9

How to let the Firewall of RHEL7 the SNMP connection passing?

When I did this command on the computer:

systemctl stop firewalld

All the SNMP packet are passing well. When I restarted firewalld all the packet arre blocked. I tried several connfigruation with the firewall running of course, like:

iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 161 -j ACCEPT

or

firewall-cmd --zone=public --add-port=161/tcp --permanent

I've not get any error message but the SNMP still in TIMEOUT.

3 Answers 3

18

The correct way to do this is to add a profile for SNMP to firewalld. Using UDP 161 not TCP

vim /etc/firewalld/services/snmp.xml

<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>SNMP</short>
  <description>SNMP protocol</description>
  <port protocol="udp" port="161"/>
</service>

Then you should reload your firewall

firewall-cmd --reload

Then you need to add the service to your public zone

firewall-cmd --zone=public --add-service snmp --permanent

Then finally reload your firewall again

firewall-cmd --reload

4
  • The command firewall-cmd --zone=public --add-service SNMP --permanent gives Error: INVALID_SERVICE: SNMP
    – dubis
    Commented Jul 7, 2015 at 14:31
  • did you reload your firewall after adding the snmp.xml ?
    – squareborg
    Commented Jul 7, 2015 at 14:38
  • Sorry try snmp not SNMP, updated answer, copy paste fail.
    – squareborg
    Commented Jul 7, 2015 at 14:40
  • I restarted the procedure from the beguining and it's working thanks a lot
    – dubis
    Commented Jul 7, 2015 at 14:44
0

SNMP is udp vs tcp. Change your protocol in your rule and it should work.

2
  • I used this command changing tcp by udp but the port still closed ` snmpwalk -v2c -c public computer system` ===> Timeout: No Response from computer
    – dubis
    Commented Jul 7, 2015 at 14:34
  • Are you also blocking outbound traffic on udp 161? Keep in mind that UDP traffic is stateless and you have to have a specific rule for it.
    – Grim76
    Commented Jul 7, 2015 at 17:49
0

You need to open the 161/udp port (instead of tcp) :

firewall-cmd --zone=public --add-port=161/udp --permanent
firewall-cmd --reload

Or use these commands to create a new SNMP service (adapted from Documentation - HowTo - Add a Service | firewalld) :

firewall-cmd --permanent --new-service=snmp
firewall-cmd --permanent --service=snmp --set-description="SNMP protocol"
firewall-cmd --permanent --service=snmp --set-short=SNMP
firewall-cmd --permanent --service=snmp --add-port=161/udp
firewall-cmd --permanent --service=snmp --add-protocol=udp

and then use your brand new SNMP service :

firewall-cmd --zone=public --add-service snmp --permanent
firewall-cmd --reload

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .