firewalld-users February 2025

firewalld-users@lists.fedorahosted.org

4 participants
2 discussions

firewalld rejects packets that should be routed
by Eric Robinson 12 Feb '25

12 Feb '25

Greetings, We have a Rocky 8.5 server running firewalld 0.9.11-9 with two NICs, eth0 and eth1 (not their actual names, but those are easier). The default zone is 'core' and contains eth0. eth1 is in the 'replication' zone. IP forwarding is enabled, and I can ping through the server from a host in the eth0 LAN to a host in the eth1 LAN, but only if firewalld is not running. As soon as I start firewalld, the ping stops and I start getting "packet filtered" messages. I'm pretty sure I have the right rich rules in place, but obviously I am doing something wrong. Several people have suggested enabling masquerade, but I don't need NAT. I just want to route. Any ideas on where I can look to figure out what's going on? -Eric Disclaimer : This email and any files transmitted with it are confidential and intended solely for intended recipients. If you are not the named addressee you should not disseminate, distribute, copy or alter this email. Any views or opinions presented in this email are solely those of the author and might not represent those of Physician Select Management. Warning: Although Physician Select Management has taken reasonable precautions to ensure no viruses are present in this email, the company cannot accept responsibility for any loss or damage arising from the use of this email or attachments.

2 4

What are the correct Firewalld Rules to enable IPv6 for VMs ran by libvirtd?
by Mark Savenent 01 Feb '25

01 Feb '25

Right now, I seem to be unable to ping, run traceroute or perform lookups via IPv6 while firewalld is turned on. This is within the VMs that I am running. The VMs were created libvirt/qemu and are attached to the main system via a Bridge Interface. IPv6 ping, run traceroute or perform lookups work on the host whether Firewalld is turned on or not. I have turned firewalld off and all the above functions, seem to work within the VMs. So I am thinking it could be a missing/blocked set of rules that may have not been added to the libvirtd zone or another zone. Please be aware that the bridge interface in this scenario is managed by network manager. Are there any suggestions of any rules to implement to allow? I have had a look at this guide here (https://superuser.com/questions/1775676/which-inbound-outbound-rules-are-ne…) Although it is Windows based there were 3 things that stood out to me which I believe I may need to get enabled for IPv6 for the VMs. - ICMPv6 - Neighbor Discovery - DHCPv6 This wasn't part of the guide, but would there be a rule needed for this? - Allowing DNS for IPv6

4 13

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

firewalld-users February 2025