3

You are not translating the port number. When the external connection is to port 1234, this is not a problem. But when it is to 4321, the dnat passes through to port 4321 on the internal server, not port 1234. Try tcp dport { 1234, 4321 } log prefix "nat-pre " dnat 172.23.32.200:1234; You do not need to translate the reply packets coming back from your ...


1

On Linux, the standard network stack forbids to send an IP packet with source IP 0.0.0.0 (probably since kernel 2.2). As this is required by the DHCP protocol, DHCP tools must bypass this limitation. Thus DHCP clients rely on RAW sockets to craft this forbidden packet with source IP 0.0.0.0 and actually use them for the initial DHCP exchanges. Those packets ...


1

No, the explanation is much simpler: the counter statement has optional arguments packets and bytes which display the number of packets and bytes counted by the counter when a packet reached the rule where it was. Without filter before the counter, any packet (including on loopback) will thus increase the values so it can happen very early and fast. The tool ...


1

I think the answer is fairly straightforward. First, you have done exactly the right thing... Firewalld is a pure frontend. It's not an independent firewall by itself. It only operates by taking instructions, then turning them into nftables rules (formerly iptables), and the nftables rules ARE the firewall. So you have a choice between running "firewalld ...


1

Recently I've got the same request and came to the thread. I was able to scan open ports on the FW with the nc command, like this as I query its output: nc -v -w 1 -z -s *srcIP destIP port* 2>&1 | grep timed > /dev/null && echo closed || echo open Basically, if I get 'timed out' it means that the port is not open on the FW.


Only top voted, non community-wiki answers of a minimum length are eligible