Questions tagged [firewalld]
FirewallD is a firewall service daemon with D-BUS interface managing a dynamic firewall. First used in Fedora 18, it is expected to be the default firewall tool for future versions of Enterprise Linux.
435
questions
0
votes
1
answer
147
views
How does firewalld assign a zone?
I've read and re-read the manual pages, but I'm still confused by firewalld zones.
I'm confused by which zone configuration elements are used in the matching traffic to zone mechanism, and which are ...
0
votes
0
answers
35
views
Strange issue with firewalld and ssh on Almalinux 9
I have this strange issue with firewalld and ssh on my fresh AlmaLinux 9 installation.
I changed the ssh port to a non-default port(9322), restarted the sshd daemon. Firewalld is running in it's ...
0
votes
1
answer
58
views
Firewall blocking not the IP-address, but the DNS-name
System: CentOS 7
I noticed on my server that some IP-addresses that I blocked are not actually blocked, but continue to hold connections.
I started to look on the iptables-level and saw a strange ...
0
votes
0
answers
184
views
Port forwarding to podman container not working
I want to serve port 8000 from a podman container to the LAN using port 8009.
The container is run using podman-compose, which translates to the following command:
podman create --name=pihole-...
1
vote
2
answers
8k
views
Firewalld drop by default and allow the existing rules that are in place
My question is how can i retain the existing configuration i have with firewalld and also drop all other connections if there is no specific rule for it.
I have the following firewall configuration:
...
1
vote
1
answer
4k
views
Linux centos firewall commands not found
firewalld-cmd--add-service=mysql--zone=public--permanent
firewalld-cmd--add-service=http--zone=public--permanent
firewalld-cmd--add-port=80/tcp--zone=public--permanent
firewalld-cmd--reload
lamps: ...
1
vote
2
answers
4k
views
How to add a new zone in firewalld without blocking `port=80/tcp` in `zone=public` in Ubuntu 20.04
I'm not too familiar with firewalld, but I thought I'd try it out on Ubuntu20.04. The problem I'm having is that port=80/tcp in zone=public gets blocked every time I try to add a new zone.
So my ...
0
votes
2
answers
277
views
firewalld config for OpenVPN
I am trying to setup an OpenVPN server on a VPS running Fedora Server 35. I got the VPN setup and working, but am running into issues with the firewall setup.
This is my first experience administering ...
0
votes
1
answer
5k
views
Firewalld: only allow ICMP and SSH from specific IP
I am trying to use Firewalld to restrict access to/from a Linux server
Environment
the Linux server has a single network interface: ens160
Requirements
It shall allow only machines with IP ...
1
vote
0
answers
91
views
firewalld and iptables | fail2ban
I have fail2ban 1.0.2 running on an Almalinux server. Seems to be working as hoped, but I'm puzzled by something.
have sshd.local and 00-firewalld.local in jail.d (installed fail2ban and fail2ban-...
1
vote
2
answers
2k
views
What is the FIREWALLD equivalent to IPTABLES -NOTRACK
I recently converted to centos 7 and so far I am beginning to like the simplicity of zones in my firewall structure, however I can't seem to find a configuration parameter for firewalld like the ...
0
votes
1
answer
1k
views
Should I allow LDAP through firewallD?
Setting up firewallD on Centos 7 servers. They use LDAP for authentication over SSH login. Do I need to explicitly allow port 389 LDAP on the default zone on FirewallD or because iv allowed SSH and ...
0
votes
0
answers
34
views
Create firewalld rule
I have this code that I've been using for years (works fine) which takes external requests coming to the server at the port 9944 and redirects those requests internally to localhost on port 9922.
For ...
-2
votes
1
answer
71
views
Set a specific IP per program in CentOS
I have a VPS with multiple IPs assigned. In this VPS I run some programs that make requests on the network and, for some reason, all the requests use one specific IPv4 of my VPS.
However I have many ...
1
vote
2
answers
201
views
Looping forwarded and locally originating connections through port forwarding rules in firewalld
I have a Debian box running firewalld set up a as gateway NAT/router. This device has two NICS; wan --- public interface, assigned to the external firewalld zone, dynamically assigned IP address using ...
4
votes
1
answer
5k
views
Migrating from libvirt + iptables to libvirt + nftables
I'm about to migrate a Debian Stretch host using qemu-kvm to Debian Buster.
I've seen people complaining on the Internet about issues due to nftables becoming default in place of iptables and libvirt ...
0
votes
1
answer
4k
views
Port is open and apache is listening but on browser "ERR_CONNECTION_TIMED_OUT" error
i have centos 7 and installed apache server on vps. listening 80, 8002 ports in httpd.conf
Listen 80
Listen 8002
also checked the $ netstat -anp | grep 8002
tcp 0 0 0.0.0.0:8002 ...
