Firewalld & IPv6
by Paavo Leinonen
Hi,
I'm running firewalld in a router that connects the devices in my home LAN
to internet.
I have recently added IPv6 DHCPv6 config to the router, and prefix
delegation works, so
the devices in my home LAN get proper IPv6 addresses.
However, I don't like the idea that all IPv6 enabled devices in my home LAN
have public
IPv6 addresses. I'd very much prefer simple IPv4 -style NAT approach to
protect the
devices in home LAN from being accessed from the internet.
How do I implement something like this with firewalld in the router?
wanif=eth0
lanif=eth1
ip6tables -A FORWARD -m state --state NEW -i $lanif -o $wanif -j ACCEPT
ip6tables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
ip6tables -P FORWARD DROP
Other ways to protect the devices in my home LAN being accessed from the
internet?
-Paavo
6 years
question on DNAT or Port forwarding with firewalld
by nitesh sinha
Hi List,
I have a query regarding firewalld configuration. If this is not the correct place to ask, please redirect me to the correct place which is.
i am trying to setup Port forwarding from https (443) port to application port (8443).
The application runs on non-standard port i am able to DNAT it to the outside world on 443.
These are the iptable rules that work for me.
#for remote connections
iptables -t nat -A PREROUTING -i eno16777984 -p tcp --dport 443 -j DNAT --to-destination 127.0.0.1:8443
iptables -A FORWARD -i eno16777984 -m state --state NEW -m tcp -p tcp -d 127.0.0.1 --dport 8443 -j ACCEPT
#for localhost connections
iptables -t nat -A OUTPUT -p tcp --dport 443 -d 127.0.0.1 -j DNAT --to-destination 127.0.0.1:8443
Now, with firewalld, i tried the following :
added service (https) to public zone
added port-forwarding : port=443:proto=tcp:toport=8443:toaddr=127.0.0.1
this did not work, so i tried adding rules using --direct
firewall-cmd --direct --add-rule ipv4 nat PREROUTING 0 -i eno16777984 -d 127.0.0.1 -p tcp --dport 443 -j DNAT --to-destination 127.0.0.1:8443
firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i eno16777984 -m state --state NEW -m tcp -p tcp -d 127.0.0.1 --dport 8443 -j ACCEPT
firewall-cmd --direct --add-rule ipv4 nat OUTPUT 0 -p tcp --dport 443 -d 127.0.0.1 -j DNAT --to-destination 127.0.0.1:8443
I assume that this will work, since these are exact rules what work with iptables.
Working -> https://localhost:443
Not Working -> https://10.211.213.143:443/ (assuming this is the network ip of my machine)
[root@jmaster ~]# firewall-cmd --direct --get-all-rule
ipv4 nat OUTPUT 0 -p tcp --dport 443 -d 127.0.0.1 -j DNAT --to-destination 127.0.0.1:8443
ipv4 nat OUTPUT 0 -p tcp -o lo --dport 443 -j REDIRECT --to-ports 8443
ipv4 filter FORWARD 0 -i eno16777984 -m state --state NEW -m tcp -p tcp -d 127.0.0.1 --dport 8443 -j ACCEPT
ipv4 nat PREROUTING 0 -i eno16777984 -p tcp --dport 443 -j DNAT --to-destination 127.0.0.1:8443
What should i do make the service accessible from outside on 443 ?
Thanks in advance.
Nitesh
6 years, 5 months
Re: firewalld and ipsets
by John Griffiths
I implemented the use of ipsets for a direct rule in firewalld in 2013.
The direct.xml is:
<?xml version="1.0" encoding="utf-8"?>
<direct>
<!-- IPset Blacklisting -->
<chain ipv="ipv4" table="raw" chain="PREROUTING_blacklist"/>
<passthrough ipv="ipv4">-t raw -A PREROUTING_blacklist -m limit
--limit
3/min -j LOG --log-prefix BLACKLIST_DROP: --log-level 6</passthrough>
<passthrough ipv="ipv4">-t raw -A PREROUTING_blacklist -j
DROP</passthrough>
<passthrough ipv="ipv4">-t raw -A PREROUTING -m set --match-set
blacklist
src -j PREROUTING_blacklist</passthrough>
<chain ipv="ipv6" table="raw" chain="PREROUTING_blacklist"/>
<passthrough ipv="ipv6">-t raw -A PREROUTING_blacklist -m limit
--limit
3/min -j LOG --log-prefix BLACKLIST_DROP: --log-level 6</passthrough>
<passthrough ipv="ipv6">-t raw -A PREROUTING_blacklist -j
DROP</passthrough>
<passthrough ipv="ipv6">-t raw -A PREROUTING -m set --match-set
blacklist
src -j PREROUTING_blacklist</passthrough>
</direct>
I have several ipsets that are modified outside of firewalld.
blacklist_ipv4_permanent
blacklist_ipv4_semipermanent
blacklist_ipv4_current
blacklist_ipv6_permanent
blacklist_ipv6_semipermanent
blacklist_ipv6_current
These are members of ipset blacklist:
Name: blacklist
Type: list:set
Revision: 3
Header: size 8
Size in memory: 368
References: 0
Number of entries: 6
Members:
blacklist_ipv4_permanent
blacklist_ipv4_semipermanent
blacklist_ipv4_current
blacklist_ipv6_permanent
blacklist_ipv6_semipermanent
blacklist_ipv6_current
This was working until I upgraded to Fedora 26 from Fedora 24. Now, even
though an IP is in one of the member iplists,
blacklist_ipv4_semipermanent or one of the others, firewalld does not
block the IP.
I do not know if this is an issue with ipsets or firewalld, nor do I
know whether this is a "feature" or a bug.
Since these ipsets are modified dynamically and need to be accessed from
bash scripts, using the internal ipset functionality of firewalld is not
my desired choice.
Any insight or help in getting the ipsets working again with firewalld
would be greatly appreciated.
Thanks.
John
6 years, 6 months
Custom log file?
by Paavo Leinonen
Hi,
LogDenied=all (or anything but off) in firewalld.conf;
Is there a way to specify a custom log file, now firewalld is flooding
dmesg.
-Paavo
6 years, 6 months
cross compiling firewalld
by Tux Mason
Hello,
Is it possible to cross compile firewalld. If so, kindly share how to?
Many thanks.
6 years, 6 months
