Questions tagged [firewalld]

Firewalld is a Fedora project that "provides a dynamically managed firewall with support for network/firewall zones to define the trust level of network connections or interfaces".

2
votes
2answers
21 views

How to enable firewalld without breaking application?

I have multiple CentOS 7 machines in the same LAN. Each one is communicating with a few others and having one or more applications installed that each listen on various ports (database, webserver, ...
1
vote
1answer
10 views

Ordering Cycle - FirewallD & DBusException

[SYSTEM] Virgin DigitalOcean droplet Ubuntu 18.04.2 LTS (GNU/Linux 4.15.0-52-generic x86_64) with all updates with latest Virtualmin and nothing else. How would you suggest I proceed with this? [...
2
votes
1answer
29 views

Stopping brute force attempts

"postfix/smtpd[28164]: warning: unknown[45.227.253.210]: SASL PLAIN authentication failed: authentication failure" Normally I'd use fail2ban however it seems that under the openvz container fail2ban ...
0
votes
1answer
22 views

Cant open a port on Debian

I'm have a Debian installation ~$ cat /etc/os-release PRETTY_NAME="Debian GNU/Linux 9 (stretch)" NAME="Debian GNU/Linux" VERSION_ID="9" VERSION="9 (stretch)" ID=debian HOME_URL="https://www.debian....
0
votes
0answers
21 views

Firewalld active with error reading a file

Today, checking the status of the firewalld, I see the following error: ● firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/usr/lib/systemd/system/firewalld.service; ...
0
votes
1answer
8 views

vnc dynamic runtime firewall ports >= 5901

In RHEL/Centos 7, TigerVNC-Server only needs 5901/tcp for desktop:1, then 5902/tcp for desktop:2, and so on. I think any VNC-server would operate the same way. If no one has typed vncerver for ...
2
votes
0answers
36 views

Ansible firewalld - guaranteed final state?

The ansible firewalld module is great for adding rules, but old rules are left in place. How can I achieve a guaranteed final state using the firewalld module? Specifically, I would like a role that ...
0
votes
1answer
11 views

Firewalld not printing active zones

On a vagrant Ubuntu 18.04.02 box: root@ubuntu-bionic:~# firewall-cmd --get-active-zones root@ubuntu-bionic:~# firewall-cmd --list-all public target: default icmp-block-inversion: no interfaces:...
0
votes
1answer
15 views

Does firewalld require system reboot for changes to become effective

On a vagrant Ubuntu 18.04.02 box root@ubuntu-bionic:~# ss -tulanp | grep -i 3306 root@ubuntu-bionic:~# docker run -d --rm -e "MYSQL_ROOT_PASSWORD=root" -p 3306:3306 -v mysql_volume:/var/lib/mysql --...
0
votes
1answer
189 views

Firewalld: block outgoing connections on specific port

I want to add a rule to firewalld in order to block any outgoing connections/traffic on port 9000 and leave the rest unchanged. How to to that with firewall-cmd command? Thanks.
0
votes
0answers
85 views

How to migrate iptables rules to firewalld?

I need to migrate this iptables rules to firewalld but I don't know how to do it. The rules to migrate are: *nat :PREROUTING ACCEPT [5322227:529801781] :POSTROUTING ACCEPT [848032:...
0
votes
1answer
170 views

Port forward from external postgresql to localhost

I have several databases hosted outside the application server, ex: DB instances: 192.168.178.21:5432 192.168.178.22:5432 192.168.178.23:5432 app-server: 192.168.178.11 now I want to forward the ...
0
votes
0answers
34 views

Does the `drop` zone (and the `block` zone) allow all ICMP packets?

$ rpm -q firewalld firewalld-0.6.3-1.fc29.noarch $ cd /usr/lib/firewalld/zones/ $ cat drop.xml <?xml version="1.0" encoding="utf-8"?> <zone target="DROP"> <short>Drop</short> ...
0
votes
1answer
36 views

Using firewalld on a gateway certain websites are not accessible over HTTPS

I'm building a firewall / gateway on a raspberry PI (Debian 9) I'm using firewalld to create firewall rules. So far, most sites and services are working fine. However there are a few sites that are ...
1
vote
2answers
276 views

firewall-cmd says no firewall zones are active. Why?

