On Debian 9, I installed
sudo firewall-cmd --get-active-zones shows no output. And
echo $? shows the exit status was 0 (
I have a network interface
eth0, which is shown by
ip link (as well as the loopback interface
I should say my firewall configuration appears to be mostly working. FWIW, I have changed the default zone from
MyZone, defined as follows:
$ sudo cat /etc/firewalld/zones/MyZone.xml <?xml version="1.0" encoding="utf-8"?> <zone> <short>My Zone</short> <service name="ssh"/> <service name="https"/> <!-- ... --> </zone>
If I try to connect using another computer, I am allowed to access the SSH and HTTPS services. And if I run
ncat -l -p 8000 on the server, and try to connect with
ncat my-server 8000, the connection is correctly blocked. (
Ncat: No route to host. And
tcpdump shows an ICMP unreachable reply is generated, type "admin prohibited").
firewall-cmd --get-active-zones not showing MyZone as active?
$ sudo firewall-cmd --state running $ sudo firewall-cmd --get-active-zones $ echo $? 0 $ sudo firewall-cmd --get-default-zone MyZone $ ip addr show dev eth0 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000 link/ether 00:50:43:01:c0:ab brd ff:ff:ff:ff:ff:ff inet 172.16.1.8/24 brd 172.16.1.255 scope global eth0 valid_lft forever preferred_lft forever inet6 fd5e:fcf3:b885:0:250:43ff:fe01:c0ab/64 scope global mngtmpaddr dynamic valid_lft forever preferred_lft forever inet6 fe80::250:43ff:fe01:c0ab/64 scope link valid_lft forever preferred_lft forever
firewalld.service does not log any warnings.
$ sudo systemctl status firewalld ● firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled) Active: active (running) since Wed 2019-01-30 13:17:31 GMT; 56min ago Docs: man:firewalld(1) Main PID: 509 (firewalld) Tasks: 2 (limit: 4915) CGroup: /system.slice/firewalld.service └─509 /usr/bin/python3 -Es /usr/sbin/firewalld --nofork --nopid Jan 30 13:17:21 brick systemd: Starting firewalld - dynamic firewall daemon... Jan 30 13:17:31 brick systemd: Started firewalld - dynamic firewall daemon.
I see that
firewalld prefers to be used with NetworkManager. I am not running NetworkManager at the moment, and it sounds like this is a bit fragile.
If NetworkManager is not used, there are some limitations... If firewalld gets started after the network is already up, the connections and manually created interfaces are not bound to a zone.
However, I have rebooted at least once since installing
firewalld. I checked the
firewalld.service is started
networking.service is started
After=network-pre.target. I have confirmed that
firewalld is started before
$ sudo journalctl -b -u networking -u firewalld -- Logs begin at Sat 2019-01-26 04:15:01 GMT, end at Wed 2019-01-30 14:15:33 GMT. -- Jan 30 13:17:21 brick systemd: Starting firewalld - dynamic firewall daemon... Jan 30 13:17:31 brick systemd: Started firewalld - dynamic firewall daemon. Jan 30 13:17:31 brick systemd: Starting Raise network interfaces... Jan 30 13:17:37 brick systemd: Started Raise network interfaces.
I have not manually restarted networking or run
ifup, and I am not running
ifplugd. The kernel logs (below) say that the ethernet link has been up, and IPv6 has been running, continuously since boot.
$ sudo dmesg|grep eth0 [ 4.082350] mv643xx_eth_port mv643xx_eth_port.0 eth0: port 0 with MAC address 00:50:43:01:c0:ab [ 47.577570] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready [ 49.981569] mv643xx_eth_port mv643xx_eth_port.0 eth0: link up, 1000 Mb/s, full duplex, flow control disabled [ 49.991543] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
I am not even using DHCP. The configuration for
auto eth0 iface eth0 inet static address 172.16.1.8 netmask 255.255.255.0 gateway 172.16.1.1 dns-nameservers 172.16.1.1