2

Trying to self-train on firewalld I set up apache and configured the zones as follows:

[root@localhost ~]# firewall-cmd --get-active-zones
work
  sources: 192.168.122.1
public
  interfaces: ens3
[root@localhost ~]# firewall-cmd --zone=work --list-all
work
  interfaces:
  sources: 192.168.122.1
  services: dhcpv6-client ipp-client ssh
  ports:
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules:

[root@localhost ~]# firewall-cmd --zone=public --list-all
public (default, active)
  interfaces: ens3
  sources:
  services: dhcpv6-client http https ssh
  ports:
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules:

My expected result is that traffic from the hypervisor would match the "work" zone and since http isn't allowed for that zone for it to be dropped. However I'm still able to get to the web page from there:

enter image description here

I know the traffic is matching the "public" zone because removing the "http" and "https" services causes web traffic to stop and adding them back to the public zone restores service while making the same modifications on the "work" zone does nothing.

I'm sure it's a failure of my understanding but I can't spot it.

Update

Still having this issue. If I remove the interface from public and add it to work it starts to work but that's likely because all ens3 traffic will be going to that zone now. I did a iptable -Z to zero out the packet counts and did verify that the chains associated with the public zone are getting the packets.

Interestingly, if I do the --add-source so that it adds the traffic to the drop or block zones it works how I would expect (traffic is dropped/rejected regardless of what services are configured on the public zone).

Here's the output from netstat on the server running the firewall:

[root@localhost ~]# netstat -rn
Kernel IP routing table
Destination     Gateway         Genmask        Flags   MSS Window   irtt Iface
0.0.0.0         192.168.122.1   0.0.0.0        UG        0 0           0 ens3
192.168.122.0   0.0.0.0         255.255.255.0  U         0 0           0 ens3
  • iptables -L -v may give you an insight to what's happening. – garethTheRed Mar 6 '15 at 6:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.