Questions tagged [firewalld]
FirewallD is a firewall service daemon with D-BUS interface managing a dynamic firewall. First used in Fedora 18, it is expected to be the default firewall tool for future versions of Enterprise Linux.
425
questions
0
votes
1
answer
33
views
Different ways to reload or restart Firewalld
To reload firewalld I could use:
firewall-cmd --reload or
firewall-cmd --complete-reload
How do those differ from:
systemctl reload firewalld and
systemctl restart firewalld
- 871
1
vote
1
answer
39
views
What is the INPUT_direct chain in firewalld?
In many firewalld config examples I see mention of the normal INPUT iptables chain, as well as one named INPUT_direct.
e.g.
$ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 \
# etc....
- 871
0
votes
0
answers
7
views
firewalld config without interface declaration
In my custom firewalld zone file, I defined various ports, and this:
<interface name="eth0"/>
The firewall works as expected, whether I include that or not.
Is it strictly necessary? ...
- 871
0
votes
1
answer
25
views
Logging of "direct" iptables rules with firewalld
I'm using firewalld with the iptables backend. I added "direct" rules for ssh connection limiting:
sudo firewall-cmd --add-port=22/tcp
sudo firewall-cmd --direct --add-rule ipv4 filter ...
- 871
1
vote
1
answer
51
views
Testing rate limiting rules in firewalld
I want to rate limit ssh connections per IP to a server running firewalld.
Suppose my sshd listens on port 2222, and I want to limit ssh connections per IP to 3 per minute. I tried:
sudo firewall-cmd -...
- 871
0
votes
0
answers
78
views
Different port forwarding for https and wss (Websocket) using firewalld
Currently I setup port forwarding for a nodejs server such that all http requests (using tcp protocol) get redirected from port 80 to 3000, and all https requests (using tcp) get redirected from port ...
- 33
0
votes
1
answer
102
views
Debian 11 firewalld+nftables rules not taking effect
Update: after commenting out the line in /etc/hosts that is kinda like
#127.0.1.1 my-host.domain.edu my-host
and rebooting, the firewall does open the expected ports. I thought to do this because, ...
- 1
0
votes
1
answer
128
views
firewalld SSH closed ports still logging failed login attempts
Setting up a new VPS with almalinux.
I've set up firewalld with the following settings
target: default
icmp-block-inversion: no
interfaces:
sources:
services: dhcpv6-client http https
...
0
votes
0
answers
47
views
Script to stop and start firewalld at boot
I have a ticketing system website connecting to a back-end database on my LAN through a Wireguard VPN tunnel. The front end web server is an Ubuntu 20.04.6 LTS VPS and if I reboot the server (which is ...
- 13
0
votes
1
answer
114
views
fail2ban ipset proper setup of jail.conf
My understanding is that running Fail2ban using ipset is faster. To that end:
I downloaded and installed per instructions (modified for Fedora 37) ritsu/ipset-fail2ban from Git.
My banaction is still ...
- 3
0
votes
0
answers
116
views
oracle19c - Port 1521 open on remote VM and visible in netstat, but cannot ping with telnet
I am running into some issues while trying to access a remove oracle db 19.3. The VM (CentOS 7) is located inside GCP Cloud and I can ping it on other ports (22), but i cannot connect to the database ...
google-cloud-platform
0
votes
0
answers
80
views
Wierd firewalld block after recent update, Centos Stream 9, blocks icmp replies as invalid state
I am running Centos Stream 9 on VMware. I recently used dnf update and now there is a weird problem that some ping-replies are stopped by the firewalld. If I stop the firewall, ping works ok.
The ...
- 1
0
votes
1
answer
39
views
Do firewalld rich-rules apply irrespective of the allowed services in a zone?
Context: I have firewalld running on an AWS EC2.
Goal: I want to add a rich rule to the default zone (public) that allows traffic from a certain CIDR range/IP address range/subnet over port 443 (HTTPS)...
0
votes
0
answers
13
views
exclude a subnet from a firewalld zone?
We have a, historically grown, rather complicated network layout, forcing me to build complex and hard-to-manage firewalld zones. One thing that would really help me is if there was a way to exclude ...
- 890
0
votes
1
answer
61
views
Firewalld Allow 1 ip address from a subnet and drop the rest
I am using firewalld to control access to my AlmaLinux 8 server. I have several subnets defined as sources in the DROP zone and it seems to work well.
I am wondering if is easily possible to allow ...
- 1
0
votes
1
answer
119
views
Firewalld enable but need restart it again after reboot
I have
rocky 8
PHP 8.1
Apache/2.4.37 (rocky)
Firewalld blocking thousands and thousands of IP's
enable with firewall-cmd --permanent --zone=block --add-source=ipset:block_ips
When I reboot the server ...
- 11
0
votes
1
answer
93
views
firewalld apply interface zone after ipset zone match
I have a firewalld setup with two zones.