On Debian 9, I installed firewalld (version 0.4.4.2-1). sudo firewall-cmd --get-active-zones shows no output. And echo $? shows the exit status was 0 (EXIT_SUCCESS). Why? I have a network ...
0
votes
1answer
310 views

Ports not really open after firewalld command

OS: CentOS 7 This is a question that is bordering on two issues. I have a docker machine running where I recently installed the PLEX container from linuxserver/plex. The current problem is that I ...
2
votes
1answer
278 views

firewalld to allow routing without NAT between NICs

As a network adminstrator, I often have to set up network gear for remote sites before shipping it. I have found it convenient to use a linux workstation with two network cards, setting the secondary ...
2
votes
1answer
131 views

What does ebtables.service do?

On Fedora, the firewalld package requires ebtables. Installing firewalld on Debian also installs ebtables by default, although it is a recommendation and not a hard requirement. Fedora does not ...
0
votes
1answer
49 views

I can't see the iptables rules where firewalld enables helpers. Why? Have the helpers been disabled somehow?

Here is an example of the ftp helper added by enabling the ftp service in the public zone: # iptables -t raw -S | grep CT -A PRE_public_allow -p tcp -m tcp --dport 21 -j CT --helper ftp https://...
0
votes
0answers
18 views

Is it possible to disable a “helper” in firewalld?

Is it possible to disable a "helper" in firewalld? Background information: the "helpers" are the conntrack modules which parse an individual application protocol. The classic example is for FTP, ...
0
votes
2answers
25 views

Tighten existing firewalld rules

I have a current ruleset: net1 (active) target: default icmp-block-inversion: no interfaces: ens192 sources: services: http https smtp smtp-submission pop3 pop3s imap imaps ssh ports: ...
-1
votes
1answer
17 views

How to open some port for only OpenVNP clients?

I have a web service on an external server, and an openvpn server on the same machine. I need to open port 80, but only for openvpn clients. In other words, if I do nmap-p 80 server_ip I expect to ...
0
votes
1answer
61 views

Firewalld %%REJECT%%

I'm trying to configure firewalld (v0.4.4.2) on Debian 9 to REJECT invalid requests originating from an internal network. However, if I set the default target of the zone in question to REJECT, the ...
0
votes
1answer
45 views

How do I get a list of the ports which belong to preconfigured firewall-cmd services?

I want to open the following ports in my CentOS 7 firewall: UDP 137 (NetBIOS Name Service) UDP 138 (NetBIOS Datagram Service) TCP 139 (NetBIOS Session Service) TCP 445 (SMB) I can guess that the ...
-2
votes
1answer
265 views

How to block a program from accessing the Internet on Centos [closed]

I want to block a program from using internet. I don't want this program to use internet. How can I do that.
0
votes
1answer
93 views

Allow NetBIOS lookup with firewalld

I just upgraded OpenSUSE from Leap 42.3 to Leap 15.0, and with this upgrade, OpenSUSE moved its default firewall application from SuSEfirewall2 to Firewalld. I opted not to use the susefirewall2-to-...
0
votes
0answers
69 views

Performance of active port - netstat

Below command [root@machine1 output]# netstat -s --udp IcmpMsg: InType0: 371137 InType3: 296 InType8: 386843 InType11: 4 InType13: 141 InType15:...
0
votes
1answer
204 views

Firewalld and iptables priority

Simple question: What is the priority if we have both firewalld and iptables in use? Which takes the priority in the rules. For example, if I block ICMP with firewalld and with iptables I accept it, ...
0
votes
1answer
79 views

firewall-cmd do you have to add port when adding a service?

Will adding a service with firewall-cmd automatically adds the port that a service needs? for example, when I add myservice, do I need to specify a port also? What is the purpose of --add-service if ...
2
votes
1answer
77 views

Source-MAC Filter iptables

I have a HAProxy box with centos7 and doing load balance proxy for a smtp cluster providing mail relay to our customers. default gateway => 10.0.0.1 master-relay.example.net => 10.0.0.254 ...
1
vote
0answers
124 views

How to make ssh port 22 not visible (using firewalld)

I have a virtual machine out on the Internet running Fedora 27 and it gets pounded regularly on port 22 with bots attempting to log in. I have disabled root logins to my machine but I'm tired of my ...
0
votes
1answer
86 views

Name or service not known in DHCP subnet [closed]

I'm trying to setup proper ip forwarding within a DHCP subnet generated through a host with two different netowrk adapters. My current situation is the following: First node with two networks ...
1
vote
1answer
346 views

How can I configure firewalld to share a single interface with multiple zones?

