firewalld-users

firewalld-users@lists.fedorahosted.org

2 participants
351 discussions

StrictForwardPorts=yes may still allow port forwarding added externally
by Andrei Borzenkov 08 Jan '25

08 Jan '25

With StrictForwardPorts=yes firewalld adds rule(s) checking for the original destination port. It sounds like if some entity adds another DNAT rule for the same port matching e.g. on a different address, this rule will also be accepted. I.e. <zone> <interface name"eth0"> <forward-port port="1234" to-port="1234" to-addr="1.2.3.4" </zone> will configure port forwarding on eth0 to the address 1.2.3.4, but the rule tcp dport 1234 ip saddr 5.6.7.8 dnat to 4.3.2.1 will create exception for one single source address redirecting it somewhere else which will be accepted due to the rule ct original proto-dst 1234 accept added by firewalld. As this rule only checks for the original destination port. That is what the original fwmark implementation avoided.

2 1

Zones with target="ACCEPT" allow unconstrained forwarding to the interfaces in other zones
by Andrei Borzenkov 07 Jan '25

07 Jan '25

This came as a surprise to me. I was sure that zone is about traffic *to* host. But here is the diff between two configurations differing only in target, where enp0s3 is in the "internal" zone. The first configuration is with target="DROP", the second - target="ACCEPT". > +++ rules.accept 2025-01-07 10:44:24.012374347 +0300 > @@ -141,7 +141,7 @@ table inet firewalld { > iifname "docker0" accept > iifname "enp0s3" jump filter_IN_policy_allow-host-ipv6 > iifname "enp0s3" jump filter_IN_internal > - iifname "enp0s3" drop > + iifname "enp0s3" accept > iifname "enp0s2" jump filter_IN_policy_allow-host-ipv6 > iifname "enp0s2" jump filter_IN_public > iifname "enp0s2" reject with icmpx admin-prohibited > @@ -160,13 +160,13 @@ table inet firewalld { > iifname "docker0" jump filter_FWD_docker > iifname "docker0" accept > iifname "enp0s3" oifname "docker0" jump filter_FWD_internal > - iifname "enp0s3" oifname "docker0" drop > + iifname "enp0s3" oifname "docker0" accept > iifname "enp0s3" oifname "enp0s3" jump filter_FWD_internal > - iifname "enp0s3" oifname "enp0s3" drop > + iifname "enp0s3" oifname "enp0s3" accept > iifname "enp0s3" oifname "enp0s2" jump filter_FWD_internal > - iifname "enp0s3" oifname "enp0s2" drop > + iifname "enp0s3" oifname "enp0s2" accept > iifname "enp0s3" jump filter_FWD_internal > - iifname "enp0s3" drop > + iifname "enp0s3" accept > iifname "enp0s2" oifname "docker0" jump filter_FWD_public > iifname "enp0s2" oifname "docker0" reject with icmpx admin-prohibited > iifname "enp0s2" oifname "enp0s3" jump filter_FWD_public Is it expected? Is it documented anywhere?

2 1

How firewalld to-addr work
by Hamado Dene 31 Oct '24

31 Oct '24

Hello firewalld Community, I'm trying to understand how the to-addr feature works in firewalld. I haven’t found much information in the documentation.We use RHEL 9 and have firewalld version 1.2.1.We have an interface with a primary IP and other secondary IPs. The scenario is as follows: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 50:6b:8d:d8:2d:84 brd ff:ff:ff:ff:ff:ff altname enp0s3 inet 10.104.112.5/24 brd 10.104.112.255 scope global noprefixroute ens3 valid_lft forever preferred_lft forever inet 10.104.112.8/32 brd 10.104.112.255 scope global ens3 valid_lft forever preferred_lft forever 10.104.112.5 is the machine's primary IP, while 10.104.112.8 is a floating IP managed by Pacemaker. We tried adding a rule like this: rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089" By doing this, we noticed that the request is always forwarded to the machine’s primary IP, i.e., 10.104.112.5.However, I expected it to be forwarded to the IP 10.104.112.9. How is the IP to forward the request to actually decided?The only way I see to force it to 10.104.112.9 is by specifying to-addr=10.104.112.9. In CentOS 7 with firewalld version 0.6, by specifying only the rule: rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089" without specifying to-addr, the request is correctly forwarded to IP 10.104.112.9. Could anyone provide me with more information? Thanks in advance. Hamado Dene

3 10

backup & restore of a whole firewalld instance
by Bastard Operator from Hell aka Django 09 Oct '24

09 Oct '24

HI Eric! According to unconfirmed rumors, Eric has a very good and hot line to RedHat. ;) Maybe he can pass on my wish and suggestion to the developers. O.K. what is it about? I have been a loyal customer for many years and have been a loyal “customer since CentOS7 times”. What I miss in firewalld and especially in firewall-cmd is a kind of fulldump backup and restore functionality. Something like: firewall-cmd --backup backup-file.back firewall-cmd --restore backup-file.back Why all this? Well, for one thing, it would be an adequate way to regularly back up the running firewall rules. And if you restore a previously backed up firewall configuration, this would be a very simple and smooth process. OK, alternatively, I just have to continue to back up the XML files from /etc/firewalld using Ansible and store them in the inventory so that I can deploy them to a host later via ansible. Or have I overlooked something and the whole thing already exists and I'm worrying about nothing? Best regards, -- Django (Bastard Operator from Hell [BOfH])

3 2

problem with firewalld
by Biagio Vittorioso 07 Oct '24

07 Oct '24

Good morning everyone I have a problem with firewalld on any distro I try from debian to ubuntu, including fedora. The problem is this: I configure all the firewalld from terminal I open all the ports I need to test if I surf like ‘https’ http’ and I don't open “dns” and “dns-over-tls” so logically I shouldn't surf the internet and instead, after making the settings permanent and reloading the firewalld, I surf anyway. So I was wondering: is there something I'm missing about how to configure the firewalld, or is there actually some bug in it? P.S. I have also blocked all incoming and outgoing traffic, but I still surf.

3 8

IPv6 network - firewalld - routing issue
by Bastard Operator from Hell aka Django 03 Oct '24

