Questions tagged [firewalld]

Firewalld is a Fedora project that "provides a dynamically managed firewall with support for network/firewall zones to define the trust level of network connections or interfaces".

Filter by
Sorted by
Tagged with
0
votes
0answers
16 views

How to write a statement in firewalld?

I have selected "block" zone in firewalld. When I run sudo iptables -xnv -L the outout shows the Chain INPUT, FORWARD and OUTPUT have ACCEPT policy. When I open up the browser and navigate to a ...
0
votes
0answers
12 views

Centos7: Closed the port but it still shows as listening

I am using CentOS7. I have closed the port using the below command: firewall-cmd --zone=public --permanent --remove-port=9200/tcp firewall-cmd --reload While executing the command, it also gives ...
0
votes
1answer
16 views

firewalld redirect specific port from only specific source to remote ip and port

I am having a problem within allowing port redirect to another remote machine with another port, but in the same time the redirection is done based on specific source ip The situation is that i want ...
2
votes
1answer
42 views

How to isolate two subnets from each other but allow Internet access for each

I have a server running as a gateway with three interfaces on their own networks: enp1s0 - DHCP to Internet enp2s0 - 172.16.0.1/12 to work LAN enp3s0 - 10.0.0.1/8 for guest wireless I want both ...
0
votes
1answer
34 views

Using Whitelist of Mac address for Sftp login in Centos 7

i would like to configure firewalld in my server. Its possible to use iptables by whitelist the mac adresss.I want to do Sftp login by Mac address. So far ive search the internet but got no solution. ...
0
votes
0answers
22 views

How can I add a comment to a firewalld rich rule?

In iptables, I can add a comment or a note to a firewall rule using the built-in comment extension, which provides access to the --comment flag to iptables -I. I find this useful to record why a ...
4
votes
1answer
295 views

How to enable multiple services at once with firewalld module - Ansible

How to enable multiple services at once with firewalld module? I'm using this code which enables one service (https) after running ansible-playbook.It work just fine. However, I can't figure out how ...
0
votes
0answers
19 views

CentOS 8 FirewallD seems to be ignoring “source” rules

So I've been having trouble adjusting firewalld rules on CentOS 8. I have a server with three interfaces: ens3 (local network) ens9 (private network) ens10 (public network) I'm running openldap on ...
0
votes
1answer
33 views

Interface specific firewalld rules

I have Linux VM with multiple NICs configured, eth0 and eth1. Now I want SSH to be enabled on both the NICs and HTTPS only on eth0. I have made drop zone as default to drop all traffic other than it. ...
0
votes
0answers
89 views

Can't remove interface from zone with NetworkManager enabled. - Firewalld / Centos8

My issue is when I'm trying to remove interface from public (default) zone I get error: firewall-cmd --zone=public --remove-interface=eth0 --permanent The interface is under control of ...
0
votes
0answers
25 views

Allow connections only from certain IP addresses - FirewallD / Centos8

I have configurated Nginx load balancing server with two backend web servers (nginx). I'm trying to secure the two web servers with firewalld so they can be contacted/accessed only by load balancing ...
0
votes
1answer
67 views

Hole punching a VPN kill-switch

I use firewalld's direct rules to block all incoming and outgoing connections except for on a tun interface, making a kill switch for my VPN connections (similar to here). I have since whitelisted ...
0
votes
0answers
45 views

Firewalld - Whitelist IP/service, Drop Rest

Purpose : Initially I want some 4k+ IPs to access the server through SSH, HTTP ,HTTPS and FTP and block the remaining. I also may have to easily white list some IPs and services at later stage . I am ...
0
votes
0answers
44 views

Why can a port can be accessible from outside although it is not in firewall open ports on centos 7?

I have a remote vps working with centos 7, related firewalld info is as below, firewalld is running actively. [root@doer mydir]# firewall-cmd --get-zone-of-interface=eth0 no zone [root@ doer mydir]# ...
0
votes
1answer
193 views

Firewalld: How to drop everything but for an IP?

I'd like to understand FirewallD coming from Iptables. My zone is the default drop zonem without any service. drop (active) target: DROP icmp-block-inversion: no interfaces: enp9s0u2u1u2c2 ...
3
votes
1answer
1k views

CentOS 8 firewalld + nftables or just nftables

I've been on CentOS 7 for a long time and was used to building my custom iptables configurations on a variety of both personal and business boxes. I've recently started working with CentOS 8 and ...
0
votes
1answer
132 views

Samba only works when firewall is disabled

I have a Samba share on my Fedora Linux box. I was able to connect to it just fine when I was on Fedora 30, but after the upgrade to Fedora 31 it stopped working. Fedora 31 Samba version: 4.11....
0
votes
0answers
275 views

How do I use firewall-cmd to block all outbound connections but exclude an IP number and also allow all inbound connections?

