Questions tagged [firewalld]
Firewalld is a Fedora project that "provides a dynamically managed firewall with support for network/firewall zones to define the trust level of network connections or interfaces".
287
questions
0
votes
1
answer
53
views
Using Zones in Firewalld to Block Outbound Access
I want to provide limited access to a machine which runs CentOS Linux release 7.9.2009.
For this purpose, I changed the default zone to a new zone called custom and applied a configuration as follows:
...
- 309
1
vote
1
answer
24
views
How to list the connections of the port forwarded by firewalld?
I have forwarded a port using firewalld, and everything is functioning properly. However, the 'netstat' and 'ss' commands do not display the port opened by firewalld, nor do they show the connections. ...
- 13
0
votes
0
answers
32
views
Fixing DBus after changing /home /lib and /root permissions
Firstly, I know, it was dumb, but now it's done and don't need to say "why did you do that" etc...
So, I'm using Almalinux 9 and I changed permissions of /home /lib and /root. Now, firewalld ...
- 1
0
votes
1
answer
27
views
Firewall : firewalld with docker open port for local service
I'm trying to open port for ssh on non-standard port like 12452, i used these commands and non of them worked
iptables -I INPUT -p tcp --dport 12452 -j ACCEPT
iptables -I OUTPUT -p tcp --dport 12452 -...
- 123
0
votes
0
answers
146
views
Podman: automatic network rules and iptables
When I run podman container and share port 4444 as following example:
podman run -dit --name test -p 4444:4444 alpine
It creates following iptable
Chain INPUT (policy ACCEPT)
target prot opt ...
- 163
2
votes
1
answer
38
views
Firewalld with variable source
I'm writing a script and I'm stuck.
I have a url (https://file.test.com/tips) that contains a file with the list of network subnets.
File content:
{192.168.1.0/24,10.0.0.0/24,2001:aaaa:bbbb:cccc::/64}
...
- 135
0
votes
1
answer
26
views
firewalld configuration will not allow http/https traffic
There is a hardware firewall in place, but I want to also product the system at the os level.
$ sudo firewall-cmd --list-all-zones
block
target: %%REJECT%%
icmp-block-inversion: no
interfaces:
...
- 3
4
votes
1
answer
208
views
Is there a way to check the ports that are open in firewalld without sudo?
I noticed that even checking the status of firewalld seems to require sudo. I want to keep the privileges of this script as low as possible and, for that reason, I would like the user to be able to ...
- 515
1
vote
1
answer
185
views
blocking telnet service using firewalld
my zone in firewalld in public and the list is like below.
firewall-cmd --list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: enp0s3 enp0s8
sources:
services: ...
0
votes
0
answers
63
views
FirewallD docker doesn't have access to IPs in trusted zone
I am using FirewallD version 1.1.1 with Ubuntu version 22.04.2 LTS when I add an IP to the trusted zone it gets blocked from docker zone.
Any idea why this is happening? and how I can fix it.
Here is ...
- 121
0
votes
0
answers
14
views
Firewalld configuration / pinhole?
I have a host with two interfaces:
ens32 /zone=internal 10.10.0.47
ens36 /zone=public 192.168.0.47
I have a workstation at 192.168.0.88
I'm trying to configure firewalld to allow ssh only from a set '...
- 3
2
votes
0
answers
663
views
Ubuntu 22.04 firewalld initiation problem: no python-nftables
I tried to use firewalld instead of ufw, but it keeps showing the following errors even after manually downloading python-nftables through sudo apt install
iptables is not being used.
$ systemctl ...
- 21
0
votes
2
answers
171
views
How does firewalld handle packet state internally when you add rules?
Coming from an iptables background, I can specify packet connection states (usually either NEW and/or ESTABLISHED) when defining new firewall rules. For example, this pair of rules will ensure that ...
- 3
1
vote
0
answers
103
views
How to firewall a network namespace using firewalld?
I'm running fedora 36 using firewalld as my firewall.
I set up a network namespace called "wireguard". It contains the interface wg0 which connects to Mullvad VPN. I set it up like this:
ip ...
0
votes
1
answer
71
views
How to block connection from eth1 through firewall daemon?
I have Debian 11 using the new Firewall Daemon, and I have a device connected to eth1. I want to block all connections from internet or any IP other than the local IP in the range 10.147.20.0/24.
Is ...
- 189
2
votes
1
answer
435
views
How to configure Firewalld to block incoming traffic on loopback interface?
I have firewalld enabled and configured as below:
loopback (active)
target: DROP
icmp-block-inversion: no
interfaces: lo
sources:
services:
ports:
protocols:
forward: no
...
- 155
0
votes
0
answers
97
views
does NFS proto=rdma bypass firewalld?
in /etc/firewalld/zone/mycustomzone.xml I use the syntax of <port protocol="tcp" port="2049"/> to open port number being a protocol choice of either tcp or udp. For NFSv4 ...
