I'm building a firewall / gateway on a raspberry PI (Debian 9)
I'm using firewalld to create firewall rules.
So far, most sites and services are working fine. However there are a few sites that are not accessible, one example is Netflix. However, Facebook and Google work perfectly over HTTPS.
So I have 3 interfaces configured, lan0, ppp0, and vpn0
lan0 = Local lan interface 192.168.1.2/24
ppp0 = PPPoE connection to my internet provider
vpn0 = Openconnect connection to a work VPN
Starting off with an unconfigured firewall, these are the only commands I used to set things up:
firewall-cmd --zone=external --change-interface=ppp0
firewall-cmd --zone=external --change-interface=vpn0
firewall-cmd --zone=trusted --change-interface=lan0
firewall-cmd --zone=public --add-service=http
I then browse the internet from a local client (192.168.1.5) and most sites are working. But I'm having a problem with Netflix and Skype (so far).
Here is what happens when I used curl from the same client, it just hangs forever.
curl -v https://www.netflix.com
* Rebuilt URL to: https://www.netflix.com/
* Hostname was NOT found in DNS cache
* Trying 220.127.116.11...
* Connected to www.netflix.com (18.104.22.168) port 443 (#0)
* successfully set certificate verify locations:
* CAfile: none
* SSLv3, TLS unknown, Certificate Status (22):
* SSLv3, TLS handshake, Client hello (1):
The same command from the gateway works (RPI) just fine.
Looks like the client is stuck waiting for a server response? Did I miss something?