03 Oct '24

Hello, here I am again and I hope you can help me as you did in January this year and give me THE crucial tip. My environment: ### Internet ### ^ | V +-----------+ | | | FWA | | | +-----------+ ^ | --EDMZ--+----------------- [special devices] | V eth0 +-----------+ | | | FWB | vml000210 | | +-----------+ ^ eth1 | --IDMZ--+------------------ [web, mail ...] | V eth0 +-----------+ | | | FWC | vml000110 | | +-----------+ ^ eth1 | --------+-----Intranet----- [mobile devices, notebooks, phones ...] Okay, so far so good, the diagram roughly shows my infrastructure at home. The two firewalls/routers FWB and FWC are virtual Archlinux hosts in a KVM environment. The good thing is that I can access the internet from both VMs (FWB and FWC) and reach all services, such as DNS, WEB, MAIL, without any problems. I can also access services/daemons (ssh, smtp, http...) from the outside that are offered on these two VMs, for example! But now comes the big BUT and my problems begin! If I connect my laptop to the interface eth1 of my internal firewall, I can access it via ICMP or SSH, for example. But everything else “behind” it, i.e. the FWB or even out to the internet, is starved across the board or blocked and not routed through by something or someone. But I currently have absolutely no other explanation than PEBCAK for my problem! So now we come to the configuration: ======================================================================= First, let's take a look at the external firewall (EDMZ ← → IDMZ) Virtual KVM Host vml000210 firewall FWB: ----------------------------------------------------------------------- I: IP Forwarding root@vml000210:~# sysctl net.ipv4.ip_forward net.ipv6.conf.all.forwarding net.ipv4.ip_forward = 1 net.ipv6.conf.all.forwarding = 1 ----------------------------------------------------------------------- II: NETWORK root@vml000210:~# ip -6 -br addr lo UNKNOWN ::1/128 eth0 UP 2003:a:bcd:ef00:1720:17:2:210/64 fd00::172:17:2:210/64 fe80::1720:17ff:fe02:210/64 eth1 UP 2003:a:bcd:ef03:10::210/64 fd00::3:10:0:0:210/64 fe80::5054:ff:fe41:2102/64 ----------------------------------------------------------------------- III: ROUTING root@vml000210:~# ip -6 route 2003:a:bcd:ef00::/64 dev eth0 proto kernel metric 256 pref medium 2003:a:bcd:ef03::/64 dev eth1 proto kernel metric 256 pref medium fd00::/64 dev eth0 proto kernel metric 256 pref medium fd00:0:0:3::/64 dev eth1 proto kernel metric 256 pref medium fe80::/64 dev eth1 proto kernel metric 256 pref medium fe80::/64 dev eth0 proto kernel metric 256 pref medium default via fe80::7ac5:7dff:fefd:1c10 dev eth0 proto static metric 1024 pref medium The default gateway with the address fe80::7ac5:7dff:fefd:1c10 that is entered here is the LLA of the external FWA! ----------------------------------------------------------------------- IV: FIREWALL-DAEMON root@vml000210:~# firewall-cmd --zone=edmz --list-all edmz (default, active) target: default ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: eth0 sources: services: ports: protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: rule family="ipv4" forward-port port="25" protocol="tcp" to-port="25" to-addr="10.0.0.110" rule family="ipv6" source address="2003:a:bcd:ef00::/64" service name="ssh" accept rule family="ipv6" forward-port port="465" protocol="tcp" to-port="465" to-addr="2003:a:bcd:ef03:10::110" rule family="ipv4" forward-port port="587" protocol="tcp" to-port="587" to-addr="10.0.0.110" rule family="ipv4" forward-port port="41022" protocol="tcp" to-port="22" rule family="ipv6" forward-port port="41022" protocol="tcp" to-port="22" rule family="ipv6" forward-port port="587" protocol="tcp" to-port="587" to-addr="2003:a:bcd:ef03:10::110" rule family="ipv4" source address="172.17.2.0/24" service name="ssh" accept rule family="ipv6" forward-port port="25" protocol="tcp" to-port="25" to-addr="2003:a:bcd:ef03:10::110" rule family="ipv4" forward-port port="465" protocol="tcp" to-port="465" to-addr="10.0.0.110" rule family="ipv6" icmp-type name="echo-request" accept root@vml000210:~# firewall-cmd --policy=edmz_2_idmz --list-all edmz_2_idmz (active) priority: -1 target: REJECT ingress-zones: edmz egress-zones: idmz services: ports: protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: rule family="ipv6" destination address="2003:a:bcd:ef03:10::110" icmp-type name="echo-request" accept