Questions tagged [firewalld]

FirewallD is a firewall service daemon with D-BUS interface managing a dynamic firewall. First used in Fedora 18, it is expected to be the default firewall tool for future versions of Enterprise Linux.

Filter by
Sorted by
Tagged with
0 votes
1 answer
147 views

How does firewalld assign a zone?

I've read and re-read the manual pages, but I'm still confused by firewalld zones. I'm confused by which zone configuration elements are used in the matching traffic to zone mechanism, and which are ...
0 votes
0 answers
35 views

Strange issue with firewalld and ssh on Almalinux 9

I have this strange issue with firewalld and ssh on my fresh AlmaLinux 9 installation. I changed the ssh port to a non-default port(9322), restarted the sshd daemon. Firewalld is running in it's ...
0 votes
1 answer
58 views

Firewall blocking not the IP-address, but the DNS-name

System: CentOS 7 I noticed on my server that some IP-addresses that I blocked are not actually blocked, but continue to hold connections. I started to look on the iptables-level and saw a strange ...
0 votes
0 answers
184 views

Port forwarding to podman container not working

I want to serve port 8000 from a podman container to the LAN using port 8009. The container is run using podman-compose, which translates to the following command: podman create --name=pihole-...
1 vote
2 answers
8k views

Firewalld drop by default and allow the existing rules that are in place

My question is how can i retain the existing configuration i have with firewalld and also drop all other connections if there is no specific rule for it. I have the following firewall configuration: ...
1 vote
1 answer
4k views

Linux centos firewall commands not found

firewalld-cmd--add-service=mysql--zone=public--permanent firewalld-cmd--add-service=http--zone=public--permanent firewalld-cmd--add-port=80/tcp--zone=public--permanent firewalld-cmd--reload lamps: ...
1 vote
2 answers
4k views

How to add a new zone in firewalld without blocking `port=80/tcp` in `zone=public` in Ubuntu 20.04

I'm not too familiar with firewalld, but I thought I'd try it out on Ubuntu20.04. The problem I'm having is that port=80/tcp in zone=public gets blocked every time I try to add a new zone. So my ...
0 votes
2 answers
277 views

firewalld config for OpenVPN

I am trying to setup an OpenVPN server on a VPS running Fedora Server 35. I got the VPN setup and working, but am running into issues with the firewall setup. This is my first experience administering ...
0 votes
1 answer
5k views

Firewalld: only allow ICMP and SSH from specific IP

I am trying to use Firewalld to restrict access to/from a Linux server Environment the Linux server has a single network interface: ens160 Requirements It shall allow only machines with IP ...
1 vote
0 answers
91 views

firewalld and iptables | fail2ban

I have fail2ban 1.0.2 running on an Almalinux server. Seems to be working as hoped, but I'm puzzled by something. have sshd.local and 00-firewalld.local in jail.d (installed fail2ban and fail2ban-...
1 vote
2 answers
2k views

What is the FIREWALLD equivalent to IPTABLES -NOTRACK

I recently converted to centos 7 and so far I am beginning to like the simplicity of zones in my firewall structure, however I can't seem to find a configuration parameter for firewalld like the ...
0 votes
1 answer
1k views

Should I allow LDAP through firewallD?

Setting up firewallD on Centos 7 servers. They use LDAP for authentication over SSH login. Do I need to explicitly allow port 389 LDAP on the default zone on FirewallD or because iv allowed SSH and ...
0 votes
0 answers
34 views

Create firewalld rule

I have this code that I've been using for years (works fine) which takes external requests coming to the server at the port 9944 and redirects those requests internally to localhost on port 9922. For ...
-2 votes
1 answer
71 views

Set a specific IP per program in CentOS

I have a VPS with multiple IPs assigned. In this VPS I run some programs that make requests on the network and, for some reason, all the requests use one specific IPv4 of my VPS. However I have many ...
1 vote
2 answers
201 views

Looping forwarded and locally originating connections through port forwarding rules in firewalld

I have a Debian box running firewalld set up a as gateway NAT/router. This device has two NICS; wan --- public interface, assigned to the external firewalld zone, dynamically assigned IP address using ...
4 votes
1 answer
5k views

Migrating from libvirt + iptables to libvirt + nftables

I'm about to migrate a Debian Stretch host using qemu-kvm to Debian Buster. I've seen people complaining on the Internet about issues due to nftables becoming default in place of iptables and libvirt ...
0 votes
1 answer
4k views