- 5,826
0
votes
0
answers
239
views
fail2ban and firewalld and Drop zone - strange behavior with rich-rule (add-source works fine)
firewalld and fail2ban settings:
LOG_TAG1=HTTP-DENY_
LOG_TAG2=HTTPS-DENY_
F2B_NAME=http_https_deny
sudo firewall-cmd --zone=public --add-rich-rule="rule family=ipv4 port port=80 protocol=tcp log ...
0
votes
1
answer
254
views
Ansible: Firewalld how to set multiple services (loop from another playbook)
I see the issue when I try to set multiple services to the zone.
Only first one is set and another always comes with the following error:
TASK [Set services] ******************************************...
- 163
0
votes
0
answers
171
views
SSDP/UDP Multicast on fresh installation not working
I have a freshly setup CentOS 8 Stream host.
I need to receive SSDP messages.
The problem is, as soon as firewalld is enabled, socat does not print anything.
socat UDP4-RECVFROM:1900,ip-add-membership=...
- 121
0
votes
0
answers
211
views
OpenVPN traffic being blocked by firewalld on CentOS from reaching lan
I have OpenVPN setup on a CentOS box. Clients can connect to the vpn just fine and access its resources, ping the server's lan address. However i wanted OpenVPN clients to be able to access a computer ...
- 1
0
votes
1
answer
264
views
Configuring a firewalld killswitch
I want to configure a firewalld killswitch on my computer but don't know how to go about it.
I want to block all incoming traffic. The outgoing traffic should only be allowed on a specific IP address, ...
flippunk
0
votes
0
answers
84
views
Why rsyslog don't esclude iptables message from klog/dmesg?
I have configured firewalld to log messages
sudo vim /etc/firewalld/firewalld.conf
LogDenied=all
then I configure rsyslog for separate logging
:msg, contains, "_DROP" /var/log/...
- 12.1k
0
votes
0
answers
325
views
How do i express this nftables command using firewalld rich rules, direct or policy method?
I had issues with access to a service listening on the interface lxcxxx (172.XX). this because requests are arriving through eth0, and firewalld was blocking the forwarding on the FWD filter
[30772....
- 535
0
votes
0
answers
74
views
How to forward the Internet through the OPENVPN client?
There is an Openvpn server and two clients
How will all traffic for client 1 be routed through client 2?
Server
tun0 10.8.0.1
client 1
tun0 10.8.0.2
client 2
tun0 10.8.0.3
я хочу чтобы весь ...
- 1
0
votes
0
answers
183
views
forward vpn traffic to GRE tunnel in centos7
I used GRE tunnel to connect a Linux server (centos 7) to mikrotik and I configured a openconnect service on the linux server.
How can I forward all traffics of openconnect service user's to mikrotik ...
0
votes
1
answer
112
views
Active Directory & firewall-cmd
I'm using a RHEL based VM as a router and I'm trying to get AD running on the network but I'm not being successful at it.
When I set up the interfaces on the LAN side to the trusted zone everything ...
- 25
1
vote
0
answers
364
views
Rocky linux wireguard firewalld MASQUERADE in custom zone
I'm trying to set up a masquerade for wireguard. To open it using such a code that I found
wg0.conf
[Interface]
PrivateKey = 2CSTiZ0l30qQZ6IZfnfvpvVMYlLGxAMLHTK8ZF8qpHs=
Address = 172.16.100.1
...
1
vote
1
answer
113
views
How to know saltstack tool TCP port
When I stop the firewall service, salt master is working well. I recieved answer from the salt minion. When I start the firewall salt can not connect to the minion anymore.
I didn't change the TCP ...
- 1,430
0
votes
1
answer
44
views
Routing internet bound traffic from one interface to another
So, my set up is as follows. I have my linux server with firewalld between my access point(AP) and my internet router(IR). My server connects wirelessly to the AP, and with a LAN cable to the IR, and ...
- 11
1
vote
3
answers
966
views
Firewalld reject rule is present, still traffic coming in
I asked the same question on ServerFault, 0 reactions...
We developed a simple tool that adds a reject-rule to firewalld whenever our server's SMTP port is repeatedly attacked. We discovered that some ...
- 111
4
votes
1
answer
892
views
Which takes precedence: /etc/hosts.allow or firewalld?
On a RHEL 7 server, /etc/hosts.allow has a number of IP addresses with full access. The firewall (confirmed with firewall-cmd), there are no specific sources defined, and the default zone allows ...
0
votes
0
answers
28
views
firewalld Not Registering Directives
I've sent some commands to firewalld to open up a PostgreSQL port 5432 to be opened. nmap shows it open on localhost4 to be open, but on its ip 192.168.1.23 to be non-existent.
sniffing ports 0-10000 ...
