Trying to self-train on
firewalld I set up apache and configured the zones as follows:
[root@localhost ~]# firewall-cmd --get-active-zones work sources: 192.168.122.1 public interfaces: ens3 [root@localhost ~]# firewall-cmd --zone=work --list-all work interfaces: sources: 192.168.122.1 services: dhcpv6-client ipp-client ssh ports: masquerade: no forward-ports: icmp-blocks: rich rules: [root@localhost ~]# firewall-cmd --zone=public --list-all public (default, active) interfaces: ens3 sources: services: dhcpv6-client http https ssh ports: masquerade: no forward-ports: icmp-blocks: rich rules:
My expected result is that traffic from the hypervisor would match the "work" zone and since http isn't allowed for that zone for it to be dropped. However I'm still able to get to the web page from there:
I know the traffic is matching the "public" zone because removing the "http" and "https" services causes web traffic to stop and adding them back to the public zone restores service while making the same modifications on the "work" zone does nothing.
I'm sure it's a failure of my understanding but I can't spot it.
Still having this issue. If I remove the interface from
public and add it to
work it starts to work but that's likely because all
ens3 traffic will be going to that zone now. I did a
iptable -Z to zero out the packet counts and did verify that the chains associated with the
public zone are getting the packets.
Interestingly, if I do the
--add-source so that it adds the traffic to the
block zones it works how I would expect (traffic is dropped/rejected regardless of what services are configured on the
Here's the output from netstat on the server running the firewall:
[root@localhost ~]# netstat -rn Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 0.0.0.0 192.168.122.1 0.0.0.0 UG 0 0 0 ens3 192.168.122.0 0.0.0.0 255.255.255.0 U 0 0 0 ens3