firewall-cmd --direct --add-rule ipv4 nat PREROUTING 0 -i eno16777984 -d 127.0.0.1 -p tcp --dport 443 -j DNAT --to-destination 127.0.0.1:8443 firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i eno16777984 -m state --state NEW -m tcp -p tcp -d 127.0.0.1 --dport 8443 -j ACCEPT firewall-cmd --direct --add-rule ipv4 nat OUTPUT 0 -p tcp --dport 443 -d 127.0.0.1 -j DNAT --to-destination 127.0.0.1:8443 I assume that this will work, since these are exact rules what work with iptables. Working -> https://localhost:443 Not Working -> https://10.211.213.143:443/ (assuming this is the network ip of my machine) [root@jmaster ~]# firewall-cmd --direct --get-all-rule ipv4 nat OUTPUT 0 -p tcp --dport 443 -d 127.0.0.1 -j DNAT --to-destination 127.0.0.1:8443 ipv4 nat OUTPUT 0 -p tcp -o lo --dport 443 -j REDIRECT --to-ports 8443 ipv4 filter FORWARD 0 -i eno16777984 -m state --state NEW -m tcp -p tcp -d 127.0.0.1 --dport 8443 -j ACCEPT ipv4 nat PREROUTING 0 -i eno16777984 -p tcp --dport 443 -j DNAT --to-destination 127.0.0.1:8443 What should i do make the service accessible from outside on 443 ? Thanks in advance. Nitesh

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

firewalld-users January 2018