rule family="ipv4" destination address="10.0.0.110" port port="25" protocol="tcp" accept rule family="ipv6" destination address="2003:a:bcd:ef03:10::110" port port="25" protocol="tcp" accept rule family="ipv4" destination address="10.0.0.110" port port="465" protocol="tcp" accept rule family="ipv6" destination address="2003:a:bcd:ef03:10::110" port port="465" protocol="tcp" accept rule family="ipv4" destination address="10.0.0.110" port port="587" protocol="tcp" accept rule family="ipv6" destination address="2003:a:bcd:ef03:10::110" port port="587" protocol="tcp" accept root@vml000210:~# firewall-cmd --zone=idmz --list-all idmz (active) target: default ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: eth1 sources: services: ssh ports: protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: rule family="ipv6" forward-port port="41022" protocol="tcp" to-port="22" rule family="ipv4" forward-port port="41022" protocol="tcp" to-port="22" root@vml000210:~# firewall-cmd --policy=idmz_2_edmz --list-all idmz_2_edmz (active) priority: -1 target: ACCEPT ingress-zones: idmz egress-zones: edmz services: ports: protocols: masquerade: yes forward-ports: source-ports: icmp-blocks: rich rules: ======================================================================= And here we have the configuration details for the internal firewall. (IDMZ ←→ INTRANET) Virtual KVM Host vml000110 firewall FWC: ----------------------------------------------------------------------- I: IP Forwarding root@vml000110:~# sysctl net.ipv4.ip_forward net.ipv6.conf.all.forwarding net.ipv4.ip_forward = 1 net.ipv6.conf.all.forwarding = 1 ----------------------------------------------------------------------- II: NETWORK root@vml000110:~# ip -6 -br addr lo UNKNOWN ::1/128 eth0 UP 2003:a:bcd:ef03:10::110/64 fd00::3:10:0:0:110/64 fe80::5054:ff:fe41:1101/64 eth1 UP 2003:a:bcd:ef07:10:0:10:110/64 fd00::7:10:0:10:110/64 fe80::5054:ff:fe41:1102/64 ----------------------------------------------------------------------- III: ROUTING root@vml000110:~# ip -6 route 2003:a:bcd:ef03::/64 dev eth0 proto kernel metric 256 pref medium 2003:a:bcd:ef07::/64 dev eth1 proto kernel metric 256 pref medium fd00:0:0:3::/64 dev eth0 proto kernel metric 256 pref medium fd00:0:0:7::/64 dev eth1 proto kernel metric 256 pref medium fe80::/64 dev eth0 proto kernel metric 256 pref medium fe80::/64 dev eth1 proto kernel metric 256 pref medium default via fd00::3:10:0:0:210 dev eth0 proto static metric 1024 pref medium The default gateway with the address fd00::3:10:0:0:210 is here the ULA of firewall FWB! ----------------------------------------------------------------------- IV: FIREWALL-DAEMON root@vml000110:~# firewall-cmd --zone=idmz --list-all idmz (default, active) target: default ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: eth0 sources: services: ssh ports: 25/tcp 465/tcp 587/tcp protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: rule family="ipv4" source address="10.0.0.0/24" destination address="10.0.0.110/32" port port="123" protocol="udp" accept rule family="ipv6" source address="2003:a:bcd:ef03::/64" destination address="2003:a:bcd:ef03:10::110/64" port port="123" protocol="udp" accept rule family="ipv6" source address="fd00::/10" destination address="fd00::3:10:0:0:110/64" port port="123" protocol="udp" accept rule family="ipv6" icmp-type name="echo-request" accept root@vml000110:~# firewall-cmd --policy=idmz_2_intra --list-all idmz_2_intra (active) priority: -1 target: REJECT ingress-zones: idmz egress-zones: intra services: ports: protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: root@vml000110:~# firewall-cmd --zone=intra --list-all intra (active) target: default ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: eth1 sources: services: dhcp dhcpv6 smtp ssh ports: protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: rule family="ipv6" source address="2003:a:bcd:ef07::/64" destination address="2003:a:bcd:ef07:10:0:10:110/64" port port="123" protocol="udp" accept rule family="ipv4" source address="10.0.10.0/24" service name="ssh" accept rule family="ipv6" source address="fd00::/10" destination address="fd00::7:10:0:0:110/64" port port="123" protocol="udp" accept rule family="ipv6" source address="2003:a:bcd:ef07::/64" service name="ssh" accept rule family="ipv4" source address="10.0.10.0/24" destination address="10.0.10.110/32" port