I have 1 server using CentOS7: Local subnet: 192.168.10.10/24 => interface eth0 WAN subnet: 123.456.879/22 => interface eth1 I want to use firewall-cmd to block all outbound connections from ...
1
vote
0answers
16 views

firewall NAT failed while working on nearby equipment; bad cable, both nets up, but packets not passed; troubleshooting advice?

We're FINALLY replacing some older equipment and as a part of that work I pulled two very deep drawers holding equipment farther out than they'd been moved in many years. One of those drawers has a ...
0
votes
1answer
45 views

Routing over different subnets

I have two subnets S1 (10.3.0.0/24) and S2 (10.3.120.0/24) and two CentOS 7.6 machines A and B. Machine A two NICs, one for each subnet with ip addresses 10.3.0.4 on eth0 for S1 and 10.3.120.254 on ...
-1
votes
1answer
23 views

I have no firewall2 file

I have firewall2.d but no firewall2 file. I am trying to set up a lamp server but all the directions I get are for firewall2 "no d". I looked into firewall2.d but it doesn't have what they are ...
0
votes
0answers
15 views

Firewalld rules per user or users group

I would like to create a kind of a linux sandbox, where users can connect and run several programs remotely. The problem is that I don't know how can I forbid them making outgoing connections and ...
0
votes
0answers
26 views

Regarding Target in firewall-cmd

Can somebody to explain to me what is going wrong here? [root@lcl ~]# firewall-cmd --list-all public (active) target: %%REJECT%% icmp-block-inversion: no interfaces: enp6s0f1 sources: ...
2
votes
1answer
1k views

How to use POSTROUTING / SNAT with firewalld?

I try to set up SNAT with firewalld on my CentOS-7-Router like described here, with additions from Karl Rupps explanation, but I end up like Eric. I also read some other documentation, but I am not ...
0
votes
0answers
66 views

firewall-cmd - required to add a subnet to source?

I am prepping for the RHCSA and I am moving through some of the guided labs that are apart of the offical Red Hat training. One of the questions is having me perform the following: On serverb, ...
1
vote
0answers
27 views

Something is overwriting the ZONE setting in CentOS 7 network configuration files

I have multi-homed CentOS 7 servers, and I configure their NICs by editing the ifcfg-* files in /etc/sysconfig/network-scripts (automatically with Ansible). In particular, that's where I specify the ...
4
votes
1answer
424 views

Show list of open ports using firewalld in CentOS7

Is there an easy way to show a full list of all the ports that have been opened using firewalld? I know the command firewall-cmd --list-all, but that just shows service names, not the ports that ...
1
vote
1answer
457 views

CentOS 7 firewalld errors and warnings after default install

My VPS provided a minimal CentOS 7 install which did not come with firewalld pre-installed. This question is related to this question I installed it and had the following errors at startup: # ...
0
votes
0answers
21 views

br0 is under control of NetworkManager despite renderer: networkd

I recently switched from iptables-persistent to using firewalld on my Ubuntu-based router (desktop install, not server). The first and only time I used netplan is when I set this machine up initially ...
2
votes
1answer
42 views

What would be Firewalld equivalent of this command?

I installed IBSng on my server (Centos 7) and the install guide has been written in according to iptables. so I need equivalent of this command in firewalld please. Thanks a bunch iptables -t filter ...
0
votes
0answers
182 views

Local Chrony server and client not syncing

I'm trying to demonstrate a simple Linux local network with some most used services on it. I have two virtual machines (Fedora Server 30): A, B. I have configured A to act as a router in the network ...
-1
votes
1answer
163 views

Virtual network virbr0 cannot connect to internet anymore

I have VMs in virt-manager. Normally, they can connect to the internet. These VMs are connected to my default virtual network, device virbr0. To reach the internet, the virtual network is configured ...
0
votes
1answer
169 views

Route all traffic of external IP directly to KVM guest with systemd-networkd

I have a dedicated server running Debian Buster. I am connected through a single network interface and I orderd an extra IP from the server provider. I would like to setup a KVM guest which will be ...
1
vote
2answers
5k views

Wireguard not routing traffic from client to other servers on the network

I am having CentOS 7.6 version, and I installed test Wireguard VPN server. The whole installation and configuration is pretty easy, at least according to documentation, so what I did, I installed ...
1
vote
0answers
16 views

Restricting access to localhost with firewalld

I added direct rule to block localhost access to port 22 but it doesn't work. Basically chain OUTPUT looks like this: Chain OUTPUT (policy ACCEPT 3160 packets, 271K bytes) pkts bytes target prot ...
0
votes
0answers
25 views

How do I allow all machine from current network to access to fedora server?

