ipforwarding between interfaces and firewall rules
by R C
Hello,
I have a machine I am running RHEL 8 on. there are two interfaces and I
want to forward all traffic between those interfaces (for the src and
dst in the subnet a wireless device is on).
One interface is connected to a switch, WAN side. The other ethernet
port has an access point, connected wired.
I did turn on ipforwarding, and thought I needed only two firewall rules.
sysctl -w net.ipv4.ip_forward=1
firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -o eno1 -i
enp0s20u4u1 -j ACCEPT
firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -o enp0s20u4u1 -i
eno1 -j ACCEPT
However, when I try to do a DNS lookup, it looks like it is being
blocked/stopped by the firewall, because when I stop the firewall, it
just seems to work. With the firewall up and running, however I can ping
an ip address.
for example; if I do "ping www.google.com" I get a "ping
www.google.com: Name or service not known" If I use an IP address
(from www.google.com), it just works.
what am I missing (probably a rule in the firewall?)
(Also, I probably should restrict traffic to 192.168.67.0/24, the
network "on it" ?)
thanks,
Ron
2 years, 12 months
ping: sendmsg: Operation not permitted.
by Jason Long
Hello,
I used https://tecadmin.net/ip-failover-setup-using-keepalived-on-centos-redhat/"]https://tecadmin.net/ip-failover-setup-using-keepalived-on-centos-redhat/ tutorial to configure Keepalived on two CentOS web servers:
Server 1: 192.168.56.7
Server 2: 192.168.56.9
Virtual IP: 192.168.56.110
And after it, I added below Firewalld rule:
# firewall-cmd --add-rich-rule='rule protocol value="vrrp" accept' --permanent
# firewall-cmd --reload
#
# firewall-cmd --list-all
FedoraServer (active)
target: default
icmp-block-inversion: no
interfaces: enp0s3 enp0s8
sources:
services: dhcpv6-client http ssh
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule protocol value="vrrp" accept
But I can't ping my Virtual IP address:
# ping 192.168.56.110
PING 192.168.56.110 (192.168.56.110) 56(84) bytes of data.
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
And cURL doesn't show anything too:
# curl -l 192.168.56.110
Is it related to the Firewalld?
Thank you.
3 years