Skip to main content

Questions tagged [firewalld]

Firewalld is a Fedora project that "provides a dynamically managed firewall with support for network/firewall zones to define the trust level of network connections or interfaces".

Filter by
Sorted by
Tagged with
0 votes
1 answer
7 views

Determining the performance Impact of firewalld rule count

I was working on tweaking the performance of fail2ban and I read that a too-long ban can result in a build-up of rules that will negatively impact performance, which made me wonder, "Is there any ...
jhilgeman's user avatar
  • 101
0 votes
0 answers
31 views

How to Log Each Outbound TCP Connection

At my company we have a set of 3 identical VMs. These VMs house an app that "sends messages". The app sends each message by making a TCP connection out to one of two fixed IP addresses (...
godot's user avatar
  • 1
0 votes
0 answers
21 views

Using Linux server as a gateway for specific addresses in internal network

I have a RHEL 9 server which has IP addresses as 172.10.0.10 and 172.30.1.10, which is connected to two separate switches with two separate network interfaces. This server runs a virtual machine, ...
discouragedone's user avatar
0 votes
0 answers
18 views

Firewalld default fallback behavior

RHEL9 with firewalld 1.2.1 and nftables 1.0.4. I am trying to understand the default behavior. Source 10.0.0.0/24 is in custom zone. Target default. Service ssh and port 5000 is set here. Interface ...
cde's user avatar
  • 449
0 votes
0 answers
12 views

firewalld different rules for different interfaces

running RHEL 8.9, with firewalld is there a way to have a specific /etc/firewalld/zones/mycustom.rules file for different network interfaces? For example, I have a quad-port nic in a server, doing ...
ron's user avatar
  • 7,264
0 votes
0 answers
43 views

Firewalld (nftables) SNAT problem

so my setup is following: A: PrivIP: 172.16.1.1 PublicIP: 212.1.2.3 B: PrivIP: 10.123.0.1 (Interface: dummyip, dont ask why I named it like that) PublicIP: 213.1.2.3 (Interface: eth0) They both are ...
TwoSoulz's user avatar
0 votes
1 answer
49 views

What can cause network drop when running a VM with virt-manager?

I'm new to virt-manager, qemu and libvirt so I barely know how to use them. I use virt-manager's GUI to make it easier for me to do a transition from VirtualBox (including VBoxManage) to KVM. By far I ...
NewbieDeveloper's user avatar
1 vote
0 answers
52 views

firewalld inconsistent behaviour

I have a docker swarm with a number of nodes. They are connected through wireguard interfaces. All docker swarm communication happens inside the internal network, provided by wireguard. In the example ...
nagylzs's user avatar
  • 111
0 votes
0 answers
27 views

Firewalld is running, I can acccess unallowed kubernetes exposed port?

I have a Kubeadm based Kubernetes cluster. Firewalld is running on all nodes on the cluster. I expose a nginx service via NodePort service, that on theory should be accessible via all nodes on the ...
teoman's user avatar
  • 101
0 votes
0 answers
51 views

Kafka with KRaft - what is listening on the random high port?

I'm in the process of writing some ansible to install Kafka on RHEL and I've got the service running and am about to configure the firewall to make the service accessible on the network. When I look ...
azzid's user avatar
  • 1,000
0 votes
0 answers
102 views

Fail2ban firewall-cmd ipset not blocking

Fail2ban has accumulated quite the list of ip's to block: # fail2ban-client banned [{'sshd': ['101.126.34.231', '106.58.179.182', '117.50.187.153', '119.91.54.127', '121.250.190.129', '124.220.15.172',...
azzid's user avatar
  • 1,000
0 votes
0 answers
41 views

Firewalld access from OpenVPN to ftp server

On my router I opened port 21 to FTP and server(Alma Linux 9)works on my public adress IP. In firewalld I set below rule where access has my public IP and it works. sudo firewall-cmd \ --...
ldybiec's user avatar
0 votes
0 answers
226 views

chrony port 323 automatically open with firewalld?

Documentation states chrony uses port 323udp by default, versus port 123udp that old NTP used. But where is port 323 defined, because I do not see it in the default /etc/chrony.conf as it comes in a ...
ron's user avatar
  • 7,264
0 votes
0 answers
321 views

firewalld and NAT

So i have been given a task to get to know firewalld and linux networking in general. This is my test setup: Router and Client are running Debian 12, Laptop Ubuntu 22.04. This setup should accomplish ...
Niko's user avatar
  • 1
0 votes
0 answers
42 views

I want to allow incoming traffic on a specific port like ssh and block all outgoing traffic in firewalld

I'm using Firewalld, I want to block all the outgoing traffic. And allow all incoming traffic or SSH connection for specific IPs. I'm able to block all the outbound traffic and it is working by ...
Tech_div's user avatar
0 votes
0 answers
44 views

New error nessage "Can't use lokkit options with other options." from firewall-offline-cmd

A few months ago I wrote a script that helps configuring the firewall in SLES15. However when I ran the script today, I saw a new confusing error message like this: + firewall-offline-cmd --zone=...
U. Windl's user avatar
  • 1,493
0 votes
2 answers
341 views

Why can I run a playbook successfully as root but NOT as the user who owns the playbook?

I am trying to run a playbook and part of the playbooks job is to add a firewall port. What is the best way to do this? I get this error with the lineinfile module: - name: Ensure specific port ...
jspaine's user avatar
  • 21
0 votes
0 answers
111 views

how do I properly isolate the containers with firewalld with iptables=false?

I do not want the docker modify my iptables/nftables on fly so I decided to use iptables=false. I then follow the suggestion here to enable the outbound internet connection inside the containers. ...
Wang's user avatar
  • 1,336
0 votes
1 answer
3k views

Using Zones in Firewalld to Block Outbound Access

I want to provide limited access to a machine which runs CentOS Linux release 7.9.2009. For this purpose, I changed the default zone to a new zone called custom and applied a configuration as follows: ...
yildizabdullah's user avatar
1 vote
1 answer
634 views

How to list the connections of the port forwarded by firewalld?

I have forwarded a port using firewalld, and everything is functioning properly. However, the 'netstat' and 'ss' commands do not display the port opened by firewalld, nor do they show the connections. ...
Blake Candy's user avatar
0 votes
0 answers
437 views

Fixing DBus after changing /home /lib and /root permissions

Firstly, I know, it was dumb, but now it's done and don't need to say "why did you do that" etc... So, I'm using Almalinux 9 and I changed permissions of /home /lib and /root. Now, firewalld ...
Moréo's user avatar
  • 1
0 votes
1 answer
93 views

Firewall : firewalld with docker open port for local service

I'm trying to open port for ssh on non-standard port like 12452, i used these commands and non of them worked iptables -I INPUT -p tcp --dport 12452 -j ACCEPT iptables -I OUTPUT -p tcp --dport 12452 -...
Ebrahim Karimi's user avatar
2 votes
0 answers
1k views

Podman: automatic network rules and iptables

When I run podman container and share port 4444 as following example: podman run -dit --name test -p 4444:4444 alpine It creates following iptable Chain INPUT (policy ACCEPT) target prot opt ...
Rafal Niznik's user avatar
2 votes
1 answer
88 views

Firewalld with variable source

I'm writing a script and I'm stuck. I have a url (https://file.test.com/tips) that contains a file with the list of network subnets. File content: {192.168.1.0/24,10.0.0.0/24,2001:aaaa:bbbb:cccc::/64} ...
IgorK's user avatar
  • 135
0 votes
1 answer
128 views

firewalld configuration will not allow http/https traffic

There is a hardware firewall in place, but I want to also product the system at the os level. $ sudo firewall-cmd --list-all-zones block target: %%REJECT%% icmp-block-inversion: no interfaces: ...
TexasTim's user avatar
4 votes
1 answer
1k views

Is there a way to check the ports that are open in firewalld without sudo?

