0

I've read and re-read the manual pages, but I'm still confused by firewalld zones.

I'm confused by which zone configuration elements are used in the matching traffic to zone mechanism, and which are just there to define what happens once the zone has been assigned.

For example, I believe that interfaces are used in the match; if a zone has an interface and no other config defined, I believe it will be the chosen zone for any traffic on that interface (assuming it is the first zone considered that matches). Zones have a 'target' property which specifies what happens when packets don't match.

The %%REJECT%% target is used in block zone to reject (with default firewalld reject type) every packet not matching any rule. https://firewalld.org/documentation/zone/options.html

This is where I get confused: it implies some of the config is used to select a zone to apply, while others are used to determine whether there's a match. It's unclear to me which is used when.

Example:

Let's say my internet facing interface is eth0 and I have a local service running on port 123/tcp. If I configure the block zone with

  • interface: eth0
  • sources: address=1.2.3.4
  • target: %%REJECT%%

And I have an other zone with

  • interface: eth0
  • sources: address=1.2.3.4
  • ports: 123/tcp
  • target: ACCEPT

Now if traffic comes in from 1.2.3.4 for port 123, which zone applies? block or other?

I think block because firewalld considers them alphabetically, and it matches. But that means the packets match, so therefore the target which only applies to "every packet not matching any rule" doesn't apply? So what - is it accepted then?

If the zone is being used, then there must be matches, right? (Except in the case that no zone matches and therefore DefaultZone is used. But that doesn't seem to be implied by the standard zone configs.)

And if I were to rename other to another (comes before block alphabetically), then the traffic would be accepted, not because of target=ACCEPT, but because the sources/ports matched?

So which of these:

  • interfaces:
  • sources:
  • services:
  • ports:
  • protocols:
  • forward-ports:
  • source-ports:
  • icmp-blocks:
  • rich rules:

is used to select the zone and which is used to determine what to do if a packet, now in the zone, matches?

Any explanations gratefully received!

1 Answer 1

1
  1. Only the source and interface are used to determine the zone.
  2. Source-defined zones are considered first.
  3. If the zone has "rich rules" and any of those apply, it's allowed (or rejected etc. if the rich rule says that).
  4. If it's ICMP, use those rules to accept or not.
  5. If ALL of the zone's other rules match (port, source-port, services, protocols) match, then accept.
  6. If not, and the zone's target is 'default': find the interface-defined zone that matches (using the configured DefaultZone if not). Repeat steps 3-5
  7. If the rules aren't satisfied and the target is ACCEPT|%%REJECT%%|DROP, then do that.
  8. Finally, a target='default' zone whose rules don't match gets the default treatment which is that ICMP is allowed and the rest is rejected.

In a flowchart

flowchart image of the above process

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .