12:44 a.m.
Hello,
Comparing the default nft rulesets of firewalld and ufw (on Debian 11), I note that ufw
provides a qualified 'policy drop' for input, but firewalld does not.
Isn't this less secure, and shouldn't it?
With thanks,
Gareth
7:23 a.m.
On Sun, Jul 10, 2022 at 06:44:20AM +0100, Gareth Evans wrote:
Hello,
Comparing the default nft rulesets of firewalld and ufw (on Debian
11), I note that ufw provides a qualified 'policy drop' for input, but
firewalld does not.
I'm not sure what you mean. firewalld denies most traffic by default.
Exception is that some zones, e.g. public, allow some things by default,
e.g. ssh.
# nft list chain inet firewalld filter_INPUT
table inet firewalld {
chain filter_INPUT {
type filter hook input priority filter + 10; policy accept;
ct state { established, related } accept
ct status dnat accept
iifname "lo" accept
jump filter_INPUT_ZONES
ct state invalid drop
reject with icmpx admin-prohibited <--- catch-all reject
}
}
The chain policy is not necessary because there is an explicit rule at
the end of the chain.
5:54 p.m.
On Mon 11 Jul 2022, at 13:23, Eric Garver <egarver(a)redhat.com> wrote:
[...]
# nft list chain inet firewalld filter_INPUT
table inet firewalld {
chain filter_INPUT {
[...]
reject with icmpx admin-prohibited <--- catch-all
reject
}
}
The chain policy is not necessary because there is an explicit rule at
the end of the chain.
That had slipped my notice, thank you for confirming.
Kind regards,
Gareth
648
days inactive
649
days old
firewalld-users@lists.fedorahosted.org
2 comments
2 participants
participants (2)
-
Eric Garver -
Gareth Evans