port="123" protocol="udp" accept rule family="ipv6" icmp-type name="echo-request" accept root@vml000110:~# firewall-cmd --policy=intra_2_idmz --list-all intra_2_idmz (active) priority: -1 target: ACCEPT ingress-zones: intra egress-zones: idmz services: ports: protocols: masquerade: yes forward-ports: source-ports: icmp-blocks: rich rules: ======================================================================= TRAFFIC: IDMZ-FW (FWC) → EDMZ-FW (FWB) "outgoing" 1) ping to LLA (eth1) root@vml000110:~# ping -6 -c4 fe80::5054:ff:fe41:2102%eth0 PING fe80::5054:ff:fe41:2102%eth0 (fe80::5054:ff:fe41:2102%eth0) 56 data bytes 64 bytes from fe80::5054:ff:fe41:2102%eth0: icmp_seq=1 ttl=64 time=0.554 ms 64 bytes from fe80::5054:ff:fe41:2102%eth0: icmp_seq=2 ttl=64 time=0.435 ms 64 bytes from fe80::5054:ff:fe41:2102%eth0: icmp_seq=3 ttl=64 time=0.430 ms 64 bytes from fe80::5054:ff:fe41:2102%eth0: icmp_seq=4 ttl=64 time=0.434 ms --- fe80::5054:ff:fe41:2102%eth0 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3036ms rtt min/avg/max/mdev = 0.430/0.463/0.554/0.052 ms 2) ping to ULA (eth1) root@vml000110:~# ping -6 -c4 fd00::3:10:0:0:210 PING fd00::3:10:0:0:210 (fd00::3:10:0:0:210) 56 data bytes 64 bytes from fd00::3:10:0:0:210: icmp_seq=1 ttl=64 time=0.443 ms 64 bytes from fd00::3:10:0:0:210: icmp_seq=2 ttl=64 time=0.433 ms 64 bytes from fd00::3:10:0:0:210: icmp_seq=3 ttl=64 time=0.461 ms 64 bytes from fd00::3:10:0:0:210: icmp_seq=4 ttl=64 time=0.476 ms --- fd00::3:10:0:0:210 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3040ms rtt min/avg/max/mdev = 0.433/0.453/0.476/0.016 ms 3) ping to GUA (eth1) root@vml000110:~# ping -6 -c4 2003:a:bcd:ef03:10::210 PING 2003:a:bcd:ef03:10::210 (2003:a:bcd:ef03:10::210) 56 data bytes 64 bytes from 2003:a:bcd:ef03:10::210: icmp_seq=1 ttl=64 time=0.448 ms 64 bytes from 2003:a:bcd:ef03:10::210: icmp_seq=2 ttl=64 time=0.424 ms 64 bytes from 2003:a:bcd:ef03:10::210: icmp_seq=3 ttl=64 time=0.424 ms 64 bytes from 2003:a:bcd:ef03:10::210: icmp_seq=4 ttl=64 time=0.417 ms --- 2003:a:bcd:ef03:10::210 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3033ms rtt min/avg/max/mdev = 0.417/0.428/0.448/0.011 ms 4) ping to ULA (eth0) root@vml000110:~# ping -6 -c4 fd00::172:17:2:210 PING fd00::172:17:2:210 (fd00::172:17:2:210) 56 data bytes 64 bytes from fd00::172:17:2:210: icmp_seq=1 ttl=64 time=0.488 ms 64 bytes from fd00::172:17:2:210: icmp_seq=2 ttl=64 time=0.390 ms 64 bytes from fd00::172:17:2:210: icmp_seq=3 ttl=64 time=0.518 ms 64 bytes from fd00::172:17:2:210: icmp_seq=4 ttl=64 time=0.341 ms --- fd00::172:17:2:210 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3038ms rtt min/avg/max/mdev = 0.341/0.434/0.518/0.071 ms 5) ping to GUA (eth0) root@vml000110:~# ping -6 -c4 2003:a:bcd:ef00:1720:17:2:210 PING 2003:a:bcd:ef00:1720:17:2:210 (2003:a:bcd:ef00:1720:17:2:210) 56 data bytes 64 bytes from 2003:a:bcd:ef00:1720:17:2:210: icmp_seq=1 ttl=64 time=0.434 ms 64 bytes from 2003:a:bcd:ef00:1720:17:2:210: icmp_seq=2 ttl=64 time=0.254 ms 64 bytes from 2003:a:bcd:ef00:1720:17:2:210: icmp_seq=3 ttl=64 time=0.410 ms 64 bytes from 2003:a:bcd:ef00:1720:17:2:210: icmp_seq=4 ttl=64 time=0.518 ms --- 2003:a:bcd:ef00:1720:17:2:210 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3032ms rtt min/avg/max/mdev = 0.254/0.404/0.518/0.095 ms ======================================================================= TRAFFIC: IDMZ-FW (FWC) → Internet 1) DNS root@vml000110:~# host -t AAAA heise.de heise.de has IPv6 address 2a02:2e0:3fe:1001:302:: 2) ping to heise.de root@vml000110:~# ping -6 -c4 2a02:2e0:3fe:1001:302:: PING 2a02:2e0:3fe:1001:302:: (2a02:2e0:3fe:1001:302::) 56 data bytes 64 bytes from 2a02:2e0:3fe:1001:302::: icmp_seq=1 ttl=56 time=13.0 ms 64 bytes from 2a02:2e0:3fe:1001:302::: icmp_seq=2 ttl=56 time=13.6 ms 64 bytes from 2a02:2e0:3fe:1001:302::: icmp_seq=3 ttl=56 time=13.3 ms 64 bytes from 2a02:2e0:3fe:1001:302::: icmp_seq=4 ttl=56 time=13.2 ms --- 2a02:2e0:3fe:1001:302:: ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3005ms rtt min/avg/max/mdev = 12.952/13.245/13.606/0.237 ms ======================================================================= TRAFFIC: EMZ-FW (FWB) → IDMZ-FW (FWC) "incoming" 1) ping to LLA eth0 root@vml000210:~# ping -6c4 fe80::5054:ff:fe41:1101%eth1 PING fe80::5054:ff:fe41:1101%eth1 (fe80::5054:ff:fe41:1101%eth1) 56 data bytes 64 bytes from