I noticed that even checking the status of firewalld seems to require sudo. I want to keep the privileges of this script as low as possible and, for that reason, I would like the user to be able to ...
Grant Curell's user avatar
1 vote
1 answer
559 views

blocking telnet service using firewalld

my zone in firewalld in public and the list is like below. firewall-cmd --list-all public (active) target: default icmp-block-inversion: no interfaces: enp0s3 enp0s8 sources: services: ...
Emad Khavaninzadeh's user avatar
5 votes
0 answers
2k views

Ubuntu 22.04 firewalld initiation problem: no python-nftables

I tried to use firewalld instead of ufw, but it keeps showing the following errors even after manually downloading python-nftables through sudo apt install iptables is not being used. $ systemctl ...
Nimbus's user avatar
  • 51
0 votes
2 answers
571 views

How does firewalld handle packet state internally when you add rules?

Coming from an iptables background, I can specify packet connection states (usually either NEW and/or ESTABLISHED) when defining new firewall rules. For example, this pair of rules will ensure that ...
huthut28's user avatar
1 vote
0 answers
197 views

How to firewall a network namespace using firewalld?

I'm running fedora 36 using firewalld as my firewall. I set up a network namespace called "wireguard". It contains the interface wg0 which connects to Mullvad VPN. I set it up like this: ip ...
minamikoarikui's user avatar
0 votes
1 answer
98 views

How to block connection from eth1 through firewall daemon?

I have Debian 11 using the new Firewall Daemon, and I have a device connected to eth1. I want to block all connections from internet or any IP other than the local IP in the range 10.147.20.0/24. Is ...
Dr.Sherif Omran's user avatar
2 votes
1 answer
865 views

How to configure Firewalld to block incoming traffic on loopback interface?

I have firewalld enabled and configured as below: loopback (active) target: DROP icmp-block-inversion: no interfaces: lo sources: services: ports: protocols: forward: no ...
x300n's user avatar
  • 155
0 votes
1 answer
274 views

does NFS proto=rdma bypass firewalld?

in /etc/firewalld/zone/mycustomzone.xml I use the syntax of <port protocol="tcp" port="2049"/> to open port number being a protocol choice of either tcp or udp. For NFSv4 ...
ron's user avatar
  • 7,264
0 votes
1 answer
495 views

Ansible: Firewalld how to set multiple services (loop from another playbook)

I see the issue when I try to set multiple services to the zone. Only first one is set and another always comes with the following error: TASK [Set services] ******************************************...
Rafal Niznik's user avatar
0 votes
0 answers
457 views

OpenVPN traffic being blocked by firewalld on CentOS from reaching lan

I have OpenVPN setup on a CentOS box. Clients can connect to the vpn just fine and access its resources, ping the server's lan address. However i wanted OpenVPN clients to be able to access a computer ...
James's user avatar
  • 1
0 votes
1 answer
528 views

Configuring a firewalld killswitch

I want to configure a firewalld killswitch on my computer but don't know how to go about it. I want to block all incoming traffic. The outgoing traffic should only be allowed on a specific IP address, ...
user avatar
1 vote
0 answers
586 views

How do i express this nftables command using firewalld rich rules, direct or policy method?

I had issues with access to a service listening on the interface lxcxxx (172.XX). this because requests are arriving through eth0, and firewalld was blocking the forwarding on the FWD filter [30772....
mike-m's user avatar
  • 545
0 votes
0 answers
75 views

How to forward the Internet through the OPENVPN client?

