Hi, sometimes is useful to allow connections from a specific combination of of source_address:source_port. For example if you want to allow the icecream[1] autodiscovery service in your local network you would likely want to allow connections coming from: 192.168.1.0/24:8765 udp I think this is a very common use case in local networks where you have services running in well-known ports that use random ports in your local machine to setup connections. Is there any way to do that in firewalled?

On 11.09.2013 12:18, Sergio Villar Senin wrote: > Hi, > > sometimes is useful to allow connections from a specific combination of > of source_address:source_port. For example if you want to allow the > icecream[1] autodiscovery service in your local network you would likely > want to allow connections coming from: > > 192.168.1.0/24:8765 udp > > I think this is a very common use case in local networks where you have > services running in well-known ports that use random ports in your local > machine to setup connections. > > Is there any way to do that in firewalled? > It would be awkward if it can't. :) man 5 firewalld.richlanguage

On 11.09.2013 17:55, Sergio Villar Senin wrote: > On 11/09/13 13:37, poma wrote: >> On 11.09.2013 12:18, Sergio Villar Senin wrote: >>> Hi, >>> >>> sometimes is useful to allow connections from a specific combination of >>> of source_address:source_port. For example if you want to allow the >>> icecream[1] autodiscovery service in your local network you would likely >>> want to allow connections coming from: >>> >>> 192.168.1.0/24:8765 udp >>> >>> I think this is a very common use case in local networks where you have >>> services running in well-known ports that use random ports in your local >>> machine to setup connections. >>> >>> Is there any way to do that in firewalled? >>> >> >> It would be awkward if it can't. :) >> man 5 firewalld.richlanguage > > I've read the richlanguage syntax and still I cannot find the way to > specify the source port, because the <port> element is translated to the > destination port in the iptables rule and the <source> element only > allows to specify the address, not the port. > firewall-cmd --permanent --add-rich-rule='rule port port="8765" protocol="udp" family="ipv4" source address="192.168.1.0/24" accept' firewall-cmd --reload firewall-cmd --list-rich-rules

On 11.09.2013 19:13, Sergio Villar Senin wrote: > Using again iptables terminology, I want to set the "--sport" not the > "--dport" > OK now I understand what you meant. RFE - firewalld-devel(a)lists.fedorahosted.org ;)