CentOS 7 I have two zones (home and public). I'd like to allow SSH from my home but not from public. [root@foobox ~]# firewall-cmd --list-all --zone=home home (active) target: default icmp-...
1
vote
2answers
173 views

Use the LANs of one server to access the LAN of another

I'm a bit lost here, so I'm asking for your help. =D I have three servers: 1# - LANs A and B 2# - LANs B and C 3# - LANs C and D How can I make server 1# access through LAN B an ip that is in LAN D ...
1
vote
0answers
26 views

restrict one port to a subnet but allow all others

I'm using Firewalld. In general I'd like to leave the computer open for the other services I use, but I've one web server that I'd like to restrict to a subnet. I can find plenty on opening one port ...
0
votes
2answers
49 views

Using FirewallD as SOCKS server

On CentOS 7, can the FirewallD service be used as a SOCKS server? i.e. if I connect ISP line to server's port #1 and LAN to port #2? Using Squid allows LAN clients to browse only, but other things ...
2
votes
1answer
4k views

Firewalld - restrict traffic to specific IPs

I'm trying to setup firewalld to restrict access to the CentOS7 server to specific IPs (192.168.10.5 and 167.165.100.22) both for incoming and outgoing traffic. I have only one network interface, ...
1
vote
3answers
194 views

How to schedule activation/termination of KVM/QEMU virtual mahines?

I run an IPv4 server in a Fedora virtual machine. This server hosts a git service for a group of developers and is open to the internet. As a consequence, it is confronted to hacking attempts (mainly ...
1
vote
0answers
30 views

How to forward traffic comming to NON listening port to another listening port using firewalld?

I have server which does NOT listen on port 514. I need forwarding in this way: request to public_IP:514 ---> redirect to --> localhost:5514 How can I do it using firewalld?
0
votes
1answer
580 views

change source address of outgoing traffic on specific ports

I would like to be able to change the source address of all traffic that is going outbound from my linux server on ports 53 (DNS), 67 & 68 (DHCP) I tried with iptables/firewalld: firewall-cmd --...
0
votes
2answers
556 views

FirewallD Drops Docker Packets

[SOLVED] -- See update below. I installed outline-server (link) on my server and unfortunately FirewallD drops all packets coming from outline-client. My System: Ubuntu 18.04 x64 Linux x 4.15.0-20-...
3
votes
1answer
824 views

Which ports does the default firewall allow on Fedora Workstation and Fedora Server?

What incoming TCP and UDP connections are permitted, by the default firewall policy of Fedora Workstation, and Fedora Server? I am interested in the current version, Fedora 28.
0
votes
0answers
410 views

Why systemctl reload firewalld on centos7 is not working?

Running the following commands on CentOS7 #systemctl start firewalld #systemctl enable firewalld #systemctl reload firewalld #systemctl status firewalld gives output as follows: ...Active:inactive(...
3
votes
1answer
1k views

How can i allow traffic coming at specific Port in IPtables Rules

I have centos7 running in 2 VM's. firewall is running on both VM machines. Suppose some application is running on machine A which is using 5044 port. and i have another machine called machine B who ...
1
vote
0answers
39 views

Get notified if a specific port accessed? or on outgoing connections?

i am using centos minimal install. Is it possible to get a desktop message on a specific firewall rule ? For example: Get desktop message if a specific port accessed or if a new outgoing connection ...
0
votes
1answer
2k views

Firewalld — interface not adding to zone

I have a peervpn interface "tap0" which I am wanting to accept all traffic from. Box is CentOS 7. My understanding is that I just need to add the interface to the "Trusted" zone. When I try this ...
0
votes
1answer
2k views

URL Filtering with IP tables

I've been trying to set up URL filtering with Iptables. I have set up two interfaces. Traffic flows in from one interface and flows out from the other. Below are the Iptables I have configured: *...
0
votes
0answers
100 views

firewalld still having trouble with stops and starts

My previous adventures with firewalld: CentOS 7: Firewalld ignores its configuration files firewalld zone settings don't survive a reboot Well, firewalld is still being weird across stops and starts....
1
vote
1answer
1k views

Linux ports are blocked even when firewalld is disabled!

RHEL 7.4 I disabled the firewalld and also checked that SELINUX is disabled. But still when I use telnet to check the ports, port 3307 refused the connection. Even port 80 rejects the connection. ...
0
votes
1answer
732 views

firewalld failed to apply rules / set_rule() failure when --reload

I have been using firewalld without any problems for about a year now. Recently I added a new zone docker, to which I added the virual docker0 interface, and added services to that zone, and that zone ...