There is an Openvpn server and two clients How will all traffic for client 1 be routed through client 2? Server tun0 10.8.0.1 client 1 tun0 10.8.0.2 client 2 tun0 10.8.0.3 я хочу чтобы весь ...
sasha-ld's user avatar
0 votes
1 answer
207 views

Active Directory & firewall-cmd

I'm using a RHEL based VM as a router and I'm trying to get AD running on the network but I'm not being successful at it. When I set up the interfaces on the LAN side to the trusted zone everything ...
DefaultVLAN's user avatar
1 vote
0 answers
631 views

Rocky linux wireguard firewalld MASQUERADE in custom zone

I'm trying to set up a masquerade for wireguard. To open it using such a code that I found wg0.conf [Interface] PrivateKey = 2CSTiZ0l30qQZ6IZfnfvpvVMYlLGxAMLHTK8ZF8qpHs= Address = 172.16.100.1 ...
Александр Инженер's user avatar
1 vote
1 answer
134 views

How to know saltstack tool TCP port

When I stop the firewall service, salt master is working well. I recieved answer from the salt minion. When I start the firewall salt can not connect to the minion anymore. I didn't change the TCP ...
dubis's user avatar
  • 1,460
0 votes
1 answer
115 views

Routing internet bound traffic from one interface to another

So, my set up is as follows. I have my linux server with firewalld between my access point(AP) and my internet router(IR). My server connects wirelessly to the AP, and with a LAN cable to the IR, and ...
anark10n's user avatar
1 vote
3 answers
2k views

Firewalld reject rule is present, still traffic coming in

I asked the same question on ServerFault, 0 reactions... We developed a simple tool that adds a reject-rule to firewalld whenever our server's SMTP port is repeatedly attacked. We discovered that some ...
D.Bugger's user avatar
  • 111
4 votes
1 answer
1k views

Which takes precedence: /etc/hosts.allow or firewalld?

On a RHEL 7 server, /etc/hosts.allow has a number of IP addresses with full access. The firewall (confirmed with firewall-cmd), there are no specific sources defined, and the default zone allows ...
Jon Pennycook's user avatar
0 votes
0 answers
33 views

firewalld Not Registering Directives

I've sent some commands to firewalld to open up a PostgreSQL port 5432 to be opened. nmap shows it open on localhost4 to be open, but on its ip 192.168.1.23 to be non-existent. sniffing ports 0-10000 ...
Rich_F's user avatar
  • 144
0 votes
0 answers
3k views

firewall-cmd: You most likely need to use --zone=trusted option

With Fedora 36, I noticed a new firewall-cmd warning I didn't notice before (when setting things up in the same way): # firewall-cmd --list-all You're performing an operation over default zone ...
maxschlepzig's user avatar
  • 57.9k
0 votes
1 answer
2k views

How can I allow connections from 127.0.0.1 (localhost) on ports from 49152 to 65535 using firewall-cmd?

How can I allow connections from 127.0.0.1 (localhost) on ports from 49152 to 65535 using firewall-cmd? This is needed to deploy a jupyterlab server on RHEL8. Thanks in advance for your help. Best, ...
bilou_12's user avatar
0 votes
1 answer
481 views

Firewalld Internal zone Rejected

I'm trying a simple firewalld setup on ubuntu/jammy64 as follows with Source (K1) ------ (fw int) | Firewall (FW1) | (fw ext) ------ Destination (K2) ┌──(vagrant㉿k1)-[~] └─$ ip -4 a show eth1 3: eth1:...
j202's user avatar
  • 101
0 votes
0 answers
1k views

Firewalld block all input/output connections and only allow some outgoing ports

I am trying to set firewalld in Fedora 36 to block all input and output connections and only allow certain outgoing communication. The computer is not a server of any kind so we want to block all ...
Athwale's user avatar
1 vote
1 answer
1k views

How to make changes to firewall during a kickstart installation

I am trying to change some of the firewall settings during an automatic kickstart installation in the %post section on a RHEL 8 server. For example: firewall-cmd --permanent --zone=public --set-...
Garnet's user avatar
  • 398

1
2 3 4 5 6