0
votes
1
answer
158
views
How to proxy | forward | nat masquerade all traffic sourced from an IP to another IP elsewhere
I am setting up a new public network IP/24.
Sooner or later my old subnet public network IP/24 will be dropped.
In the meanwhile I would like to create a proxy to move all traffic to the OLD to the ...
0
votes
2
answers
105
views
iptables drop to keep ports silent with no response
I am working on the network telescope stuffs (AKA. darknet, black hole), which need to make the port take no response to outer traffic (ie. when other servers PING or send SYN requests, my server ...
0
votes
1
answer
442
views
Converting iptables ruleset to Firewalld
Does anyone have a good resource or suggestion of how to convert an iptables rule set to firewalld? I'm migrating Centos 6 to Centos 7 (actually Oracle Linux 9 but let's pretend Centos 6). I could ...
0
votes
0
answers
215
views
How to correctly remove entries from firewalld ipset runtime?
Running Debian 12
I have created an IPSet in the following manner:
~$ firewall-cmd --permanent --new-ipset=myipset --type=hash:ip --option=timeout=0
success
~$ firewall-cmd --reload
success
~$ ...
0
votes
0
answers
340
views
Firewalld: restrict ssh access to specific IP and allow that IP to access services in the interface zone
The target setup is the following: I want to restrict ssh access to the server to a specific IP, and allow the http service to all. Now, to start from "scratch" I defined a new zone which I ...
0
votes
1
answer
240
views
Firewalld is not working,. port open but I can't reach from other server
I got a wildfly 9 server on REHEL 7 with ports http=4070. Then I executed the following instructions:
[root@linux]# firewall-cmd --add-port=4070/tcp --permanent
Warning: ALREADY_ENABLED: 4070:tcp
...
0
votes
0
answers
21
views
In firewalld , added rule is active but unable to list
Added Rule in a CentOS Linux 7 Machine
[root@localhost ~]# sudo firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -d 8.8.8.8/32 -j REJECT
success
Rule is working as expected
[root@localhost ~]# ...
0
votes
2
answers
1k
views
Why can't iptables see rules added using firewalld?
I have a CentOS7 machine, and I use firewalld as my firewall. Recently I added a few rules using firewall-cmd:
# Removing DOCKER-USER CHAIN (it won't exist at first)
firewall-cmd --permanent --direct ...
1
vote
1
answer
627
views
Are rich-rules in firewalld applied before or after regular zone rules with a default "DROP" policy?
As far as I know, there are 2 main ways to add rules in firewalld, normal "zone" rules and rich-rules. Also, I understand that when we set target="DROP, all new incoming connections ...
0
votes
2
answers
6k
views
INVALID_SERVICE upon firewall command
Upon entering following command,
firewall-cmd --add-service=postgresql-13 --permanent
I am getting this
Error: INVALID_SERVICE: 'postgresql-13' not among existing services
Where, postgresql-13 is ...
0
votes
0
answers
140
views
How to DROP traffic whose source IP is on a blocklist ipset unless the source is on an allowlist ipset in firewalld?
I have 2 ipsets: friends (allow-list) and enemies (block-list).
My default zone (public) DROPs all traffic, except certain services (e.g. http).
I have edited the block zone that comes shipped with ...
1
vote
1
answer
1k
views
Firewalld fails on completely new Debian 12 server
My Debian 12 Bookworm VPS was running firewalld 1.3.0-1 without problems. Due to unrelated issues, I had to rebuild the server, and now firewalld fails.
I use ansible, so the configuration should be ...
0
votes
1
answer
48
views
How to create trap with Firewalld
I'd like to set up the following logic using firewalld
When a host attempts to access the server from the internet on port 22:
DROP and
add their IP to an ipset called "trap" (with 24 hour ...
0
votes
1
answer
4k
views
CentOS 7 - firewalld[8509]: ERROR: COMMAND_FAILED
[root@localhost ~]# systemctl status firewalld -l
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: ...
0
votes
1
answer
402
views
Limit connections to private network with firewalld and wireguard in point to site
I am trying to limit VPN access to a private network running in Openstack. The wireguard server is inside the private network and the traffic is routed to its private ip address from Openstack.
Inside ...
0
votes
0
answers
273
views
Forward local http port to external device using firewalld on Ubuntu 23.04
I have an external device A that advertises a HTTP server at port 80. It is fixed at address 192.168.1.107. I can view the HTTP server at http://192.168.1.107:80 on my local network from any other ...
