1

I'd like to understand FirewallD coming from Iptables.

My zone is the default drop zonem without any service.

drop (active)
  target: DROP
  icmp-block-inversion: no
  interfaces: enp9s0u2u1u2c2
  sources:
  services: 
  ports: 
  protocols: 
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 

What's the point to add a source ip to this zone?

  1. I added all the local IPs firewall-cmd --add-source=192.168.0.0/16
  2. It still drops all the packets even coming from one of this source IP.

    • Adding a service to this zone will allow anybody to access this service whatever source IPs I set.

    • How to restrict the service and allow only a single IP (or range) to the service?

The behavior of firewalld isn't very clear at all compare to iptables. There are so many assumptions and unknown default behaviors.

1
  1. I added all the local IPs firewall-cmd --add-source=192.168.0.0/16

  2. It still drops all the packets even coming from one of this source IP.

From FirewallD documentation:

Binding a source to a zone means that this zone settings will be used to restrict traffic from this source.

So, you told FirewallD that the drop zone will now apply specifically to traffic coming from 192.168.0.0/16 and to nothing else. I'm not sure what will happen to any traffic coming from outside that IP range. (Modifying the default drop zone like that may not be a great idea.)

Adding a service to a zone normally means that the specified service is always allowed for any interface configured to that zone, for any source IP address. If a zone has no services enabled, it will disallow all traffic. I don't have tried adding source IP addresses to a zone, so I have no clue how the normal behavior interacts with that.

To achieve what you want, you probably should create a new zone, and add a rich rule for the service you want:

firewall-cmd --permanent --new-zone="allow-limited-<service>"
firewall-cmd --permanent --zone="allow-limited-<service>" --add-rich-rule="rule source address=192.168.0.0/16 service name=<service> accept" 

Now if you assign a network interface to this zone allow-limited-<service>, it will allow only the service <service> (which may include one or more TCP and/or UDP ports) from 192.168.0.0/16, and block everything else.

A zone is effectively a pre-defined set of firewall rules you can easily apply to any specific network interface. A network interface can be assigned to only one zone at a time.

The FirewallD logic seems to be tailored for enterprise/ISP/hosting provider use, where there may be separate VLAN interfaces and the IP address allocation might change drastically if the enterprise gets a new block of IPs from a very different range than the previous ones. In such an environment, you might tie the firewall rules to (VLAN or physical) interfaces according to their purpose, not as much to IP addresses.

1
  • In that case, I'm just gonna disable firewalld and keep using my iptables service. Using rich rule adds more complexity than just using iptables.That's pretty basic to block everything but IPs for a specific service. I wonder who need to change often rules for interface. Thanks.
    – Alexis
    Dec 9 '19 at 10:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.