firewalld-users January 2022

firewalld-users@lists.fedorahosted.org

5 participants
3 discussions

masquerade between zones
by tim aliaj 25 Jan '22

25 Jan '22

Hi Guys, I have setup one firewall machines with two interfaces one on public zone and one in internal zone. i created a new policy with ingress internal and egress public and enabled masquerade on it. if i enable masquerade on zone public as normal i works the issue is it does not work with policies. Bellow is my config so far: [root@FW1 ~]# firewall-cmd --list-all-policies allow-host-ipv6 (active) priority: -15000 target: CONTINUE ingress-zones: ANY egress-zones: HOST services: ports: protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: rule family="ipv6" icmp-type name="neighbour-advertisement" accept rule family="ipv6" icmp-type name="neighbour-solicitation" accept rule family="ipv6" icmp-type name="router-advertisement" accept rule family="ipv6" icmp-type name="redirect" accept brenda2jashte (active) priority: -500 target: CONTINUE ingress-zones: internal egress-zones: public services: ports: protocols: masquerade: yes forward-ports: source-ports: icmp-blocks: rich rules: [root@FW1 ~]# public (active) target: default icmp-block-inversion: no interfaces: enp1s0 sources: services: cockpit dhcpv6-client ssh ports: protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: internal (active) target: default icmp-block-inversion: no interfaces: enp7s0 sources: services: cockpit dhcpv6-client mdns samba-client ssh ports: protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: i am using the info from: https://firewalld.org/2020/09/policy-objects-introduction https://firewalld.org/2021/06/the-upcoming-1-0-0 Please can someone help out. first time i am trying to do NAT with policies Tim

3 3

Rich rules of blocking traffic to a specific IP seem not to work
by Snow Summer 04 Jan '22

04 Jan '22

Hello, I am trying to block all kinds (TCP/UDP/ICMP and so on) of network traffic from/to a specific IP address, and I have used the IP 4.2.2.1 as a test. My firewall-cmd --list-all shows: root@summersnow # firewall-cmd --list-all public (active) target: default icmp-block-inversion: no interfaces: wlp4s0 sources: services: dhcpv6-client ports: protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: rule family="ipv4" destination address="4.2.2.1" drop rule family="ipv4" source address="4.2.2.1" drop rule family="ipv4" source address="4.2.2.1" reject rule family="ipv4" destination address="4.2.2.1" reject However, I can confirm that I can still receive DNS responses from it by: root@summersnow # nslookup twitter.com 4.2.2.1 Server: 4.2.2.1 Address: 4.2.2.1#53 Non-authoritative answer: Name: twitter.com Address: 104.244.42.65 Name: twitter.com Address: 104.244.42.129 The rich rules above seem not working properly. Any ideas? Thanks, HanatoK

4 8

Setting Deny Forward Rules with Firewalld
by Sean Zimmermann 04 Jan '22

04 Jan '22

Hi everyone, I'm trying to setup a firewall so one of my VMs is barred from accessing the LAN (if saddr = VM Address and daddr = 192.168.0.0/16, deny input and forward). I was able to do this in nftables here: table inet ext_only { chain input { type filter hook input priority filter - 10; policy accept; ct state new ip saddr 192.168.100.100 drop } chain forward { type filter hook forward priority filter - 10; policy accept; ct state new ip saddr 192.168.100.100 ip daddr 192.168.0.0/16 drop } } However, I've been having trouble trying to figure out the correct way to do this for firewalld. I know I can move the VM IP to its own zone, and I can then block input, but I couldn't figure out how to write a forward deny rule. What is the recommended way to handle dropping forwarded packets? Thank you for any help with this. Regards, Sean

3 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

firewalld-users January 2022