fe80::5054:ff:fe41:1101%eth1: icmp_seq=1 ttl=64 time=0.637 ms 64 bytes from fe80::5054:ff:fe41:1101%eth1: icmp_seq=2 ttl=64 time=0.593 ms 64 bytes from fe80::5054:ff:fe41:1101%eth1: icmp_seq=3 ttl=64 time=0.502 ms 64 bytes from fe80::5054:ff:fe41:1101%eth1: icmp_seq=4 ttl=64 time=0.505 ms --- fe80::5054:ff:fe41:1101%eth1 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3040ms rtt min/avg/max/mdev = 0.502/0.559/0.637/0.057 ms 2) ping to ULA eth0 root@vml000210:~# ping -6c4 fd00::3:10:0:0:110 PING fd00::3:10:0:0:110 (fd00::3:10:0:0:110) 56 data bytes 64 bytes from fd00::3:10:0:0:110: icmp_seq=1 ttl=64 time=0.438 ms 64 bytes from fd00::3:10:0:0:110: icmp_seq=2 ttl=64 time=0.406 ms 64 bytes from fd00::3:10:0:0:110: icmp_seq=3 ttl=64 time=0.430 ms 64 bytes from fd00::3:10:0:0:110: icmp_seq=4 ttl=64 time=0.434 ms --- fd00::3:10:0:0:110 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3046ms rtt min/avg/max/mdev = 0.406/0.427/0.438/0.012 ms 3) ping to GUA eth0 root@vml000210:~# ping -6c4 2003:a:bcd:ef03:10::110 PING 2003:a:bcd:ef03:10::110 (2003:a:bcd:ef03:10::110) 56 data bytes 64 bytes from 2003:a:bcd:ef03:10::110: icmp_seq=1 ttl=64 time=0.522 ms 64 bytes from 2003:a:bcd:ef03:10::110: icmp_seq=2 ttl=64 time=0.601 ms 64 bytes from 2003:a:bcd:ef03:10::110: icmp_seq=3 ttl=64 time=0.387 ms 64 bytes from 2003:a:bcd:ef03:10::110: icmp_seq=4 ttl=64 time=0.507 ms --- 2003:a:bcd:ef03:10::110 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3051ms rtt min/avg/max/mdev = 0.387/0.504/0.601/0.076 ms 4) ping to ULA eth1 (interface whos shows to the intranet!) root@vml000210:~# ping -6c4 fd00::7:10:0:10:110 PING fd00::7:10:0:10:110 (fd00::7:10:0:10:110) 56 data bytes --- fd00::7:10:0:10:110 ping statistics --- 4 packets transmitted, 0 received, 100% packet loss, time 3035ms Route to the ULA from eth1 of the IDMZ firewall (FWC): root@vml000210:~# ip route get fd00::7:10:0:10:110 fd00::7:10:0:10:110 from :: via fe80::7ac5:7dff:fefd:1c10 dev eth0 proto static src fd00::172:17:2:210 metric 1024 pref medium 5) ping to GUA eth1 root@vml000210:~# ping -6c4 2003:a:bcd:ef07:10:0:10:110 PING 2003:a:bcd:ef07:10:0:10:110 (2003:a:bcd:ef07:10:0:10:110) 56 data bytes --- 2003:a:bcd:ef07:10:0:10:110 ping statistics --- 4 packets transmitted, 0 received, 100% packet loss, time 3035ms Route to the GUA from eth1 of the IDMZ firewall (FWC): root@vml000210:~# ip route get 2003:a:bcd:ef07:10:0:10:110 2003:a:bcd:ef07:10:0:10:110 from :: via fe80::7ac5:7dff:fefd:1c10 dev eth0 proto static src 2003:a:bcd:ef00:1720:17:2:210 metric 1024 pref medium In both cases, fe80::7ac5:7dff:fefd:1c10 is the default gateway of the EDMZ firewall in the direction of the DSL router, i.e. the ULA of the DSL router! ======================================================================= TRAFFIC: EDMZ-FW (FWB) → Internet 1) DNS root@vml000210:~# host -t AAAA heise.de heise.de has IPv6 address 2a02:2e0:3fe:1001:302:: 2) ping to heise.de root@vml000210:~# ping -6 -c4 2a02:2e0:3fe:1001:302:: PING 2a02:2e0:3fe:1001:302:: (2a02:2e0:3fe:1001:302::) 56 data bytes 64 bytes from 2a02:2e0:3fe:1001:302::: icmp_seq=1 ttl=56 time=13.0 ms 64 bytes from 2a02:2e0:3fe:1001:302::: icmp_seq=2 ttl=56 time=13.6 ms 64 bytes from 2a02:2e0:3fe:1001:302::: icmp_seq=3 ttl=56 time=13.3 ms 64 bytes from 2a02:2e0:3fe:1001:302::: icmp_seq=4 ttl=56 time=13.2 ms --- 2a02:2e0:3fe:1001:302:: ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3005ms rtt min/avg/max/mdev = 12.952/13.245/13.606/0.237 ms ======================================================================= However, if I now connect my laptop directly to the network interface, which is connected directly from the KVM host to the virtual machine vml000110 using a bridge, I get the following configuration parameters from the host vml000110's radvd and kea-dhcp6: ----------------------------------------------------------------------- I) NETWORK root@nitropad:~# ip -6 -br addr lo UNKNOWN ::1/128 enp0s25 UP fd00::7:10:0:10:73/64 2003:a:bcd:ef07:10:0:10:73/64 fe80::9f6c:de76:b191:9938/64 ----------------------------------------------------------------------- II) ROUTING root@nitropad:~# ip -6 route ::1 dev lo proto kernel metric 256 pref medium 2003:a:bcd:ef07::/64 dev enp0s25 proto kernel metric 100 pref medium fd00:0:0:7::/64 dev enp0s25 proto kernel metric 100 pref medium fe80::/64 dev enp0s25 proto kernel metric 1024 pref medium