firewalld-users

firewalld-users@lists.stg.fedorahosted.org

285 discussions

rich-rules
by Samuel Irlapati 25 Jul '22

25 Jul '22

I have been using direct-rules. I just upgraded to fedora 36 and looks like I can't use direct-rules anymore. Is this true? Also from some google searches, I have come to understand that direct-rules can be replaced with rich-rules. Is this true? I have a lot of rules that need to be converted, so will be asking for help for them. So I will just start by asking some simple ones. How do I convert the following rule to a rich-rule? firewall-cmd --direct --add-rule ipv4 mangle PREROUTING 0 -p tcp -s $WEBSAFETY0_PODIP --dport 80 -j MARK --set-mark $WEBMARK Does it matter which zone "$WEBSAFETY0_PODIP" is located in, if the $WEBMARK uses a routing table that posroutes the packet onto an interface on the external zone? Sam

2 1

firewalld's default ruleset - no 'policy drop'
by Gareth Evans 11 Jul '22

11 Jul '22

Hello, Comparing the default nft rulesets of firewalld and ufw (on Debian 11), I note that ufw provides a qualified 'policy drop' for input, but firewalld does not. Isn't this less secure, and shouldn't it? With thanks, Gareth

2 2

Multiple external zone interfaces
by Larry M. Smith 17 Apr '22

17 Apr '22

I am seeing an issue with my configuration that I can't seem to wrap my head around. With multiple interfaces in the the external zone, using masquerade, only one is usable. --8<------------------------------------------------------------- [root@gate01 ~]# firewall-cmd --get-active-zones external interfaces: eno2 eno1 internal interfaces: eno4 eno3 [root@gate01 ~]# firewall-cmd --zone=external --list-all external (active) target: default icmp-block-inversion: no interfaces: eno1 eno2 sources: services: ssh ports: protocols: forward: no masquerade: yes forward-ports: source-ports: icmp-blocks: rich rules: [root@gate01 ~]# ip addr show dev eno1 2: eno1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000 link/ether de:ad:be:ef:ca:fe brd ff:ff:ff:ff:ff:ff permaddr 3c:ec:ef:54:bc:78 inet 192.0.2.203/25 brd 192.0.2.255 scope global dynamic noprefixroute eno1 [root@gate01 ~]# ip addr show dev eno2 3: eno2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000 link/ether ca:fe:be:ef:ca:fe brd ff:ff:ff:ff:ff:ff inet 198.51.100.179/26 brd 198.51.100.191 scope global dynamic noprefixroute eno2 [root@gate01 ~]# ip route default via 192.0.2.129 dev eno1 proto dhcp metric 104 default via 198.51.100.129 dev eno2 proto dhcp metric 105 198.51.100.128/26 dev eno2 proto kernel scope link src 198.51.100.179 metric 105 192.0.2.128/25 dev eno1 proto kernel scope link src 192.0.2.203 metric 104 192.168.230.0/23 dev eno3 proto kernel scope link src 192.168.230.3 metric 102 192.168.232.0/23 dev eno4 proto kernel scope link src 192.168.232.3 metric 100 --8<------------------------------------------------------------- With this configuration, only the interface with the lowest metric default route is usable; --8<------------------------------------------------------------- [chains@imp ~]$ ping -c 2 192.0.2.203 PING 192.0.2.203 (192.0.2.203) 56(84) bytes of data. 64 bytes from 192.0.2.203: icmp_seq=1 ttl=42 time=56.8 ms 64 bytes from 192.0.2.203: icmp_seq=2 ttl=42 time=122 ms --- 192.0.2.203 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1001ms rtt min/avg/max/mdev = 56.813/89.766/122.719/32.953 ms [chains@imp ~]$ ping -c 2 198.51.100.179 PING 198.51.100.179 (198.51.100.179) 56(84) bytes of data. --- 198.51.100.179 ping statistics --- 2 packets transmitted, 0 received, 100% packet loss, time 999ms --8<------------------------------------------------------------- However, if I make if eno2 the lower metric interface then eno2 is ping-able and eno1 isn't. .. Anyone have any idea what I might be doing wrong? SgtChains (Distro is "Rocky Linux release 8.5" and Firewalld is "0.9.3")

1 1

firewalld not working after reboot
by Rob Marshall 17 Mar '22

17 Mar '22

Hi, I have an issue where, after a system reboot (Oracle Linux 7), communications to the node are not working correctly. If i stop and start (often a restart doesn't work) the firewalld service the network will work correctly. While things were broken I did a: 'firewall-cmd --list-all' and noticed that two of the interfaces were missing. Where can I look to determine what may be going wrong when firewalld starts after a reboot? Thanks, Rob

3 7

firewalld.org not updated?
by Andrei Borzenkov 15 Mar '22

15 Mar '22

Website lists 1.0.1 as the latest release while we have 1.0.2, 1.0.3 and in the meantime 1.1.0. Also some summary of changes in 1.1.0 (if there are significant changes) is certainly helpful.