I have a Fedora Desktop machine (192.168.16.109), on which I'm running VirtualBox which is running Fedora Server edition (192.168.16.112) for development purpose. There's bridged connected selected in ...
0
votes
0answers
200 views

firewall-cmd --direct --passthrough?

I added some rules to my firewall using firewall-cmd --direct and when I check them they are in my iptables (for example forward_direct chain) but they do not work the same as when I add them in my ...
2
votes
0answers
69 views

Difference between FORWARD and FORWARD_direct chain in filter table?

I needed to give ssh access to one of my virtual machines from internet. I added a NAT rule to my firewalld table but it does not work. firewall-cmd --add-rich-rule 'rule family="ipv4" destination ...
0
votes
1answer
1k views

Centos 7 port forwarding with firewalld not working

I can't seem to make firewalld-based port forwarding work under Centos 7. I am forwarding 192.168.0.148:905 to 192.168.56.102:22. When I try to ssh to 192.168.0.148 -p 905 I get "Connection refused"....
2
votes
2answers
93 views

How to enable firewalld without breaking application?

I have multiple CentOS 7 machines in the same LAN. Each one is communicating with a few others and having one or more applications installed that each listen on various ports (database, webserver, ...
1
vote
1answer
102 views

Ordering Cycle - FirewallD & DBusException

[SYSTEM] Virgin DigitalOcean droplet Ubuntu 18.04.2 LTS (GNU/Linux 4.15.0-52-generic x86_64) with all updates with latest Virtualmin and nothing else. How would you suggest I proceed with this? [...
2
votes
1answer
52 views

Stopping brute force attempts

"postfix/smtpd[28164]: warning: unknown[45.227.253.210]: SASL PLAIN authentication failed: authentication failure" Normally I'd use fail2ban however it seems that under the openvz container fail2ban ...
0
votes
1answer
378 views

Cant open a port on Debian

I'm have a Debian installation ~$ cat /etc/os-release PRETTY_NAME="Debian GNU/Linux 9 (stretch)" NAME="Debian GNU/Linux" VERSION_ID="9" VERSION="9 (stretch)" ID=debian HOME_URL="https://www.debian....
0
votes
0answers
144 views

Firewalld active with error reading a file

Today, checking the status of the firewalld, I see the following error: ● firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/usr/lib/systemd/system/firewalld.service; ...
0
votes
1answer
17 views

vnc dynamic runtime firewall ports >= 5901

In RHEL/Centos 7, TigerVNC-Server only needs 5901/tcp for desktop:1, then 5902/tcp for desktop:2, and so on. I think any VNC-server would operate the same way. If no one has typed vncerver for ...
3
votes
0answers
151 views

Ansible firewalld - guaranteed final state?

The ansible firewalld module is great for adding rules, but old rules are left in place. How can I achieve a guaranteed final state using the firewalld module? Specifically, I would like a role that ...
0
votes
1answer
61 views

Firewalld not printing active zones

On a vagrant Ubuntu 18.04.02 box: root@ubuntu-bionic:~# firewall-cmd --get-active-zones root@ubuntu-bionic:~# firewall-cmd --list-all public target: default icmp-block-inversion: no interfaces:...
0
votes
1answer
18 views

Does firewalld require system reboot for changes to become effective

On a vagrant Ubuntu 18.04.02 box root@ubuntu-bionic:~# ss -tulanp | grep -i 3306 root@ubuntu-bionic:~# docker run -d --rm -e "MYSQL_ROOT_PASSWORD=root" -p 3306:3306 -v mysql_volume:/var/lib/mysql --...
1
vote
1answer
2k views

Firewalld: block outgoing connections on specific port

I want to add a rule to firewalld in order to block any outgoing connections/traffic on port 9000 and leave the rest unchanged. How to to that with firewall-cmd command? Thanks.
1
vote
1answer
577 views

Port forward from external postgresql to localhost

I have several databases hosted outside the application server, ex: DB instances: 192.168.178.21:5432 192.168.178.22:5432 192.168.178.23:5432 app-server: 192.168.178.11 now I want to forward the ...