Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [firewalld]

FirewallD is a firewall service daemon with D-BUS interface managing a dynamic firewall. First used in Fedora 18, it is expected to be the default firewall tool for future versions of Enterprise Linux.

Filter by
Sorted by
Tagged with
0 votes
1 answer
59 views

Firewalld: adding a source IP blocks SSH. Different behaviour between versions?

I have two servers with different versions of RHEL and firewalld. Both are configured the same, but they are behaving differently when I add a source IP to a zone. Server A: # cat /etc/redhat-release ...
Darren's user avatar
  • 335
0 votes
1 answer
29 views

Metrics: unreachable Kubernetes API (no logs)

While running the rke setup we have this problem: reconcile] host [192.168.137.41] is a control plane node without reachable Kubernetes API endpoint in the cluster in the metrics pod: │ E0415 14:51:...
Guillaume's user avatar
0 votes
0 answers
102 views

Docker renders server inaccessible when starting

Docker on Centos 7, using Portainer to manage containers. I created a sonarqube container from YML. When I deployed the "stack" I never had and answer. Starting docker from console with: ...
Rodrigo's user avatar
0 votes
0 answers
162 views

Strange issue with firewalld and ssh on Almalinux 9

I have this strange issue with firewalld and ssh on my fresh AlmaLinux 9 installation. I changed the ssh port to a non-default port(9322), restarted the sshd daemon. Firewalld is running in it's ...
AndyK's user avatar
  • 1
0 votes
0 answers
494 views

Port forwarding to podman container not working

I want to serve port 8000 from a podman container to the LAN using port 8009. The container is run using podman-compose, which translates to the following command: podman create --name=pihole-...
arielnmz's user avatar
  • 433
0 votes
1 answer
96 views

Firewall blocking not the IP-address, but the DNS-name

System: CentOS 7 I noticed on my server that some IP-addresses that I blocked are not actually blocked, but continue to hold connections. I started to look on the iptables-level and saw a strange ...
sivsoft's user avatar
  • 11
0 votes
2 answers
533 views

firewalld config for OpenVPN

I am trying to setup an OpenVPN server on a VPS running Fedora Server 35. I got the VPN setup and working, but am running into issues with the firewall setup. This is my first experience administering ...
Skenja's user avatar
  • 3
1 vote
0 answers
140 views

firewalld and iptables | fail2ban

I have fail2ban 1.0.2 running on an Almalinux server. Seems to be working as hoped, but I'm puzzled by something. have sshd.local and 00-firewalld.local in jail.d (installed fail2ban and fail2ban-...
Johnny Canuck's user avatar
0 votes
0 answers
35 views

Create firewalld rule

I have this code that I've been using for years (works fine) which takes external requests coming to the server at the port 9944 and redirects those requests internally to localhost on port 9922. For ...
Samul's user avatar
  • 316
-2 votes
1 answer
76 views

Set a specific IP per program in CentOS

I have a VPS with multiple IPs assigned. In this VPS I run some programs that make requests on the network and, for some reason, all the requests use one specific IPv4 of my VPS. However I have many ...
Samul's user avatar
  • 316
1 vote
2 answers
270 views

Looping forwarded and locally originating connections through port forwarding rules in firewalld

I have a Debian box running firewalld set up a as gateway NAT/router. This device has two NICS; wan --- public interface, assigned to the external firewalld zone, dynamically assigned IP address using ...
3dg3's user avatar
  • 11
0 votes
1 answer
226 views

How to proxy | forward | nat masquerade all traffic sourced from an IP to another IP elsewhere

I am setting up a new public network IP/24. Sooner or later my old subnet public network IP/24 will be dropped. In the meanwhile I would like to create a proxy to move all traffic to the OLD to the ...
Max Cuttins's user avatar
0 votes
2 answers
137 views

iptables drop to keep ports silent with no response

I am working on the network telescope stuffs (AKA. darknet, black hole), which need to make the port take no response to outer traffic (ie. when other servers PING or send SYN requests, my server ...
Z4R1's user avatar
  • 1
0 votes
1 answer
591 views

Converting iptables ruleset to Firewalld

Does anyone have a good resource or suggestion of how to convert an iptables rule set to firewalld? I'm migrating Centos 6 to Centos 7 (actually Oracle Linux 9 but let's pretend Centos 6). I could ...
Tim's user avatar
  • 1
0 votes
0 answers
373 views

How to correctly remove entries from firewalld ipset runtime?

Running Debian 12 I have created an IPSet in the following manner: ~$ firewall-cmd --permanent --new-ipset=myipset --type=hash:ip --option=timeout=0 success ~$ firewall-cmd --reload success ~$ ...
John David Ravenscroft's user avatar
0 votes
0 answers
527 views

Firewalld: restrict ssh access to specific IP and allow that IP to access services in the interface zone

The target setup is the following: I want to restrict ssh access to the server to a specific IP, and allow the http service to all. Now, to start from "scratch" I defined a new zone which I ...
Egidio Docile's user avatar
0 votes
1 answer
241 views

How does firewalld assign a zone?

