Forward Traffic Between Two Firewalld Interfaces In The Same Zone

Question

I have four interfaces in my CentOS 7.3.1611 system in three zones:

# firewall-cmd --get-active-zones
dmz
  interfaces: ens192
internal
  interfaces: ens256 ens161
external
  interfaces: ens224

I want systems on the two internal zones to be able to talk to each other.

I've tried adding bidirectional direct rules:

# firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -o ens256 -i ens161 -j ACCEPT
# firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i ens256 -o ens161 -j ACCEPT

...since this is how I permitted one of the internal networks to talk to the dmz network, but A) this doesn't seem to work in the intra-zone case; and B) since this command doesn't accept the --permanent flag I have my doubts that such a command will survive a reboot.

The two internal interfaces can speak to the external (internet) zone properly.

How do I permit traffic between two interfaces in the same zone to flow?

Answer 1

found your question doing a google search about similar multi-interface firewall topics for firewalld. We're about a year later, and your question remains unanswered, and I am wondering if the problem you have with --permanent is related to order of arguments.

In version 0.4.4.4 on Enterprise Linux 7.5, the man page on firewall-cmd clearly shows that you need to have --permanent before --direct. This is likely because any arguments after --direct are sub-arguments to direct, not the firewall-cmd. So run your command like so:

# firewall-cmd --permanent --direct --add-rule ipv4 filter FORWARD 0 -o ens256 -i ens161 -j ACCEPT

On your problem with the two Internal Interfaces... For one thing, you need to take a look at the output of # iptables -L and map out how your chains flow. The command you've put up there inserts a rule into the forward chain at the top of the chain, with priority 0. My guess is there's another chain with higher priority like "FORWARD_IN_ZONES" that ends up dropping your packets.

Also, in recent versions of firewalld you can run # firewall-cmd --set-log-denied=all in order to see info on dropped packets. The logs should include the chain name that's creating the drop.

Answer 2

For firewalld with nftables, a new flag --add-forward is merged two days ago [1] to allow forwarding between interfaces in a zone. It can be configured like

# firewall-cmd --zone=internal --add-forward

UPDATE 2020/09/03: a new release 0.9.0 includes that feature \o/

[1] https://github.com/firewalld/firewalld/pull/613