4

On Centos 7 I want Docker containers to be able to reach the host so I tried to add docker0 to trusted zone:

# firewall-cmd --permanent --zone=trusted --add-interface=docker0
The interface is under control of NetworkManager and already bound to 'trusted'
The interface is under control of NetworkManager, setting zone to 'trusted'.
success
# firewall-cmd --get-zone-of-interface=docker0
no zone

This used to work but not on this server for whatever reason. I also tried firewall-cmd --reload, nothing. As if firewalld commands are completely ignored. That NetworkManager message seems suspicious, is it possible that firewalld and NetworkManager are in some kind of conflict?

Out of desperation I also tried: nmcli connection modify docker0 connection.zone trusted which correctly set the ZONE=trusted in the interface config but firewalld still shows that interface is not in the trusted zone.

What is going on here?

Improve this question

2 Answers 2

Reset to default
5

From what I can tell unless there's an interface using the trusted zone that's directly recognized by firewalld (i.e. eth0) the trusted zone isn't marked as active. In order to get around this, you can explicitly set the iptables rule with the following:

firewall-cmd --permanent --zone=trusted --add-interface=docker0
firewall-cmd --direct --permanent --add-rule ipv4 filter INPUT 3 -i docker0 -j ACCEPT
firewall-cmd --reload
systemctl restart docker

The '3' here is where in your INPUT chain the rule will be inserted, your mileage may vary. After running those commands I was able to access host ports from a container.

Improve this answer
1
  • Three weeks later, after running the first command the docker0 interface magically appeared in the trusted zone. Perhaps something was messed up and a reboot solved the problem. The direct rule should be helpful though.
    – cen
    Dec 29, 2016 at 16:02
1

You should add the port or the service to the trusted zone and reload the firewall configuration.

There is an example:

To allow the 443/tcp port temporarily in the internal zone, type:

systemctl start firewalld
systemctl enable firewalld
firewall-cmd --zone=trusted --add-port=443/tcp
firewall-cmd --reload

Check it:

firewall-cmd --get-active-zones

Allowing the port permenant with:

firewall-cmd --permanent --zone=trusted --add-port=443/tcp

Also the following command should return :

firewall-cmd --get-zone-of-interface=docker0
trusted
Improve this answer
4
  • firewall-cmd --get-active-zones returns public zone only.
    – cen
    Dec 20, 2016 at 14:16
  • run firewall-cmd --set-default-zone=trusted
    – GAD3R
    Dec 20, 2016 at 14:57
  • 1
    Won't changing the default zone generally cause a lot of problems? To my understanding, simply pushing an interface to the trusted zone would cause the trusted zone to become active. Which is exactly my problem, because adding the interface does not do anything.
    – cen
    Dec 20, 2016 at 15:06
  • 1
    For example in this tutorial digitalocean.com/community/tutorials/… he changes the eth0 interface to home zone and suddenly home becomes active. I still think that NetworkManager output which I see when adding an interface is the culprit.
    – cen
    Dec 20, 2016 at 15:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.