2 1

Allowed source-port is being blocked (AdGuard Home)
by Koen Drai 09 Mar '22

09 Mar '22

Hi, I am running an AdGuard Home DNS server in my home network (on Debian 11, which is v0.9.3). Works fine so far, but I am getting the following error messages in syslog: Mar 6 20:48:33 fook kernel: [160941.334608] "filter_IN_knet_REJECT: "IN=enp2s0 OUT= MAC=<MAC> SRC=5.9.164.112 DST=192.168.1.1 LEN=40 TOS=0x00 PREC=0x00 TTL=53 ID=0 DF PROTO=TCP SPT=853 DPT=46170 WINDOW=0 RES=0x00 RST URGP=0 However, this request should not be rejected according to the configuration: /etc/firewalld/zones/knet.xml (...) <rule family="ipv4">  <source-port port="853" protocol="tcp"/> <accept/> </rule> (...) --list-all: (...) rich rules: (...) rule family="ipv4" source-port port="853" protocol="tcp" accept (...) Similar behavior for source-port 443 TCP. Am I missing something? Is this a known error (and fixed in a later version?)? Thanks for any hints, Koen

3 9

ICMP echo working but still getting a block message in log
by Koen Drai 09 Feb '22

09 Feb '22

Hi, I am running into a firewalld behavior again that I cannot understand. Running firewalld on a Debian 11 box. The zone file contains the following: <icmp-block-inversion/> <icmp-block name="echo-reply"/> <icmp-block name="echo-request"/> A ping from a client results in a reply, but I am still getting the following error message in syslog: "filter_zone_knet_HOST_ICMP_BLOCK: "IN=enp2s0 OUT= MAC=<ANOM> SRC=192.168.1.9 DST=192.168.1.1 LEN=60 TOS=0x00 PREC=0x00 TTL=128 ID=56385 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=509 What's happening? Thanks for your help and best regards, Koen

4 4

LXD container Unable to reach internet
by Sergio Belkin 08 Feb '22

08 Feb '22

Hi, I'm running on firewalld on Fedora 35 and I've installed lxd. The problem is that lxd containers can reach the host, but not the internet. This the firewalld configuration: FedoraServer target: default icmp-block-inversion: no interfaces: sources: services: cockpit dhcpv6-client ssh ports: protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: FedoraWorkstation (active) target: default icmp-block-inversion: no interfaces: wlp108s0 sources: services: dhcpv6-client mdns samba-client ssh ports: 1025-65535/udp 1025-65535/tcp protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: block target: %%REJECT%% icmp-block-inversion: no interfaces: sources: services: ports: protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: dmz target: default icmp-block-inversion: no interfaces: sources: services: ssh ports: protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: docker (active) target: ACCEPT icmp-block-inversion: no interfaces: docker0 sources: services: ports: protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: drop (active) target: DROP icmp-block-inversion: no interfaces: sources: ipset:crowdsec-blacklists services: ports: protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: external target: default icmp-block-inversion: no interfaces: sources: services: ssh ports: protocols: forward: yes masquerade: yes forward-ports: source-ports: icmp-blocks: rich rules: home target: default icmp-block-inversion: no interfaces: sources: services: dhcpv6-client mdns samba-client ssh ports: protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: internal target: default icmp-block-inversion: no interfaces: sources: services: dhcpv6-client mdns samba-client ssh ports: protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: libvirt target: ACCEPT icmp-block-inversion: no interfaces: sources: services: dhcp dhcpv6 dns ssh tftp ports: protocols: icmp ipv6-icmp forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: rule priority="32767" reject nm-shared target: ACCEPT icmp-block-inversion: no interfaces: sources: services: dhcp dns ssh ports: protocols: icmp ipv6-icmp forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: rule priority="32767" reject public target: default icmp-block-inversion: no interfaces: sources: services: dhcpv6-client mdns ssh ports: protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: trusted (active) target: ACCEPT icmp-block-inversion: no interfaces: lxdbr0 sources: services: ports: protocols: forward: yes masquerade: yes forward-ports: source-ports: icmp-blocks: rich rules: work target: default icmp-block-inversion: no interfaces: sources: services: dhcpv6-client mdns ssh ports: protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: I've trying also what is documented at https://linuxcontainers.org/lxd/docs/master/networks/# Just in case the routes on container are: default via 10.230.54.1 dev eth0 proto dhcp metric 100 10.230.54.0/24 dev eth0 proto kernel scope link src 10.230.54.220 metric 100 Please could you help and tell me if I am doing something wrong? Thanks in advance! -- -- Sergio Belkin LPIC-2 Certified - http://www.lpi.org

2 2

Rejections of related/established connections?
by Koen Drai 07 Feb '22

07 Feb '22

Hi, Not sure if I am missing something, but I keep running into connections being rejected that should be accepted from how I (think I :)) have defined the rules. I somehow get the feeling that the behavior below is related to nft rules only containing "new, untracked" but not related and established. Googled if there is a way to add these two states to rules, but did not find anything. A direct rule might help, but since these are discouraged for futureproofness, trying to figure out the "right" way. Working on a Debian 11 system, nftables backend. Example 1, syncthing: zone file knet.xml, amongst others: <service name="syncthing"/> <source-port port="22000" protocol="tcp"/> <source-port port="22000" protocol="udp"/> <rule family="ipv4"> <source address="192.168.1.1/24"/> <port port="22000" protocol="tcp"/> <accept/> </rule> <rule family="ipv4"> <source address="192.168.1.1/24"/> <port port="22000" protocol="udp"/> <accept/> </rule> Nicely translated into the nft ruleset (amongst others): ip saddr 192.168.1.0/24 tcp dport 22000 ct state { new, untracked } accept ip saddr 192.168.1.0/24 udp dport 22000 ct state { new, untracked } accept However, I still get these errors in syslog: filter_IN_knet_REJECT: "IN=enp2s0 OUT= MAC=<ANOM> SRC=192.168.1.54 DST=192.168.1.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=33526 DF PROTO=TCP SPT=22000 DPT=22000 WINDOW=65535 RES=0x00 SYN Example 2, Apache as an https proxy: <rule family="ipv4"> <source address="192.168.1.13"/> <source-port port="443" protocol="tcp"/> <accept/> </rule> ip saddr 192.168.1.13 tcp sport 443 ct state { new, untracked } accept "filter_IN_knet_REJECT: "IN=enp2s0 OUT= MAC=<ANOM> SRC=192.168.1.13 DST=192.168.1.1 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=TCP SPT=443 DPT=34860 WINDOW=0 RES=0x00 RST URGP=0 What's going on here? Thanks a lot for your help and best regards

1 0

masquerade between zones
by tim aliaj 25 Jan '22

25 Jan '22

Hi Guys, I have setup one firewall machines with two interfaces one on public zone and one in internal zone. i created a new policy with ingress internal and egress public and enabled masquerade on it. if i enable masquerade on zone public as normal i works the issue is it does not work with policies. Bellow is my config so far: [root@FW1 ~]# firewall-cmd --list-all-policies allow-host-ipv6 (active) priority: -15000 target: CONTINUE ingress-zones: ANY egress-zones: HOST services: ports: protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: rule family="ipv6" icmp-type name="neighbour-advertisement" accept rule family="ipv6" icmp-type name="neighbour-solicitation" accept rule family="ipv6" icmp-type name="router-advertisement" accept rule family="ipv6" icmp-type name="redirect" accept brenda2jashte (active) priority: -500 target: CONTINUE ingress-zones: internal egress-zones: public services: ports: protocols: masquerade: yes forward-ports: source-ports: icmp-blocks: rich rules: [root@FW1 ~]# public (active) target: default icmp-block-inversion: no interfaces: enp1s0 sources: services: cockpit dhcpv6-client ssh ports: protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: internal (active) target: default icmp-block-inversion: no interfaces: enp7s0 sources: services: cockpit dhcpv6-client mdns samba-client ssh ports: protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: i am using the info from: https://firewalld.org/2020/09/policy-objects-introduction https://firewalld.org/2021/06/the-upcoming-1-0-0 Please can someone help out. first time i am trying to do NAT with policies Tim

3 3

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

firewalld-users