--On Tuesday, June 16, 2020 7:40 AM +0800 Ed Greshko <ed.greshko(a)greshko.com&gt; wrote: OS and version? firewalld version and back end used? For RHEL/CentOS, I start by listing the back end rules.

--On Tuesday, June 16, 2020 8:17 AM +0800 Ed Greshko <ed.greshko(a)greshko.com&gt; wrote: This looks like a good starting point: <https://wiki.nftables.org/wiki-nftables/index.php/Quick_reference-nftable...

On 2020-06-16 07:24, Kenneth Porter wrote: The other thing I found odd is that I did firewall-cmd --set-log-denied=all And saw no journal entries showing the reject.  I used wireshark. and I do see. 129.168.2.116----->192.168.122.152 Transmission Control Protocol, Src Port: 44870, Dst Port: 22, Seq: 0, Len: 0 and immediately after 192.168.2.127----->192.168.2.116  Internet Control Message Protocol (Port unreachable)

--On Wednesday, June 17, 2020 8:07 AM +0800 Ed Greshko <ed.greshko(a)greshko.com&gt; wrote: That error usually means an address issue, not a firewall issue. Are the two machines in the same subnet? Check "ip addr show" for the interfaces involved.

On 2020-06-17 08:24, Ed Greshko wrote: Oh, and the ICMP message I see on wireshark coming from 192.168.2.127 (the fw side) is Type: 3 (Destination unreachable) Code: 13 (Communication administratively filtered) -- The key to getting good answers is to ask good questions.

On 2020-06-17 03:23, Eric Garver wrote: No difference when set to "yes".  :-(

On 2020-06-17 04:23, Eric Garver wrote: Just for refresher.... [egreshko@meimei ~]$ sudo firewall-cmd --get-active-zones libvirt   interfaces: virbr0 public   interfaces: enp2s0 wlp4s0 And then.... [egreshko@meimei ~]$ sudo firewall-cmd --list-all-zones FedoraServer   target: default   icmp-block-inversion: no   interfaces:   sources:   services: dhcpv6-client ssh   ports:   protocols:   masquerade: no   forward-ports:   source-ports:   icmp-blocks:   rich rules: FedoraWorkstation   target: default   icmp-block-inversion: no   interfaces:   sources:   services: dhcpv6-client samba-client ssh   ports: 1025-65535/udp 1025-65535/tcp   protocols:   masquerade: no   forward-ports:   source-ports:   icmp-blocks:   rich rules: block   target: %%REJECT%%   icmp-block-inversion: no   interfaces:   sources:   services:   ports:   protocols:   masquerade: no   forward-ports:   source-ports:   icmp-blocks:   rich rules: dmz   target: default   icmp-block-inversion: no   interfaces:   sources:   services: ssh   ports:   protocols:   masquerade: no   forward-ports:   source-ports:   icmp-blocks:   rich rules: drop   target: DROP   icmp-block-inversion: no   interfaces:   sources:   services:   ports:   protocols:   masquerade: no   forward-ports:   source-ports:   icmp-blocks:   rich rules: external   target: default   icmp-block-inversion: no   interfaces:   sources:   services: ssh   ports:   protocols:   masquerade: yes   forward-ports:   source-ports:   icmp-blocks:   rich rules: home   target: default   icmp-block-inversion: no   interfaces:   sources:   services: dhcpv6-client mdns mountd nfs nfs3 rpc-bind samba-client ssh   ports:   protocols:   masquerade: no   forward-ports:   source-ports:   icmp-blocks:   rich rules: internal   target: default   icmp-block-inversion: no   interfaces:   sources:   services: dhcpv6-client mdns samba-client ssh   ports:   protocols:   masquerade: no   forward-ports:   source-ports:   icmp-blocks:   rich rules: libvirt (active)   target: ACCEPT   icmp-block-inversion: no   interfaces: virbr0   sources:   services: dhcp dhcpv6 dns mountd nfs nfs3 rpc-bind ssh   ports:   protocols: icmp ipv6-icmp   masquerade: no   forward-ports:   source-ports:   icmp-blocks:   rich rules:         rule priority="32767" reject nm-shared   target: ACCEPT   icmp-block-inversion: no   interfaces:   sources:   services: dhcp dns   ports:   protocols: icmp ipv6-icmp   masquerade: no   forward-ports:   source-ports:   icmp-blocks:   rich rules:         rule priority="32767" reject public (active)   target: default   icmp-block-inversion: no   interfaces: enp2s0 wlp4s0   sources:   services: dhcpv6-client dns kdeconnect mdns mountd nfs nfs3 rpc-bind samba-client ssh   ports:   protocols:   masquerade: no   forward-ports:   source-ports:   icmp-blocks:   rich rules: trusted   target: ACCEPT   icmp-block-inversion: no   interfaces:   sources:   services:   ports:   protocols:   masquerade: no   forward-ports:   source-ports:   icmp-blocks:   rich rules: work   target: default   icmp-block-inversion: no   interfaces:   sources:   services: dhcpv6-client mdns ssh   ports:   protocols:   masquerade: no   forward-ports:   source-ports:   icmp-blocks:   rich rules:

On 2020-06-18 00:50, Eric Garver wrote: OK.... Due the the length of the output I'll attach 2 .txt files.  Hope that is acceptable.

On 2020-06-18 04:32, Eric Garver wrote: Well, I got my directions wrong. The VM is on the left.  The Wifi connected system is on the right. Does that change anything? Even that wouldn't explain why, with the middle system 3 interfaces being 192.168.122.1/192.168.1.18/192.168.2.127  I can't ssh to 192.168.1.142 from 2.116 with the FW up.

On 2020-06-24 22:34, Eric Garver wrote: Yes, I didn't put that network in the diagram since it seemed to me irrelevant to the initial problem/question. I can see how the new feature would affect an ssh from .2.116 to .1.142 since both enp2s0 and wlp4s0 are both in the public zone. [egreshko@meimei ~]$ sudo firewall-cmd --get-active-zones libvirt   interfaces: virbr0 public   interfaces: enp2s0 wlp4s0 But, the original problem I'm trying to resolve is ssh (or any traffic) from .2.116 to  .122.152 which would be between the public and libvirt zones. Is there a roadmap for the next release? But, I get no log messages when I set --set-log-denied=all.  Shouldn't those be logged? And, why did this all work prior to 6/5?

On 2020-06-25 22:21, Eric Garver wrote: Sorry, I must be missing something.  When you say "libvirt's rules" aren't they the rules of the libvirt zone? They can't be "adjusted" with the usual firewall-cmd commands? Also, wouldn't one expect the rules to be the same for IPv4 and IPv6?  Hope the network diagram attachment makes it. Configured on the router are Forward Port 22 from 211.75.128.214 to 192.168.122.152 Static route pointing 192.168.122.0/24 to 192.168.1.18 Static route pointing 2001:b030:112f:2::/64 to 2001:b030:112f::140e From a host with IPs of 211.75.128.211 and 2001:470:67:cce::5 this works. [egreshko@acer ~]$ ssh 2001:b030:112f:2::4 Last login: Thu Jun 25 22:15:30 2020 from 2001:470:66:cce::2 While this "hangs".  (I think because ICMP may be blocked at some point.  Too late in my day to check) [egreshko@acer ~]$ ssh 211.75.128.214 ssh: connect to host 211.75.128.214 port 22: Connection timed out

On 2020-06-26 00:49, Eric Garver wrote: And there is no way to see what those rules are and verify this?  I'd like to submit a bugzilla, so would you know what component it should be filed against? Well, all of my IPv6 addresses are public and assigned by my ISP.  I don't think there is NAT/masquerading needed/involved.

On 2020-06-26 03:00, Eric Garver wrote: OK, yes it certainly does look like all is working as designed.  I'd been thrown since it was all working for me until recently.  In fact, it never should have worked. Well, since IPv6 works for me as I would want I think I'll just go with that as the method described in the link is as it says "a hack" and only provides access to a single VM and a single port.  I use a much larger number of VMs and ports. Thanks for the link and thanks much for your time.