On Fri, Sep 25, 2020 at 06:19:40AM +0800, Ed Greshko wrote: This works too. It has the added benefit that it includes the Fedora-isms. Thanks for the input Ed. :)

Thanks, Ed and Eric, for your help. | From: Eric Garver <egarver(a)redhat.com&gt; | On Thu, Sep 24, 2020 at 05:47:26PM -0400, D. Hugh Redelmeier wrote: | > Is there a reasonable way to get firewalld-0.9 for Fedora 32? I've decided that it isn't reasonable. Updating my system from F32 to F33 might get messy. F33 appears not to include firewalld-0.9. That seems to be scheduled for F34. | > I don't wish to compile my own and fight with Fedora's package management. It's not that I fear building packages. I fear contradicting Fedora's choice of package version. | > Alternatively, is it reasonable to run the nftable service as well as | > firewalld? | | The services explicitly Conflict. This is mostly because the nftables | service will flush _all_ the rules. Very useful to know. | > Alternatively, is --direct able to add nftable rules? | | No. This is by design. If something you need is not supported by | firewalld's rich rules please file an RFE. Ahh. I asked the wrong question. I could use --direct to add an iptables rule, and that should be good enough. I just thought iptables was a step backward from nftables (itself a step backwards from firewalld). I think that the rule will look something like this. The table is "filter", the chain is FORWARD and the priority is 0. Am I correct in assuming that since the table and chain ought to already exist, all I have to do is add the rule? The purpose is to drop all packets from the internet that have an explicit destination within MYSUBNET. sudo firewall-cmd \ --direct --add-rule ipv4 filter FORWARD 0 \ --in-interface=EXTERNAL_INTERFACE \ --source MYSUBNET \ DROP Questions: - should I be using chain FORWARD_direct instead of FORWARD? firewall-cmd(1) gives the example of INPUT_direct but does not specify which other chains are automatically created. (That seems like a documentation bug.) - can I use the long form of the iptables flags or do I have to use the single-letter version? firewall-cmd(1) only uses the single-letter versions. Answer: yes, long forms are accepted. | Alternatively, you can create your own nftables rules. firewalld only | uses/touches/flushes rules/chains in the "firewalld" tables. It will not | touch nftables rules created out-of-band of firewalld. This seems too fragile and complex for the tiny hack I need.

| From: Eric Garver <egarver(a)redhat.com&gt; Thanks again, Eric. Lot of useful information. | On Fri, Sep 25, 2020 at 01:13:51AM -0400, D. Hugh Redelmeier wrote: | > The purpose is to drop all packets from the internet that have an | > explicit destination within MYSUBNET. Just to be explicit: anything on my LAN from or too MYSUBNET is OK. Normal Masquerading is applied for packets leaving or entering from the internet. | You could just add MYSUBNET to the block zone. This will also block the | forwarded traffic. | | # firewall-cmd --zone block --add-source 10.254.254.0/24 If this kind of approach could work, it seems much cleaner than a direct rule. I don't understand this suggestion for a couple of reasons. - I thought zones were mutually exclusive. So if a packet comes in the external zone and is forwarded to the internal zone, when/how/why does the block zone apply? - it looks as if IP addresses for zones use "source" and there is no --add-destination (except for ICMP). I need to block MYSUBNET destinations. - if block zone does work, that may be too general. I only want to block traffic frome the external zone with MYSUBNET destinations. Other traffic with that destination is fine. In https://firewalld.org/documentation/zone/predefined-zones.html block Any incoming network connections are rejected with an icmp-host-prohibited message for IPv4 and icmp6-adm-prohibited for IPv6. Only network connections initiated within this system are possible. For reference, here again is the direct rule I'm considering: | > sudo firewall-cmd \ | > --direct --add-rule ipv4 filter FORWARD 0 \ | > --in-interface=EXTERNAL_INTERFACE \ | > --source MYSUBNET \ | > DROP

| From: Eric Garver <egarver(a)redhat.com&gt; | > For reference, here again is the direct rule I'm considering: | > | > | > sudo firewall-cmd \ | > | > --direct --add-rule ipv4 filter FORWARD 0 \ | > | > --in-interface=EXTERNAL_INTERFACE \ | > | > --source MYSUBNET \ | > | > DROP | | Based on what you said above this looks like your best option for | firewalld < v0.9.0. | | Note: You forgot the "-j". It should be "-j DROP" instead of "DROP". Thanks. No wonder that I confused you about what I was trying to do. --source should have been --destination. I don't seem to be cut out for iptables -- I keep making little mistakes. That's why I like firewalld. With those two changes, the direct rule works. (The real complexity of iptables is in the sequencing and priorities of rules. The more declarative nature of firewalld is much better.)