default via fe80::5054:ff:fe41:1102 dev enp0s25 proto static metric 20100 pref medium The default gateway with the address fe80::5054:ff:fe41:1102 is the LLA of the internal firewall FBC with the network interface eth1, i.e. the direct partner to which the laptop is connected! ======================================================================= TRAFFIC: Laptop → IDMZ-FW (FWC) "outgoing" I can access the internal firewall FWC from my laptop without any problems: 1) ping to LLA eth1 of FWC: root@nitropad:~# ping -6c4 fe80::5054:ff:fe41:1102%enp0s25 PING fe80::5054:ff:fe41:1102%enp0s25(fe80::5054:ff:fe41:1102%enp0s25) 56 data bytes 64 bytes from fe80::5054:ff:fe41:1102%enp0s25: icmp_seq=1 ttl=64 time=0.511 ms 64 bytes from fe80::5054:ff:fe41:1102%enp0s25: icmp_seq=2 ttl=64 time=0.491 ms 64 bytes from fe80::5054:ff:fe41:1102%enp0s25: icmp_seq=3 ttl=64 time=0.490 ms 64 bytes from fe80::5054:ff:fe41:1102%enp0s25: icmp_seq=4 ttl=64 time=0.574 ms --- fe80::5054:ff:fe41:1102%enp0s25 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3068ms rtt min/avg/max/mdev = 0.490/0.516/0.574/0.034 ms 2) ping to ULA of FWC - eth1: root@nitropad:~# ping -6c4 fd00::7:10:0:10:110 PING fd00::7:10:0:10:110(fd00::7:10:0:10:110) 56 data bytes 64 bytes from fd00::7:10:0:10:110: icmp_seq=1 ttl=64 time=1.01 ms 64 bytes from fd00::7:10:0:10:110: icmp_seq=2 ttl=64 time=0.533 ms 64 bytes from fd00::7:10:0:10:110: icmp_seq=3 ttl=64 time=0.576 ms 64 bytes from fd00::7:10:0:10:110: icmp_seq=4 ttl=64 time=0.543 ms --- fd00::7:10:0:10:110 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3031ms rtt min/avg/max/mdev = 0.533/0.666/1.012/0.200 ms 3) ping to GUA of FWC - eth1: root@nitropad:~# ping -6c4 2003:a:bcd:ef07:10:0:10:110 PING 2003:a:bcd:ef07:10:0:10:110(2003:a:bcd:ef:07:10:0:10:110) 56 data bytes 64 bytes from 2003:a:bcd:ef07:10:0:10:110: icmp_seq=1 ttl=64 time=0.816 ms 64 bytes from 2003:a:bcd:ef07:10:0:10:110: icmp_seq=2 ttl=64 time=0.485 ms 64 bytes from 2003:a:bcd:ef07:10:0:10:110: icmp_seq=3 ttl=64 time=0.496 ms 64 bytes from 2003:a:bcd:ef07:10:0:10:110: icmp_seq=4 ttl=64 time=0.450 ms --- 2003:a:bcd:ef07:10:0:10:110 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3054ms rtt min/avg/max/mdev = 0.450/0.561/0.816/0.147 ms 4) ping to GUA of FWC - eth0 (this is the connection to external firewall EDMZ FWB): root@nitropad:~# ping -6c4 2003:a:bcd:ef03:10:0:0:110 PING 2003:a:bcd:ef03:10:0:0:110(2003:a:bcd:ef03:10::110) 56 data bytes 64 bytes from 2003:a:bcd:ef03:10::110: icmp_seq=1 ttl=64 time=0.458 ms 64 bytes from 2003:a:bcd:ef03:10::110: icmp_seq=2 ttl=64 time=0.373 ms 64 bytes from 2003:a:bcd:ef03:10::110: icmp_seq=3 ttl=64 time=0.462 ms 64 bytes from 2003:a:bcd:ef03:10::110: icmp_seq=4 ttl=64 time=0.506 ms --- 2003:a:bcd:ef03:10:0:0:110 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3055ms rtt min/avg/max/mdev = 0.373/0.449/0.506/0.048 ms 5) But now comes the real HOLY SHIT: When I try to ping the interface eth1 of the EDMZ firewall (FWB) from my laptop, unfortunately only this happens: root@nitropad:~# ping -6c4 2003:a:bcd:ef:03:10:0:0:210 PING 2003:a:bcd:ef03:10:0:0:210(2003:a:bcd:ef03:10::210) 56 data bytes --- 2003:a:bcd:ef:03:10:0:0:210 ping statistics --- 4 packets transmitted, 0 received, 100% packet loss, time 3071ms 6) I see the same crap when I try to ping heise.de, for example: root@nitropad:~# ping -6c4 2a02:2e0:3fe:1001:302:: PING 2a02:2e0:3fe:1001:302::(2a02:2e0:3fe:1001:302::) 56 data bytes --- 2a02:2e0:3fe:1001:302:: ping statistics --- 4 packets transmitted, 0 received, 100% packet loss, time 3055ms ======================================================================= I just don't understand it. I can access the internet without any problems from both VMs. But as soon as I try to access FWB or the internet in front of it from the intranet, I mercilessly starve to death somewhere at the internal firewall FWC. I don't even think that the firewall is causing problems here, because the configuration of the same corresponds to that on the FWB (EDMZ-Firewall) My biggest guess is more in the direction of routing, but only where exactly have I made a mistake in my thinking and configuration. I just don't understand it. That's why I'm hoping that someone here can help me out or point me in the right direction. I'd like to say a huge thank you in advance for even the tiniest hint! Best regards Django