One zone, some-ips-allowed, is used to permit traffic from specific IP networks on some ports:
some-ips-allowed (active)
target: default
icmp-block-...
- 101
0
votes
1
answer
151
views
Keepalived split brain issue
I have issue with keepalived on Oracle Linux 8. The VIP is assigned to both nodes and both nodes are in MASTER mode.
My keepalived configuration is:
Node 1 cat /etc/keepalived/keepalived.conf
...
- 1
0
votes
0
answers
29
views
Rocky Linux 8 Blocking SIP traffic
I am having trouble with Rocky Linux blocking SIP traffic from an external LAN.
If I send a SIP message from external LAN, it reaches the server but the message doesnt get passed to the application.
...
0
votes
0
answers
21
views
Can RHEL8 / Rocky8 allow sshd + imap connections by hostname pattern (like tcp_wrappers)?
We have used tcp_wrappers for many years that has allowed an extra level of protection by only allowing sshd connections matching a hostname pattern. Simplified example:
# hosts.deny This file ...
- 111
0
votes
0
answers
81
views
Established TCP connection but no data is returned
I'm running a simple registry with podman and bind it to a local private IP address.
podman container create \
--name insecure-registry \
--privileged=True \
--env REGISTRY_HTTP_ADDR=0.0.0.0:...
- 187
0
votes
0
answers
94
views
firewall-cmd block outgoing connection to an ip list
I have searched a lot about this, this is possible to have many of these commands one for each ip:
/usr/bin/firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -d ::FFFF:85.185.0.0/112 -j REJECT
/...
- 153
0
votes
0
answers
58
views
firewalld/iptables deny before allow
I'm using a pretty straightforward firewalld rule set:
public (active)
target: default
icmp-block-inversion: no
interfaces: eno1
sources:
services: dhcpv6-client mdns rdp ssh
ports: 25565/...
- 166
0
votes
2
answers
84
views
fail2ban - one IP banned multiple times by multiple jails - errors in log durin unbanning
I make few similar jails for different ports...
jail names: http_https_deny, dns_deny, ftp_deny, smtp_pop3_deny, ssh_deny
here firewalld and fail2ban settings for http_https_deny(other almost same, ...
0
votes
0
answers
158
views
Firewalld apply port redirection from rootless Podman containers to host
Is there a way to redirect ports for traffic that originates from the host or a Podman container and is destined for the host or another Podman container using Firewalld?
My use case: I am hosting a ...
- 101
0
votes
0
answers
20
views
firewalld in RHEL9 -do I have to whitelist sources on public zone now?
we've just built our first webserver on RHEL9 (alma linux 9.1) being used to RHEL 7 (centos 7) mostly.
the firewalld config all seems the same, but when setting up our usual security setup of:
https (...
0
votes
0
answers
112
views
How to create access point or virtual access point in Fedora server 37 to access localhost too
Hi I am trying to create an access point in ideal case virtual access point in Fedora server 37.
I can create a simple AP for wifi to LAN(wlp7s0 -> enp1s0 in my case) using these commands and I can ...
0
votes
1
answer
80
views
firewalld stopping for no reason
I have a Red Hat 8 server. On it, I have used firewall-cmd --permanent --zone=public --add-service=https to enable public traffic to the server. When I systemctl start firewalld, this works as ...
- 101
0
votes
0
answers
28
views
In centos7 using iptables how to allow port 3306 for only specific ip
I'm trying to setup a rule in iptables where I allow port 3306 with only specific ip. tried this below command, not working. any help could be appreciated.
iptables -A INPUT -p tcp -m tcp -s 122.16.69....
- 1
1
vote
0
answers
97
views
Assign outlet IP for a libvirt VM using routed network
My host network interface has got two IPs. Currently, I'm running my VMs in a routed network.
Host's network interface is a member of public zone in firewalld, with both forward and masquerade enabled....
- 13
0
votes
1
answer
97
views
unable to ssh into guest OS (openBSD) from host (fedora) via port forwarding on kvm
The guest OS is running on ip address 192.168.122.217.
I am able to ssh into the machine via this ip address
[kabira@linux ~]$ ssh adming@192.168.122.217
adming@192.168.122.217's password:
But when ...
- 133
1
vote
0
answers
78
views
Webmin support for Firewalld
I have configured routers/firewalls several times in the past with nftables. I'm now setting up a Linux router that will be managed by other people with less experience, so I figured Webmin would be ...
- 844
0
votes
1
answer
187
views
firewalld: interface autonomously changing zones
I have an RHEL8 system serving as a Docker Swarm worker node. It has firewalld enabled, and has a docker zone to which the docker0 and docker_gwbridge interfaces are assigned.
$ cat /etc/firewalld/...
- 205
0
votes
0
answers
248
views
rhel 9, firewalld(nftables backend), libvirt and custom bridges, masquerading not working
I have a remote server with one network interface, which has a public IP address (enp5s0).
