Hi,
I'm trying to use the new policy objects to only allow outgoing packets destined for the vpn server or the vpn tunnel. I have been able to get the first part to work (establish a connection), but I can't get the tunnel traffic to flow.
Previously, with the direct interface and the iptables backend, I would have used the direct rules
ipv4 filter OUTPUT 0 -o lo -j ACCEPT
ipv4 filter INPUT 0 -i lo -j ACCEPT
ipv4 filter OUTPUT 10 -p udp --dport 443 -d <vpn.ip.address> -j ACCEPT
ipv4 filter OUTPUT 998 -o tun+ -j ACCEPT
ipv4 filter FORWARD 2 -o tun+ -j ACCEPT
ipv4 filter FORWARD 2 -i tun+ -j ACCEPT
ipv4 filter INPUT 999 -j DROP
ipv4 filter OUTPUT 999 -j DROP
ipv4 filter FORWARD 999 -j DROP
ipv6 filter OUTPUT 0 -j DROP
ipv6 filter INPUT 0 -j DROP
ipv6 filter FORWARD 0 -j DROP
Instead, I'm trying to use the policy:
myvpnpol (active)
priority: -1
target: DROP
ingress-zones: HOST
egress-zones: ANY
services:
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family="ipv4" destination address="<vpn.ip.address>" port port="443" protocol="udp" accept
Also, my default zone is set to "drop", and I'm using the nftables backend.
Note, since I'm on version 0.9 rather than 1.0, which means I don't have the patch in https://github.com/firewalld/firewalld/pull/709. I also add the following nft rule by hand (which gets wiped on a reload)
nft insert rule inet firewalld filter_OUTPUT index 0 ct state { established, related } accept
I don't mind using this hack for now because I want to try and use the new policy framework and the nftables backend, and I know I can stop using it with version 1.0.
With this set up, I can establish a new openvpn connection. However, all the traffic to the tun0 interface is dropped by the "myvpnpol" policy. I was wondering if there was a way to handle this in firewalld, without using the direct options (-o tun+ -j ACCEPT) with the iptables backend, or adding a few more nft entries by hand (oifname "tun0" accept). If this isn't possible in 0.9, or 1.0, does anyone know how this might be handled in the future? Could the tunnel interface be assigned to a zone, or would it be handled by rich rules?