5 18

Is it on the roadmap to add Outbound ?
by Dan White 25 Sep '24

25 Sep '24

Subject line says it all. I cannot find any specific info about this feature.

3 3

Firewalld & DMZ
by Paavo Leinonen 21 Aug '24

21 Aug '24

Hi, please help me configure DMZ for my network. Used about half an hour to look for detailed docs and/or good examples, but failed. Either I need to improve my search skills, or firewalld+dmz is not very common thing or widely documented. Router/server is a Fedora box running firewalld, with interfaces - eth0 (DHCP) towards public internet - eth1 (192.168.111.1/24): DMZ - eth2 (192.168.222.1/24): trusted network for trusted devices firewall-cmd --list-all-zones for relevant zones ... dmz (active) target: ACCEPT ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: eth1 sources: services: ports: protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: ... private (default, active) target: ACCEPT ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: eth2 sources: services: ports: protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: ... public (active) target: default ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: eth0 sources: services: dhcpv6-client ports: protocols: forward: no masquerade: yes forward-ports: source-ports: icmp-blocks: rich rules: ... Now everything works, but the problem is that devices in DMZ can access devices in trusted network. When dmz zone target was default, then devices in DMZ could not access the internet. The basic goals for the network architecture is to - allow devices in DMZ access internet - allow devices in DMZ access chosen or all services in the router/server - deny devices in DMZ accessing devices in trusted network - allow devices in trusted network access internet - allow devices in trusted network access other devices in trusted network - allow devices in trusted network access devices in DMZ (ideally, not must have) Any help appreciated. -Paavo

1 0

ipset and --permanent
by Marco Moock 10 Aug '24

10 Aug '24

Hello! I would like to understand when and why I need --permanent when using ipsets. My goal is the following: fail2ban should ban IPs via the ipset option through firewalld. I want this way because I prefer to have all firewall stuff at one place. I've now deleted a permanent ipset, and it still resides in the runtime. Although, I can't delete it from the runtime. m@zbook:~$ sudo firewall-cmd --permanent --new-ipset=test --type=hash:ip --family=inet success m@zbook:~$ sudo firewall-cmd --delete-ipset=test --permanent success m@zbook:~$ sudo firewall-cmd --get-ipsets test m@zbook:~$ sudo firewall-cmd --get-ipsets --permanent m@zbook:~$ What is the preferred way to handle that? -- kind regards Marco

2 4

encrypted SIP/RTSP conn tracking
by Marco Moock 07 Aug '24

07 Aug '24

Hello! I use Linphone and SIP via TLS and SRTP. I notice that the incoming SRTP is being blocked. Is there any way to track that to allow it on demand? Aug 07 18:46:57 zbook kernel: filter_IN_FedoraServer_REJECT: IN=vpn0 OUT= MAC= SRC=2a04:2100:0000:0300:0000:0000:0000:0160 DST=2a01:0170:xxxx LEN=80 TC=184 HOPLIMIT=57 FLOWLBL=0 PROTO=UDP SPT=13211 DPT=58422 LEN=40 I can set static dst ports for that, if that is a way. -- kind regards Marco

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

firewalld-users