Port is open and apache is listening but on browser "ERR_CONNECTION_TIMED_OUT" error

i have centos 7 and installed apache server on vps. listening 80, 8002 ports in httpd.conf Listen 80 Listen 8002 also checked the $ netstat -anp | grep 8002 tcp 0 0 0.0.0.0:8002 ...
0 votes
1 answer
158 views

How to proxy | forward | nat masquerade all traffic sourced from an IP to another IP elsewhere

I am setting up a new public network IP/24. Sooner or later my old subnet public network IP/24 will be dropped. In the meanwhile I would like to create a proxy to move all traffic to the OLD to the ...
0 votes
2 answers
105 views

iptables drop to keep ports silent with no response

I am working on the network telescope stuffs (AKA. darknet, black hole), which need to make the port take no response to outer traffic (ie. when other servers PING or send SYN requests, my server ...
0 votes
1 answer
442 views

Converting iptables ruleset to Firewalld

Does anyone have a good resource or suggestion of how to convert an iptables rule set to firewalld? I'm migrating Centos 6 to Centos 7 (actually Oracle Linux 9 but let's pretend Centos 6). I could ...
0 votes
0 answers
215 views

How to correctly remove entries from firewalld ipset runtime?

Running Debian 12 I have created an IPSet in the following manner: ~$ firewall-cmd --permanent --new-ipset=myipset --type=hash:ip --option=timeout=0 success ~$ firewall-cmd --reload success ~$ ...
0 votes
0 answers
340 views

Firewalld: restrict ssh access to specific IP and allow that IP to access services in the interface zone

The target setup is the following: I want to restrict ssh access to the server to a specific IP, and allow the http service to all. Now, to start from "scratch" I defined a new zone which I ...
0 votes
1 answer
240 views

Firewalld is not working,. port open but I can't reach from other server

I got a wildfly 9 server on REHEL 7 with ports http=4070. Then I executed the following instructions: [root@linux]# firewall-cmd --add-port=4070/tcp --permanent Warning: ALREADY_ENABLED: 4070:tcp ...
0 votes
0 answers
21 views

In firewalld , added rule is active but unable to list

Added Rule in a CentOS Linux 7 Machine [root@localhost ~]# sudo firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -d 8.8.8.8/32 -j REJECT success Rule is working as expected [root@localhost ~]# ...
0 votes
2 answers
1k views

Why can't iptables see rules added using firewalld?

I have a CentOS7 machine, and I use firewalld as my firewall. Recently I added a few rules using firewall-cmd: # Removing DOCKER-USER CHAIN (it won't exist at first) firewall-cmd --permanent --direct ...
1 vote
1 answer
627 views

Are rich-rules in firewalld applied before or after regular zone rules with a default "DROP" policy?

As far as I know, there are 2 main ways to add rules in firewalld, normal "zone" rules and rich-rules. Also, I understand that when we set target="DROP, all new incoming connections ...
0 votes
2 answers
6k views

INVALID_SERVICE upon firewall command

Upon entering following command, firewall-cmd --add-service=postgresql-13 --permanent I am getting this Error: INVALID_SERVICE: 'postgresql-13' not among existing services Where, postgresql-13 is ...
0 votes
0 answers
140 views

How to DROP traffic whose source IP is on a blocklist ipset unless the source is on an allowlist ipset in firewalld?

I have 2 ipsets: friends (allow-list) and enemies (block-list). My default zone (public) DROPs all traffic, except certain services (e.g. http). I have edited the block zone that comes shipped with ...
1 vote
1 answer
1k views

Firewalld fails on completely new Debian 12 server

My Debian 12 Bookworm VPS was running firewalld 1.3.0-1 without problems. Due to unrelated issues, I had to rebuild the server, and now firewalld fails. I use ansible, so the configuration should be ...
0 votes
1 answer
48 views

How to create trap with Firewalld

I'd like to set up the following logic using firewalld When a host attempts to access the server from the internet on port 22: DROP and add their IP to an ipset called "trap" (with 24 hour ...
0 votes
1 answer
4k views

CentOS 7 - firewalld[8509]: ERROR: COMMAND_FAILED

[root@localhost ~]# systemctl status firewalld -l ● firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: ...
0 votes
1 answer
402 views

Limit connections to private network with firewalld and wireguard in point to site

I am trying to limit VPN access to a private network running in Openstack. The wireguard server is inside the private network and the traffic is routed to its private ip address from Openstack. Inside ...
0 votes
0 answers
273 views

Forward local http port to external device using firewalld on Ubuntu 23.04

I have an external device A that advertises a HTTP server at port 80. It is fixed at address 192.168.1.107. I can view the HTTP server at http://192.168.1.107:80 on my local network from any other ...
0 votes
0 answers
196 views

why isn't firewalld blocking ports that aren't open?

