firewalld-users October 2020

firewalld-users@lists.fedorahosted.org

4 participants
5 discussions

firewalld port knocking with nftables backend?
by nik 19 Oct '20

19 Oct '20

Hi all, quick question to see if anybody has done any port knocking in a firewalld compatible way? I've set up a proof of concept directly in nftables: table inet knock { set set1 { type ipv4_addr size 65535 timeout 5s } set set2 { type ipv4_addr size 65535 timeout 5s } set set3 { type ipv4_addr size 65535 timeout 5s } chain knock { type filter hook input priority raw; policy accept; ip saddr @set2 tcp dport 789 log prefix "KNOCK3 " level info add @set3 { ip saddr } return ip saddr @set1 tcp dport 456 log prefix "KNOCK2 " level info add @set2 { ip saddr } return tcp dport 123 log prefix "KNOCK1 " level info add @set1 { ip saddr } return ip saddr @set3 tcp dport 22 log prefix "ALLOWED " level info accept } } To do the same thing in a firewalld compatible way, I was thinking that the firewalld ssh allow rule (in nft table inet firewalld chain filter_IN_public_allow) could refer to @set3 but then I would also need to have the add @set3 (and @set3 itself) be defined in the same inet firewalld table. I can define that by hand with nft adding the chain to table inet firewalld, but the problem with doing that is any firewall-cmd --reload will clear out my "knock" chain. Doing firewall-cmd to define sets with timeouts also seems a bit problematic (I'm in CentOS 8 BTW) as I can define a set with a timeout: firewall-cmd --permanent --new-ipset set3 --type=hash:ip --family=inet --option=timeout=5 firewall-cmd --reload however listing the set shows it doesn't have a timeout: nft list table inet firewalld|grep -A4 set set set3 { type ipv4_addr flags interval } and in fact when I add something to the running set it doesn't disappear after 5 seconds: # firewall-cmd --ipset=set3 --add-entry=1.2.3.4 success # nft list table inet firewalld|grep -A4 set set set3 { type ipv4_addr flags interval elements = { 1.2.3.4 } } firewalld documentation is clear that you can't list the set members for a set with timeouts since that's all handled by the kernel, which is fine but strange I guess, however it doesn't seem to be that the timeout is actually getting set into the nftables set. (And actually, firewall-cmd could just do "nft list set inet firewalld set4" and extract the elements = {} list so possibly that's a future enhancement.) But I digress. Has anybody done any port knocking sort of thing in a firewalld compatible way here? I'm interested in hearing some ideas or what has worked for people. Thanks. -nik

2 2

How to open a port or service for local network and not globally?
by Jason Long 14 Oct '20

14 Oct '20

Hello, Is it possible to open a port or service for just local network and not globally? I should open that ports or services for specific IP addresses or Firewalld has special option for it? Thank you.

2 1

Firewalld rules for protecting a web server.
by Jason Long 13 Oct '20

13 Oct '20

Hello, I need the experts advice about the best Firewalld configuration for a web server. In Firewalld, I just opened port 80,443 and 22, but I'm sure with Firewalld I can protect my server with other useful rules. Can anyone share some good rules? For example, limitation or... Thank you.

3 9

Firewalld and Hping3.
by Jason Long 13 Oct '20

13 Oct '20

Hello, How can I this attack from hping3 by Firewalld: # hping3 -S -p 22 --flood --rand-source "IP" Is it possible? Thank you.

2 10

how to allow for reception based on source port
by Fulko Hew 12 Oct '20

12 Oct '20

I'm trying to develop a discovery procedure based on how a 3rd party device works... For discovery, I need to do a UDP broadcast to a specific port, and in turn all of the devices out there, will send a UDP response from that port, back to the (ephemeral) source port from the original broadcast. For example: 192.168.1.149:port --> 255.255.255.255:9999 192.168.1.149:port <-- 192.168.1.130:9999 How do I configure firewalld to enable such behaviour? Thanks Fulko

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

firewalld-users October 2020