0
votes
0
answers
196
views
why isn't firewalld blocking ports that aren't open?
I have the following zone for my internal network:
internal (active)
target: default
ingress-priority: 0
egress-priority: 0
icmp-block-inversion: no
interfaces: enp1s0f0
sources:
...
0
votes
1
answer
250
views
Difficulty with Firewalld Blocking Traffic in Absence of IPTABLES Data
I have noticed that Firewalld is actively blocking incoming and outgoing connections, which is causing disruptions in my network communication. However, upon checking the system, I discovered that no ...
0
votes
3
answers
1k
views
How to Accelerate Firewalld or should it be abandoned for nftables instead?
We have a problem where we set up a server running a service and it is capable of hundreds of simultaneous connections on port 3535 (arbitrarily assigned for this application). We have firewalld ...
0
votes
1
answer
406
views
Different ways to reload or restart Firewalld
To reload firewalld I could use:
firewall-cmd --reload or
firewall-cmd --complete-reload
How do those differ from:
systemctl reload firewalld and
systemctl restart firewalld
1
vote
1
answer
545
views
What is the INPUT_direct chain in firewalld?
In many firewalld config examples I see mention of the normal INPUT iptables chain, as well as one named INPUT_direct.
e.g.
$ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 \
# etc....
0
votes
0
answers
17
views
firewalld config without interface declaration
In my custom firewalld zone file, I defined various ports, and this:
<interface name="eth0"/>
The firewall works as expected, whether I include that or not.
Is it strictly necessary? ...
0
votes
1
answer
325
views
Logging of "direct" iptables rules with firewalld
I'm using firewalld with the iptables backend. I added "direct" rules for ssh connection limiting:
sudo firewall-cmd --add-port=22/tcp
sudo firewall-cmd --direct --add-rule ipv4 filter ...
1
vote
1
answer
413
views
Testing rate limiting rules in firewalld
I want to rate limit ssh connections per IP to a server running firewalld.
Suppose my sshd listens on port 2222, and I want to limit ssh connections per IP to 3 per minute. I tried:
sudo firewall-cmd -...
2
votes
2
answers
2k
views
Error messages in firewalld log file Set fail2ban-ssh doesn't exist
I have got the following error messages repeating in firewalld log file.
2019-07-19 14:18:20 ERROR: COMMAND_FAILED: Direct: '/usr/sbin/iptables-restore -w -n' failed: iptables-restore v1.4.21: Set ...
0
votes
0
answers
2k
views
Different port forwarding for https and wss (Websocket) using firewalld
Currently I setup port forwarding for a nodejs server such that all http requests (using tcp protocol) get redirected from port 80 to 3000, and all https requests (using tcp) get redirected from port ...
1
vote
0
answers
164
views
Assign outlet IP for a libvirt VM using routed network
My host network interface has got two IPs. Currently, I'm running my VMs in a routed network.
Host's network interface is a member of public zone in firewalld, with both forward and masquerade enabled....
0
votes
1
answer
561
views
Debian 11 firewalld+nftables rules not taking effect
Update: after commenting out the line in /etc/hosts that is kinda like
#127.0.1.1 my-host.domain.edu my-host
and rebooting, the firewall does open the expected ports. I thought to do this because, ...
0
votes
1
answer
263
views
firewalld SSH closed ports still logging failed login attempts
Setting up a new VPS with almalinux.
I've set up firewalld with the following settings
target: default
icmp-block-inversion: no
interfaces:
sources:
services: dhcpv6-client http https
...
0
votes
0
answers
163
views
Script to stop and start firewalld at boot
I have a ticketing system website connecting to a back-end database on my LAN through a Wireguard VPN tunnel. The front end web server is an Ubuntu 20.04.6 LTS VPS and if I reboot the server (which is ...
0
votes
1
answer
543
views
fail2ban ipset proper setup of jail.conf
My understanding is that running Fail2ban using ipset is faster. To that end:
I downloaded and installed per instructions (modified for Fedora 37) ritsu/ipset-fail2ban from Git.
My banaction is still ...
0
votes
1
answer
280
views
Firewalld Allow 1 ip address from a subnet and drop the rest
I am using firewalld to control access to my AlmaLinux 8 server. I have several subnets defined as sources in the DROP zone and it seems to work well.
I am wondering if is easily possible to allow ...
0
votes
0
answers
625
views
oracle19c - Port 1521 open on remote VM and visible in netstat, but cannot ping with telnet
I am running into some issues while trying to access a remove oracle db 19.3. The VM (CentOS 7) is located inside GCP Cloud and I can ping it on other ports (22), but i cannot connect to the database ...