I have the following zone for my internal network: internal (active) target: default ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: enp1s0f0 sources: ...
0 votes
1 answer
250 views

Difficulty with Firewalld Blocking Traffic in Absence of IPTABLES Data

I have noticed that Firewalld is actively blocking incoming and outgoing connections, which is causing disruptions in my network communication. However, upon checking the system, I discovered that no ...
0 votes
3 answers
1k views

How to Accelerate Firewalld or should it be abandoned for nftables instead?

We have a problem where we set up a server running a service and it is capable of hundreds of simultaneous connections on port 3535 (arbitrarily assigned for this application). We have firewalld ...
0 votes
1 answer
406 views

Different ways to reload or restart Firewalld

To reload firewalld I could use: firewall-cmd --reload or firewall-cmd --complete-reload How do those differ from: systemctl reload firewalld and systemctl restart firewalld
1 vote
1 answer
545 views

What is the INPUT_direct chain in firewalld?

In many firewalld config examples I see mention of the normal INPUT iptables chain, as well as one named INPUT_direct. e.g. $ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 \ # etc....
0 votes
0 answers
17 views

firewalld config without interface declaration

In my custom firewalld zone file, I defined various ports, and this: <interface name="eth0"/> The firewall works as expected, whether I include that or not. Is it strictly necessary? ...
0 votes
1 answer
325 views

Logging of "direct" iptables rules with firewalld

I'm using firewalld with the iptables backend. I added "direct" rules for ssh connection limiting: sudo firewall-cmd --add-port=22/tcp sudo firewall-cmd --direct --add-rule ipv4 filter ...
1 vote
1 answer
413 views

Testing rate limiting rules in firewalld

I want to rate limit ssh connections per IP to a server running firewalld. Suppose my sshd listens on port 2222, and I want to limit ssh connections per IP to 3 per minute. I tried: sudo firewall-cmd -...
2 votes
2 answers
2k views

Error messages in firewalld log file Set fail2ban-ssh doesn't exist

I have got the following error messages repeating in firewalld log file. 2019-07-19 14:18:20 ERROR: COMMAND_FAILED: Direct: '/usr/sbin/iptables-restore -w -n' failed: iptables-restore v1.4.21: Set ...
0 votes
0 answers
2k views

Different port forwarding for https and wss (Websocket) using firewalld

Currently I setup port forwarding for a nodejs server such that all http requests (using tcp protocol) get redirected from port 80 to 3000, and all https requests (using tcp) get redirected from port ...
1 vote
0 answers
164 views

Assign outlet IP for a libvirt VM using routed network

My host network interface has got two IPs. Currently, I'm running my VMs in a routed network. Host's network interface is a member of public zone in firewalld, with both forward and masquerade enabled....
0 votes
1 answer
561 views

Debian 11 firewalld+nftables rules not taking effect

Update: after commenting out the line in /etc/hosts that is kinda like #127.0.1.1 my-host.domain.edu my-host and rebooting, the firewall does open the expected ports. I thought to do this because, ...
0 votes
1 answer
263 views

firewalld SSH closed ports still logging failed login attempts

Setting up a new VPS with almalinux. I've set up firewalld with the following settings target: default icmp-block-inversion: no interfaces: sources: services: dhcpv6-client http https ...
0 votes
0 answers
163 views

Script to stop and start firewalld at boot

I have a ticketing system website connecting to a back-end database on my LAN through a Wireguard VPN tunnel. The front end web server is an Ubuntu 20.04.6 LTS VPS and if I reboot the server (which is ...
0 votes
1 answer
543 views

fail2ban ipset proper setup of jail.conf

My understanding is that running Fail2ban using ipset is faster. To that end: I downloaded and installed per instructions (modified for Fedora 37) ritsu/ipset-fail2ban from Git. My banaction is still ...
0 votes
1 answer
280 views

Firewalld Allow 1 ip address from a subnet and drop the rest

I am using firewalld to control access to my AlmaLinux 8 server. I have several subnets defined as sources in the DROP zone and it seems to work well. I am wondering if is easily possible to allow ...
0 votes
0 answers
625 views

oracle19c - Port 1521 open on remote VM and visible in netstat, but cannot ping with telnet

I am running into some issues while trying to access a remove oracle db 19.3. The VM (CentOS 7) is located inside GCP Cloud and I can ping it on other ports (22), but i cannot connect to the database ...

1
2 3 4 5
9