4:27 p.m.
Hi,
I am running into a firewalld behavior again that I cannot understand.
Running firewalld on a Debian 11 box.
The zone file contains the following:
<icmp-block-inversion/>
<icmp-block name="echo-reply"/>
<icmp-block name="echo-request"/>
A ping from a client results in a reply, but I am still getting the following error
message in syslog:
"filter_zone_knet_HOST_ICMP_BLOCK: "IN=enp2s0 OUT= MAC=<ANOM>
SRC=192.168.1.9 DST=192.168.1.1 LEN=60 TOS=0x00 PREC=0x00 TTL=128 ID=56385 PROTO=ICMP
TYPE=8 CODE=0 ID=1 SEQ=509
What's happening?
Thanks for your help and best regards,
Koen
9:26 p.m.
On 2/8/2022 2:27 PM, Koen Drai wrote:
I am still getting the following error message in syslog:
"filter_zone_knet_HOST_ICMP_BLOCK: "IN=enp2s0 OUT= MAC=<ANOM>
SRC=192.168.1.9 DST=192.168.1.1 LEN=60 TOS=0x00 PREC=0x00 TTL=128
ID=56385 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=509
Can you dump the whole nftables rule list to a pastebin and post the
link here?
10:02 p.m.
On 2/8/22 20:26, Kenneth Porter wrote:
On 2/8/2022 2:27 PM, Koen Drai wrote:
> I am still getting the following error message in syslog:
>
> "filter_zone_knet_HOST_ICMP_BLOCK: "IN=enp2s0 OUT= MAC=<ANOM>
> SRC=192.168.1.9 DST=192.168.1.1 LEN=60 TOS=0x00 PREC=0x00 TTL=128
> ID=56385 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=509
Can you dump the whole nftables rule list to a pastebin and post the
link here?
when I was talking to rhel support (different issues), I was told there
are some (serious) issues with netfilters, and they advised me to use
iptables instead for now. You can change that in the firewall setup
>
> _______________________________________________
> firewalld-users mailing list -- firewalld-users(a)lists.fedorahosted.org
> To unsubscribe send an email to
> firewalld-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedora...
> Do not reply to spam on the list, report it:
> https://pagure.io/fedora-infrastructure
8:15 a.m.
On Tue, Feb 08, 2022 at 09:02:34PM -0700, R C wrote:
On 2/8/22 20:26, Kenneth Porter wrote:
> On 2/8/2022 2:27 PM, Koen Drai wrote:
> > I am still getting the following error message in syslog:
> >
> > "filter_zone_knet_HOST_ICMP_BLOCK: "IN=enp2s0 OUT= MAC=<ANOM>
> > SRC=192.168.1.9 DST=192.168.1.1 LEN=60 TOS=0x00 PREC=0x00 TTL=128
> > ID=56385 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=509
>
> Can you dump the whole nftables rule list to a pastebin and post the
> link here?
when I was talking to rhel support (different issues), I was told there are
some (serious) issues with netfilters, and they advised me to use iptables
instead for now. You can change that in the firewall setup
I assure you this is a misunderstanding. This statement does not make
sense as iptables is part of netfilter.
netfilter is the umbrella term for all of Linux kernel packet filter,
mangling, connection tracking, etc.
Netfilter includes (non-exhaustive list):
- iptables
- nftables
- ebtables
- arptables
- ipset
- conntrack
8:10 a.m.
On Tue, Feb 08, 2022 at 11:27:57PM +0100, Koen Drai wrote:
Hi,
I am running into a firewalld behavior again that I cannot understand.
Running firewalld on a Debian 11 box.
The zone file contains the following:
<icmp-block-inversion/>
<icmp-block name="echo-reply"/>
<icmp-block name="echo-request"/>
A ping from a client results in a reply, but I am still getting the following error
message in syslog:
"filter_zone_knet_HOST_ICMP_BLOCK: "IN=enp2s0 OUT= MAC=<ANOM>
SRC=192.168.1.9 DST=192.168.1.1 LEN=60 TOS=0x00 PREC=0x00 TTL=128 ID=56385 PROTO=ICMP
TYPE=8 CODE=0 ID=1 SEQ=509
What's happening?
This has been fixed.
https://github.com/firewalld/firewalld/issues/696
Fixed in: v0.9.5, v1.0.2
815
days inactive
816
days old
firewalld-users@lists.fedorahosted.org
4 comments
4 participants
participants (4)
-
Eric Garver -
Kenneth Porter -
Koen Drai -
R C