On Mon, Aug 24, 2020 at 08:52:34AM -0000, Jason Long wrote: Alternatively you can use a "service" for some of these: 80 --> http 443 --> https # firewall-cmd --zone public --add-service http # firewall-cmd --zone public --add-service https I have no idea why you're opening 40000-50000. firewalld doesn't support NFQUEUE which seems required for Suricata. You'd have to use a firewalld --direct rule to add the rule to iptables.

On Mon, Aug 24, 2020 at 02:52:22PM -0000, Jason Long wrote: Services are abstraction. They can contain one port, many ports, but also things. They provide a user friendly way to open up firewall holes, e.g. ssh, samba, mdns, etc. No. --direct allows firewalld to manage iptables rules. It's a way to let the user add native iptables rules. firewalld doesn't have abstractions for everything iptables supports. You should read the documentation [1]. Seems like you're not familiar with the basic firewalld concepts. [1]: https://firewalld.org/documentation/

On Wed, Sep 02, 2020 at 02:00:13PM -0000, Jason Long wrote: No.