I've created an isolated network as follows:
<network>
<name>LAN-bridge</name>
<uuid&...
- 31
1
vote
0
answers
22
views
How do debug nft_table allow rule thats contradictory
I have some nftable rules in the inet firewalld table
chain filter_FWD_policy_externalTolxc {
jump filter_FWD_policy_externalTolxc_pre
jump ...
- 141
0
votes
0
answers
27
views
Centos 7 firewalld refuses to stop running
Checking the service shows the following:
firewalld.service
Loaded: masked (/dev/null; bad)
Active: inactive (dead)
So i tried forcing it to shutdown
[root@localhost ~]# ps aux |grep firewalld
...
- 1
0
votes
1
answer
316
views
Running firewalld on fresh AlmaLinux 9 CHAIN_USER_DEL CHAIN_ADD failed
Trying to run firewalld on a fresh AlmaLinux 9 VPS (OpenVZ). Only did the ff. so far:
dnf upgrade
systemctl start firewalld
systemctl enable firewalld
systemctl status firewalld
I am immediately ...
- 511
1
vote
0
answers
115
views
NAT'ing a specific port not working on Ubuntu, works correctly on Fedora
We have previously been running Fedora instances but for a few reasons we have needed to move over to Ubuntu based distros.
Previously, we have used the following firewalld rules in order to NAT ...
- 21
1
vote
1
answer
270
views
Centos7: Firewalld port 80 not being blocked
Why am I able to telnet to my machine on port 80 when I do not have http or port 80 opened and there are no services listening on port 80?
sudo firewall-cmd --list-all --zone=public
public (active)
...
- 131
0
votes
2
answers
734
views
Trouble mounting an NFS mount-point on a firewall system which works perfectly on other internal systems: How do I find the cause?
This is on Fedora Core 35: This environment is mature and has a few systems that are called either firewalls or gateways, and for the first time, we want to do an NFS share to one of these systems.
...
- 1,212
0
votes
0
answers
17
views
Will deleting all the firewalld files be enough to disable it?
Might be a silly question but I've accidentally locked myself out of my EC2 instance because I installed firewalld then rebooted my instance. Now I can't SSH into it, so what I did was clone a new ...
- 101
0
votes
1
answer
78
views
1 Interface with 2 IP's. How can I make UFW or Firewall-Cmd make different rulesets per IP
So I have a server with 1 interface "Eth0" and that interface has 2 IP's
192.168.0.10 -> Apache2
192.168.0.20 -> NginX
They share the same default gateway.
How can I make Firewall ...
- 127
4
votes
0
answers
126
views
firewall-cmd to drop existing connections
I want to use firewall-cmd to temporarily block mysql port 3306, including existing connections.
However after I remove MySQL service, only new connections are blocked. The existing connections are ...
- 141
1
vote
0
answers
209
views
Restricting docker zone to a single IP with firewall-cmd
I'm trying to restrict my docker exposed ports to a sigle outside IP.
docker (active)
target: ACCEPT
icmp-block-inversion: no
interfaces: br-27117bc1fd93 br-2905af95cf3a br-53c93737f17d br-...
0
votes
0
answers
695
views
How to prevent IP masquerading when allowing Docker containers to talk to each other?
I'm running a Mastodon instance using docker-compose, which builds and runs several containers, that connect to each other through a Docker internal network (the relevant docker-compose.yml).
I'm ...
- 1
1
vote
0
answers
106
views
How can I convert this iptables mark-user rule to firewald rich language?
I'm trying to convert the scripts here from raw iptables to firewalld rich rules. For example, these rules:
# Mark packets from $VPNUSER
iptables -t mangle -A OUTPUT ! --dest $LAN_NETWORK -m owner --...
- 219
1
vote
1
answer
2k
views
Port forwarding from external network to localhost
I have a service listen on 127.0.0.1:8080, and I only want to export port 80 to outside. I tried port forwarding but no success. So how can I forward port 80 to localhost:8080?
This is what i tried:
...
- 13
0
votes
0
answers
456
views
Disable connection tracking
I'm on Ubuntu 22.04 and I would like to disable connection tracking for UDP port 123, so I tried:
firewall-cmd --direct --add-rule ipv4 raw PREROUTING 1 -p udp --dport 123 -j NOTRACK
firewall-cmd --...
- 265
0
votes
0
answers
285
views
firewalld: forward traffic as a wireguard VPN gateway
I have setup a pi running Pi OS 11 as a VPN gateway for my local network using Wireguard & Nftables, that all works fine.
However, I wish to switch over to firewalld to be compatible with docker ...
- 111
0
votes
0
answers
26
views
Can port forwarding reveal destination IP?
I am forwarding incoming TCP connections to a different host in the local network using firewalld / iptables.
Is there a scenario where the remote connections are able to determine the IP of the ...
- 265