8:03 p.m.
Hi, I'm struggling to set up firewalld to pass traffic between 2 networks. Is this
possible with firewalld?
My lab setup is:
Server (ens192:192.168.3.2) <-> (ens224:192.168.3.1) firewall (ens192:192.168.110.8)
<-> (ens192:192.168.110.9) client
Freshly installed CentOS 8.2 (2004), server installation with no GUI on all 3 VMs.
[root@firewall ~]# sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1
Client can ping Server
[root@client ~]# ping -c 3 192.168.3.2
PING 192.168.3.2 (192.168.3.2) 56(84) bytes of data.
64 bytes from 192.168.3.2: icmp_seq=1 ttl=63 time=0.530 ms
64 bytes from 192.168.3.2: icmp_seq=2 ttl=63 time=0.552 ms
64 bytes from 192.168.3.2: icmp_seq=3 ttl=63 time=0.444 ms
Client can't get to the server's ssh port.
[root@client ~]# nc 192.168.3.2 22
Ncat: No route to host.
[root@firewall ~]# systemctl stop firewalld
[root@client ~]# nc 192.168.3.2 22
SSH-2.0-OpenSSH_8.0
So far things are working as expected.
I configure firewalld as follows:
[root@firewall ~]# systemctl start firewalld
[root@firewall ~]# firewall-cmd --version
0.8.0
[root@firewall ~]# firewall-cmd --zone=public --remove-interface=ens192
success
[root@firewall ~]# firewall-cmd --zone=public --remove-interface=ens224
success
[root@firewall ~]# firewall-cmd --zone=dmz --add-interface=ens224
success
[root@firewall ~]# firewall-cmd --zone=internal --add-interface=ens192
success
[root@firewall ~]# firewall-cmd --zone=internal --add-rich-rule='rule family=ipv4
source address=192.168.110.9/32 destination address=192.168.3.2/32 service name=ssh
accept'
success
[root@firewall ~]# firewall-cmd --zone=internal --list-all
internal (active)
target: default
icmp-block-inversion: no
interfaces: ens192
sources:
services: cockpit dhcpv6-client mdns samba-client ssh
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family="ipv4" source address="192.168.110.9/32" destination
address="192.168.3.2/32" service name="ssh" accept
[root@firewall ~]# firewall-cmd --zone=dmz --list-all
dmz (active)
target: default
icmp-block-inversion: no
interfaces: ens224
sources:
services: ssh
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
[root@client ~]# nc 192.168.3.2 22
Ncat: No route to host.
Shouldn't this work? What am I missing?
11:22 p.m.
I spent most of yesterday on this and found only 2 threads on the same subject but
unfortunately there were no answers. All other discussions were using NAT, which I
don't need nor want.
After more research it appears that this is expected in v8.0 and the functionality should
be implemented in v9.x of firewalld.
So, I installed the latest version of Fedora and installed firewalld 9.1. Unfortunately I
get the exact same results.
[root@firewall ~]# firewall-cmd --version
0.9.1
[root@firewall ~]# tail -1 /etc/firewalld/firewalld.conf
AllowZoneDrifting=yes
Any help with a solution for this would be much appreciated.
Regards,
Rob
9:35 a.m.
On Sun, Nov 08, 2020 at 05:22:52AM -0000, Robert Smuhar wrote:
I spent most of yesterday on this and found only 2 threads on the
same subject but unfortunately there were no answers. All other discussions were using
NAT, which I don't need nor want.
After more research it appears that this is expected in v8.0 and the functionality should
be implemented in v9.x of firewalld.
So, I installed the latest version of Fedora and installed firewalld 9.1. Unfortunately I
get the exact same results.
[root@firewall ~]# firewall-cmd --version
0.9.1
[root@firewall ~]# tail -1 /etc/firewalld/firewalld.conf
AllowZoneDrifting=yes
This is strongly discouraged. The default is "no". I suggest leaving it
as "no".
Any help with a solution for this would be much appreciated.
Simply upgrade to v0.9.z is not enough. You need to add the rules to
allow the traffic. This means creating a policy.
I'm guessing based of your original email, but maybe this is what you
want:
# firewall-cmd --permanent --new-policy internalToDmz
# firewall-cmd --permanent --policy internalToDmz --add-ingress-zone internal
# firewall-cmd --permanent --policy internalToDmz --add-egress-zone dmz
# firewall-cmd --permanent --policy internalToDmz --add-service ssh
# firewall-cmd --reload
This creates a policy that allows SSH connections from the zone internal
to zone dmz.