- 144
0
votes
0
answers
2k
views
firewall-cmd: You most likely need to use --zone=trusted option
With Fedora 36, I noticed a new firewall-cmd warning I didn't notice before (when setting things up in the same way):
# firewall-cmd --list-all
You're performing an operation over default zone ...
- 56.4k
0
votes
1
answer
2k
views
How can I allow connections from 127.0.0.1 (localhost) on ports from 49152 to 65535 using firewall-cmd?
How can I allow connections from 127.0.0.1 (localhost) on ports from 49152 to 65535 using firewall-cmd?
This is needed to deploy a jupyterlab server on RHEL8.
Thanks in advance for your help.
Best,
...
- 1
0
votes
1
answer
310
views
Firewalld Internal zone Rejected
I'm trying a simple firewalld setup on ubuntu/jammy64 as follows with
Source (K1) ------ (fw int) | Firewall (FW1) | (fw ext) ------ Destination (K2)
┌──(vagrant㉿k1)-[~]
└─$ ip -4 a show eth1
3: eth1:...
- 101
0
votes
0
answers
661
views
Firewalld block all input/output connections and only allow some outgoing ports
I am trying to set firewalld in Fedora 36 to block all input and output connections and only allow certain outgoing communication.
The computer is not a server of any kind so we want to block all ...
- 1
1
vote
1
answer
747
views
How to make changes to firewall during a kickstart installation
I am trying to change some of the firewall settings during an automatic kickstart installation in the %post section on a RHEL 8 server. For example: firewall-cmd --permanent --zone=public --set-...
- 366
0
votes
1
answer
771
views
Port forwarding while preserving original IP
Im using firewalld to forward an incoming port from the internet (9999) to a local LAN IP address (100.1.1.1) like this:
external (active)
target: default
icmp-block-inversion: no
interfaces: ...
- 179
0
votes
0
answers
600
views
firewalld: forward traffic as a wireguard VPN gateway
I have setup a pi running Pi OS 11 as a VPN gateway for my local network using Wireguard & Nftables, that all works fine.
However, I wish to switch over to firewalld to be compatible with docker ...
- 121
2
votes
1
answer
2k
views
Change the default firewalld zone for podman networks
Whenever podman creates a new network (interface) - by default - it adds it to the trusted zone of firewalld as described here:
Podman adds each container to firewalld's trusted zone.
You can add ...
- 420
1
vote
1
answer
473
views
Cannot make rules permanent in firewalld
I am using firewalld. I want to add a range of source IPs in the trusted zone. I can in fact do this:
❯ sudo firewall-cmd --zone=trusted --add-source=192.168.0.0/16
success
And I can confirm that the ...
- 135
0
votes
1
answer
2k
views
Convert iptable rules to firewalld
Need your help to convert this to a firewalld command. I'm not sure that i will do it in proper way, so yeah :)
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A ...
- 217
1
vote
1
answer
271
views
Convert iptables rules to firewalld for supporting domain
I have a list of iptables rules (see below). The main idea of rules replace source ip address for each request on a specific destination IP address. These rules work properly, but in my case the ...
- 113
1
vote
1
answer
1k
views
Redirecting traffic for inside network, and allow this from only IP address
I have problem with iptables. In IP tables I make redirect traffic from port 4440 to inside IP Adresses 10.0.10.102:4440
-A PREROUTING -p tcp -m tcp --dport 4440 -j DNAT --to-destination 10.0.10.102:...
- 13
4
votes
1
answer
483
views
firewalld - where are the numeric firewall port numbers mapped to the service name?
# firewall-cmd --permanent --add-service=nfs
# filewall-cmd --permanent --add-service=rpc-bind
in RHEL/CentOS 7.9 if I do the above, what numeric port numbers are opened in the firewall?
Where is the ...
- 5,826
0
votes
0
answers
268
views
firewalld not blocking http and https access
I am running a httpd container on this machine, but http or https aren't enabled on firewalld. But I can still access the website from another machine that is on the same network. Why is this behavior?...
-1
votes
1
answer
1k
views
INVALID_PORT Error from firewall-cmd
When I try to add a port via
firewall-cmd --permanent --add-port=XXXXX/tcp
I get the error
Error: INVALID_PORT: XXXXX
Why?
- 1
0
votes
1
answer
171
views
iptables accept from specific ips slows down SSH and web
I used ranges of IP address to block other countries, when I use SSH or some of my web services it slows down, if I remove the rules and put everything back to normal it works normally, any ideas?
0
votes
1
answer
546
views
Firewall is active, added port to iptables but still cannot connect
We have RedHat 8 server. Firewalld is active.
I need to connect to port 5050 from my lap top and from the second server, so I added it to the rules
iptables -I INPUT -p tcp -m tcp --dport 5050 -j ...
- 228