0

New Fedora Core 19 system refuses to forward port from external to internal zone, no logging data found.

The Scenario is simply that I've got a system that serves as a firewall / gateway, has an internal and external interface, and had a disk drive failure and the disk was replaced along with a new version of the OS - FC19. I have the old iptables script, and neither it nor firewallD work correctly. I have tried two sets of hardware and they return slightly different behaviors!

Along the way, some things partially worked and unfortunately, I trusted the new firewalld and kept going. Now I'm a little lost.

The MOST important question is: How can I debug this sucker? NOTHING has worked in that regard (at least for firewalld)? I want it to log rejected attempts to use ports so I can figure out how to fix it...

To do that, I used the rich-rules syntax, like this:

firewall-cmd --permanent --zone=external --add-rich-rule='rule family="ipv4" forward-port port="25" protocol="tcp" to-port="25" to-addr="192.168.1.1" log="smtp forward" level="info"'

It doesn't work and I suspect it's because the three actions are accept, reject, and drop, and the port-forward is implicitly an accept directive, so it would only log when packets are accepted, and not when they aren't. But how to set this up is unknown!

Some observations:

I may be having difficulty because of the naming of the interfaces. It would be nice to have firewalld tell me what it thinks the interfaces should be rather than me guess. I get one name from ifconfig, and another from route, and at least on one system, yet another name is used on the default /etc/sysconfig/network-scripts/ifcfg-xxx scripts. QUESTION: Where do the canonical names to use with firewall-cmd come from?

At one point I had (briefly) port forwarding working. BUT it was for the "public" zone. At one point I would have sworn I got it working on the "external" zone, but as I have gotten more methodical and ultra-careful with what-=all I've tried, I haven't gotten it to work again with 'external.'

NONE of the internal systems hare blocking the ports on their own internal firewall software.

I have read all of the articles I could find on firewalld on the internet and all / question/answer entries on serverfault. I am well aware that some people advocate using iptables until firewalld matures a bit more, but the iptables rules I'd like to have running on the system are non-trivial in themselves - which is a key motivator to finding a way to be successful with firewalld.

If I do try iptables as the way forward for now, I also need to know the canonical manes for it, too...

-3

...With regret, as articulated here, I've come to realize that FC releases aren't nearly as good as they once were, and whereas in the past we could get by on production systems with Fedora Core, their modern releases have dropped in quality and now they have fallen off the edge; don't use them for "production" - ANY system you care about 24 X 7.

Yeah, I replaced the OS with another distro. Yeah, it worked right away... This was NOT worth my time and the pain I went through. Don't let it be YOUR pain, too.

ALSO NOTE:

Fairly thorough testing strongly suggests but does not prove that the current firewalld (September 25, 2013, firewalld-0.3.4-1.fc19.noarch) will not do port forwarding on any zone except public. That is, don't try and use "external", for example.

  • 2
    Fedora is generally fine. FirewallD, however... is most definitely not. – Michael Hampton Sep 25 '13 at 17:26
  • @MichaelHampton Thanks for the down-vote - it's obvious my comment pertains to the network issues related to firewalld, but you want to voice your snit. fine. – Richard T Sep 25 '13 at 18:30
  • I didn't downvote your answer. You shouldn't assume things like that. – Michael Hampton Sep 25 '13 at 18:36
  • @MichaelHampton OK, you're right; it was a too-easy assumption. Frankly, I don't think a down-vote should be permitted without a comment on WHY. In this case, I suspect this answer got downvoted three times because it reflects that I finally realized you were right - Fedora Core isn't ready for Prime Time, "production use", at least not THIS version of it. And people don't like facing the reality that their favorite whatever actually deserves criticism. BTW, FWIW, I like FirewallD / Firewall-cmd, they're just not ready yet. – Richard T Sep 26 '13 at 14:04
  • I use Fedora in production in several places, where access to recent features is much more important than long-term support or other factors usually considered when choosing a distribution. It does require a more careful approach, though. One of the things you get with Fedora is very early access to new software, and that software may or may not do what you want. FirewallD didn't pass my own internal testing, and so I don't use it. Like you, I found that it wasn't sufficiently feature complete. – Michael Hampton Sep 26 '13 at 15:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.