I've read and re-read the manual pages, but I'm still confused by firewalld zones. I'm confused by which zone configuration elements are used in the matching traffic to zone mechanism, and which are ...
artfulrobot's user avatar
  • 3,139
0 votes
0 answers
38 views

In firewalld , added rule is active but unable to list

Added Rule in a CentOS Linux 7 Machine [root@localhost ~]# sudo firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -d 8.8.8.8/32 -j REJECT success Rule is working as expected [root@localhost ~]# ...
Arun's user avatar
  • 115
0 votes
1 answer
339 views

Firewalld is not working,. port open but I can't reach from other server

I got a wildfly 9 server on REHEL 7 with ports http=4070. Then I executed the following instructions: [root@linux]# firewall-cmd --add-port=4070/tcp --permanent Warning: ALREADY_ENABLED: 4070:tcp ...
user3637971's user avatar
1 vote
1 answer
877 views

Are rich-rules in firewalld applied before or after regular zone rules with a default "DROP" policy?

As far as I know, there are 2 main ways to add rules in firewalld, normal "zone" rules and rich-rules. Also, I understand that when we set target="DROP, all new incoming connections ...
huthut28's user avatar
0 votes
0 answers
157 views

How to DROP traffic whose source IP is on a blocklist ipset unless the source is on an allowlist ipset in firewalld?

I have 2 ipsets: friends (allow-list) and enemies (block-list). My default zone (public) DROPs all traffic, except certain services (e.g. http). I have edited the block zone that comes shipped with ...
artfulrobot's user avatar
  • 3,139
1 vote
1 answer
2k views

Firewalld fails on completely new Debian 12 server

My Debian 12 Bookworm VPS was running firewalld 1.3.0-1 without problems. Due to unrelated issues, I had to rebuild the server, and now firewalld fails. I use ansible, so the configuration should be ...
lonix's user avatar
  • 978
0 votes
1 answer
53 views

How to create trap with Firewalld

I'd like to set up the following logic using firewalld When a host attempts to access the server from the internet on port 22: DROP and add their IP to an ipset called "trap" (with 24 hour ...
artfulrobot's user avatar
  • 3,139
0 votes
0 answers
295 views

Forward local http port to external device using firewalld on Ubuntu 23.04

I have an external device A that advertises a HTTP server at port 80. It is fixed at address 192.168.1.107. I can view the HTTP server at http://192.168.1.107:80 on my local network from any other ...
Ryan Friedman's user avatar
0 votes
0 answers
243 views

why isn't firewalld blocking ports that aren't open?

I have the following zone for my internal network: internal (active) target: default ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: enp1s0f0 sources: ...
Tom B's user avatar
  • 195
0 votes
1 answer
340 views

Difficulty with Firewalld Blocking Traffic in Absence of IPTABLES Data

I have noticed that Firewalld is actively blocking incoming and outgoing connections, which is causing disruptions in my network communication. However, upon checking the system, I discovered that no ...
UME's user avatar
  • 111
0 votes
1 answer
451 views

Limit connections to private network with firewalld and wireguard in point to site

I am trying to limit VPN access to a private network running in Openstack. The wireguard server is inside the private network and the traffic is routed to its private ip address from Openstack. Inside ...
prototyp's user avatar
  • 103
0 votes
1 answer
484 views

Different ways to reload or restart Firewalld

To reload firewalld I could use: firewall-cmd --reload or firewall-cmd --complete-reload How do those differ from: systemctl reload firewalld and systemctl restart firewalld
lonix's user avatar
  • 978
1 vote
1 answer
681 views

What is the INPUT_direct chain in firewalld?

In many firewalld config examples I see mention of the normal INPUT iptables chain, as well as one named INPUT_direct. e.g. $ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 \ # etc....
lonix's user avatar
  • 978
0 votes
1 answer
395 views

Logging of "direct" iptables rules with firewalld

I'm using firewalld with the iptables backend. I added "direct" rules for ssh connection limiting: sudo firewall-cmd --add-port=22/tcp sudo firewall-cmd --direct --add-rule ipv4 filter ...
lonix's user avatar
  • 978
1 vote
1 answer
508 views

Testing rate limiting rules in firewalld

I want to rate limit ssh connections per IP to a server running firewalld. Suppose my sshd listens on port 2222, and I want to limit ssh connections per IP to 3 per minute. I tried: sudo firewall-cmd -...
lonix's user avatar
  • 978
0 votes
0 answers
2k views

Different port forwarding for https and wss (Websocket) using firewalld

Currently I setup port forwarding for a nodejs server such that all http requests (using tcp protocol) get redirected from port 80 to 3000, and all https requests (using tcp) get redirected from port ...
VIVEK's user avatar
  • 93
0 votes
1 answer
635 views

Debian 11 firewalld+nftables rules not taking effect

Update: after commenting out the line in /etc/hosts that is kinda like #127.0.1.1 my-host.domain.edu my-host and rebooting, the firewall does open the expected ports. I thought to do this because, ...
elliotta's user avatar
0 votes
1 answer
292 views

firewalld SSH closed ports still logging failed login attempts

Setting up a new VPS with almalinux. I've set up firewalld with the following settings target: default icmp-block-inversion: no interfaces: sources: services: dhcpv6-client http https ...
esseestpercipi's user avatar
0 votes
0 answers
192 views

Script to stop and start firewalld at boot

I have a ticketing system website connecting to a back-end database on my LAN through a Wireguard VPN tunnel. The front end web server is an Ubuntu 20.04.6 LTS VPS and if I reboot the server (which is ...
mr buffy's user avatar
0 votes
1 answer
625 views

fail2ban ipset proper setup of jail.conf

My understanding is that running Fail2ban using ipset is faster. To that end: I downloaded and installed per instructions (modified for Fedora 37) ritsu/ipset-fail2ban from Git. My banaction is still ...
WSpivak's user avatar
0 votes
0 answers
696 views

oracle19c - Port 1521 open on remote VM and visible in netstat, but cannot ping with telnet

I am running into some issues while trying to access a remove oracle db 19.3. The VM (CentOS 7) is located inside GCP Cloud and I can ping it on other ports (22), but i cannot connect to the database ...
Flavian Rotaru's user avatar
0 votes
1 answer
327 views

Do firewalld rich-rules apply irrespective of the allowed services in a zone?

Context: I have firewalld running on an AWS EC2. Goal: I want to add a rich rule to the default zone (public) that allows traffic from a certain CIDR range/IP address range/subnet over port 443 (HTTPS)...
Prithvi Boinpally's user avatar
0 votes
1 answer
361 views

Firewalld Allow 1 ip address from a subnet and drop the rest

I am using firewalld to control access to my AlmaLinux 8 server. I have several subnets defined as sources in the DROP zone and it seems to work well. I am wondering if is easily possible to allow ...
El_Tel's user avatar
  • 1
0 votes
1 answer
529 views

Firewalld enable but need restart it again after reboot

I have rocky 8 PHP 8.1 Apache/2.4.37 (rocky) Firewalld blocking thousands and thousands of IP's enable with firewall-cmd --permanent --zone=block --add-source=ipset:block_ips When I reboot the server ...
pata2004's user avatar
0 votes
1 answer
379 views

firewalld apply interface zone after ipset zone match

I have a firewalld setup with two zones. One zone, some-ips-allowed, is used to permit traffic from specific IP networks on some ports: some-ips-allowed (active) target: default icmp-block-...
rubikonx9's user avatar
  • 101
0 votes
1 answer
677 views

Keepalived split brain issue

I have issue with keepalived on Oracle Linux 8. The VIP is assigned to both nodes and both nodes are in MASTER mode. My keepalived configuration is: Node 1 cat /etc/keepalived/keepalived.conf ...
zerozg's user avatar
  • 1
0 votes
2 answers
219 views

fail2ban - one IP banned multiple times by multiple jails - errors in log durin unbanning

I make few similar jails for different ports... jail names: http_https_deny, dns_deny, ftp_deny, smtp_pop3_deny, ssh_deny here firewalld and fail2ban settings for http_https_deny(other almost same, ...
it_buddha's user avatar
0 votes
1 answer
294 views

firewalld stopping for no reason

I have a Red Hat 8 server. On it, I have used firewall-cmd --permanent --zone=public --add-service=https to enable public traffic to the server. When I systemctl start firewalld, this works as ...
Migwell's user avatar
  • 101
1 vote
0 answers
176 views

Assign outlet IP for a libvirt VM using routed network

My host network interface has got two IPs. Currently, I'm running my VMs in a routed network. Host's network interface is a member of public zone in firewalld, with both forward and masquerade enabled....
Yu Ling's user avatar
  • 13
0 votes
1 answer
221 views

unable to ssh into guest OS (openBSD) from host (fedora) via port forwarding on kvm

The guest OS is running on ip address 192.168.122.217. I am able to ssh into the machine via this ip address [kabira@linux ~]$ ssh [email protected] [email protected]'s password: But when ...
Kabira  K's user avatar
  • 133
2 votes
0 answers
268 views

Webmin support for Firewalld

I have configured routers/firewalls several times in the past with nftables. I'm now setting up a Linux router that will be managed by other people with less experience, so I figured Webmin would be ...
Ex Umbris's user avatar
  • 854
0 votes
1 answer
433 views

firewalld: interface autonomously changing zones

I have an RHEL8 system serving as a Docker Swarm worker node. It has firewalld enabled, and has a docker zone to which the docker0 and docker_gwbridge interfaces are assigned. $ cat /etc/firewalld/...
Aron's user avatar
  • 205
1 vote
0 answers
204 views

How do debug nft_table allow rule thats contradictory

I have some nftable rules in the inet firewalld table chain filter_FWD_policy_externalTolxc { jump filter_FWD_policy_externalTolxc_pre jump ...
user22866's user avatar
  • 151
0 votes
1 answer
751 views

Running firewalld on fresh AlmaLinux 9 CHAIN_USER_DEL CHAIN_ADD failed

Trying to run firewalld on a fresh AlmaLinux 9 VPS (OpenVZ). Only did the ff. so far: dnf upgrade systemctl start firewalld systemctl enable firewalld systemctl status firewalld I am immediately ...
IMB's user avatar
  • 521

1
2 3 4 5
9