12:34 a.m.
On 08/11/2020 10:03, Robert Smuhar wrote:
Hi, I'm struggling to set up firewalld to pass traffic between 2
networks. Is this possible with firewalld?
My lab setup is:
Server (ens192:192.168.3.2) <-> (ens224:192.168.3.1) firewall
(ens192:192.168.110.8) <-> (ens192:192.168.110.9) client
Freshly installed CentOS 8.2 (2004), server installation with no GUI on all 3 VMs.
I think I understand you and I think I have much the same setup. I don't know if this
is of any
help.
Server (enp1s0:192.168.122.26) <-> (virb0:192.168.122.1) firewall
(wlp4s0:192.168.2.127) <-> (wlp6s0:192.168.2.116) client
firewall=meimei, client=acer, server=f33k
[root@meimei ~]# sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1
[root@meimei ~]# firewall-cmd --get-active-zones
libvirt
interfaces: virbr0
public
interfaces: enp2s0
trusted
interfaces: wlp4s0
[root@meimei ~]# firewall-cmd --version
0.8.4
[egreshko@acer ~]$ traceroute 192.168.122.26
traceroute to 192.168.122.26 (192.168.122.26), 30 hops max, 60 byte packets
1 192.168.2.127 (192.168.2.127) 2.735 ms 2.862 ms 3.540 ms
2 192.168.122.26 (192.168.122.26) 4.319 ms !X 4.493 ms !X 4.629 ms !X
[egreshko@acer ~]$ ping -c 2 192.168.122.26
PING 192.168.122.26 (192.168.122.26) 56(84) bytes of data.
64 bytes from 192.168.122.26: icmp_seq=1 ttl=63 time=3.26 ms
64 bytes from 192.168.122.26: icmp_seq=2 ttl=63 time=3.01 ms
[egreshko@acer ~]$ ssh 192.168.122.26
egreshko(a)192.168.122.26's password:
Last login: Sun Nov 8 14:04:25 2020 from 192.168.2.116
[root@meimei ~]# firewall-cmd --zone=libvirt --list-all
libvirt (active)
target: ACCEPT
icmp-block-inversion: no
interfaces: virbr0
sources:
services: dhcp dhcpv6 dns mountd nfs nfs3 rpc-bind ssh
ports:
protocols: icmp ipv6-icmp
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule priority="32767" reject
[root@meimei ~]# firewall-cmd --zone=trusted --list-all
trusted (active)
target: ACCEPT
icmp-block-inversion: no
interfaces: wlp4s0
sources:
services: dns kdeconnect mdns mountd nfs nfs3 rpc-bind samba-client ssh
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
1:24 a.m.
G'day Ed,
Thank you for the feedback.
From my testing I found that if a zone has "target: ACCEPT" then all traffic
passes through firewalld even if you have a rich-rule to explicitly drop/reject a
host/network/service. You might as well disable firewalld.
To me it seems that firewalld is only a host based firewall and not a perimeter firewall
to block/allow access to your network... unless your NATing.
9:31 a.m.
On Sun, Nov 08, 2020 at 02:03:37AM -0000, Robert Smuhar wrote:
Hi, I'm struggling to set up firewalld to pass traffic between 2
networks. Is this possible with firewalld?
Until v0.9.0 firewalld was effectively an end station firewall. This
means it did not support FORWARD filtering.
My lab setup is:
Server (ens192:192.168.3.2) <-> (ens224:192.168.3.1) firewall
(ens192:192.168.110.8) <-> (ens192:192.168.110.9) client
Freshly installed CentOS 8.2 (2004), server installation with no GUI on all 3 VMs.
[root@firewall ~]# sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1
Client can ping Server
[root@client ~]# ping -c 3 192.168.3.2
PING 192.168.3.2 (192.168.3.2) 56(84) bytes of data.
64 bytes from 192.168.3.2: icmp_seq=1 ttl=63 time=0.530 ms
64 bytes from 192.168.3.2: icmp_seq=2 ttl=63 time=0.552 ms
64 bytes from 192.168.3.2: icmp_seq=3 ttl=63 time=0.444 ms
ICMP works because zones with a target of "default" will explicitly
allow FORWARDed ICMP packets.
Client can't get to the server's ssh port.
[root@client ~]# nc 192.168.3.2 22
Ncat: No route to host.
However, SSH is dropped because there are on FORWARD rules to allow it.
Older firewalld versions do _not_ support FORWARD filtering.
[root@firewall ~]# systemctl stop firewalld
[root@client ~]# nc 192.168.3.2 22
SSH-2.0-OpenSSH_8.0
So far things are working as expected.
I configure firewalld as follows:
[root@firewall ~]# systemctl start firewalld
[root@firewall ~]# firewall-cmd --version
0.8.0
[root@firewall ~]# firewall-cmd --zone=public --remove-interface=ens192
success
[root@firewall ~]# firewall-cmd --zone=public --remove-interface=ens224
success
[root@firewall ~]# firewall-cmd --zone=dmz --add-interface=ens224
success
[root@firewall ~]# firewall-cmd --zone=internal --add-interface=ens192
success
[root@firewall ~]# firewall-cmd --zone=internal --add-rich-rule='rule family=ipv4
source address=192.168.110.9/32 destination address=192.168.3.2/32 service name=ssh
accept'
success
rich rules added to a zone will filter on the INPUT. It will _not_
filter FORWARDed packets.
[root@firewall ~]# firewall-cmd --zone=internal --list-all
internal (active)
target: default
icmp-block-inversion: no
interfaces: ens192
sources:
services: cockpit dhcpv6-client mdns samba-client ssh
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family="ipv4" source address="192.168.110.9/32" destination
address="192.168.3.2/32" service name="ssh" accept
[root@firewall ~]# firewall-cmd --zone=dmz --list-all
dmz (active)
target: default
icmp-block-inversion: no
interfaces: ens224
sources:
services: ssh
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
[root@client ~]# nc 192.168.3.2 22
Ncat: No route to host.
Shouldn't this work? What am I missing?
No. Newer firewalld version have native support for FORWARD and OUTPUT
filtering.
See these posts:
- https://firewalld.org/2020/09/policy-objects-introduction
- https://firewalld.org/2020/09/policy-objects-filtering-container-and-vm-t...
3:53 a.m.
G'day Eric,
Thank you for the feedback and the example. It is much appreciated.
This worked in my lab setup:
[root@firewall ~]# firewall-cmd --permanent --zone=FedoraServer --remove-interface=ens192
[root@firewall ~]# firewall-cmd --permanent --zone=FedoraServer --remove-interface=ens224
[root@firewall ~]# firewall-cmd --permanent --zone=dmz --add-interface=ens224
[root@firewall ~]# firewall-cmd --permanent --zone=internal --add-interface=ens192
[root@firewall ~]# firewall-cmd --permanent --new-policy InternalToDmz
[root@firewall ~]# firewall-cmd --permanent --policy InternalToDmz --add-ingress-zone
internal
[root@firewall ~]# firewall-cmd --permanent --policy InternalToDmz --add-egress-zone dmz
[root@firewall ~]# firewall-cmd --permanent --policy InternalToDmz --add-service ssh
[root@firewall ~]# firewall-cmd --reload
So what is the "destination address=" parameter in the rich-rule for?
Also, would you have any ideas when firewalld v0.9.x will make it into the CentOS build?
Rob
7:53 a.m.
On Tue, Nov 10, 2020 at 09:53:46AM -0000, Robert Smuhar wrote:
G'day Eric,
Thank you for the feedback and the example. It is much appreciated.
This worked in my lab setup:
[root@firewall ~]# firewall-cmd --permanent --zone=FedoraServer
--remove-interface=ens192
[root@firewall ~]# firewall-cmd --permanent --zone=FedoraServer
--remove-interface=ens224
[root@firewall ~]# firewall-cmd --permanent --zone=dmz --add-interface=ens224
[root@firewall ~]# firewall-cmd --permanent --zone=internal --add-interface=ens192
[root@firewall ~]# firewall-cmd --permanent --new-policy InternalToDmz
[root@firewall ~]# firewall-cmd --permanent --policy InternalToDmz --add-ingress-zone
internal
[root@firewall ~]# firewall-cmd --permanent --policy InternalToDmz --add-egress-zone dmz
[root@firewall ~]# firewall-cmd --permanent --policy InternalToDmz --add-service ssh
[root@firewall ~]# firewall-cmd --reload
So what is the "destination address=" parameter in the rich-rule for?
It matches the destination IP address.
Also, would you have any ideas when firewalld v0.9.x will make it
into the CentOS build?
Probably not until CentOS 8.5 or later.
1261
days inactive
1263
days old
firewalld-users@lists.fedorahosted.org
7 comments
3 participants
participants (3)
-
Ed Greshko -
Eric Garver -
Robert Smuhar