CenntOS 8 are using nftables --direct rule does not work

[Bendt Mollerup]

I  have a setup with three different zones: external, internal & dmz.
In the dmz i have a dns and in the internal i have a dhcp, these servers are setup with fixed address, another server is setup as router & with firewalld and this is connected to these 3 zones
When I activate firewalld, nslookup from DHCP is blocked by the firewall. I made a tracing with tcpdump at port 53. I can see that the signals is received by the firewall at the incomming site (internal zone) but it is not send out to the dmz.
 (PS! If I change FirewallBackend from nftables to iptables then it will work as in CentOS 7)
Here are the rules that I use:

# Assigning interface to the zones
firewall-cmd --zone=external --change-interface=ens33
firewall-cmd --zone=internal --change-interface=ens37
firewall-cmd --zone=dmz --change-interface=ens38

# From the trusted zone (internal) allow trafik to DMZ
firewall-cmd --direct --add-rule ipv4 filter  FORWARD 0 -i ens37 -o ens38 -j ACCEPT  # This rule does not work with nftables

# Only answer back is allowed from dmz
firewall-cmd --direct --add-rule ipv4 filter  FORWARD 0 -i ens38 -o ens37 -m state --state RELATED,ESTABLISHED -j  ACCEPT

firewall-cmd  --zone=dmz --add-service=mdns
firewall-cmd  --zone=dmz --add-service=dns

and much more but it is not relevant here.

[Eric Garver]

Please see this blog post ("Further Information"):

https://firewalld.org/2018/07/nftables-backend

And this upstream issue:

https://github.com/firewalld/firewalld/issues/555

tl;dr: iptables and nftables are _separate_ firewalls. As such packets
need to pass through both of them to be allowed by the system. In your
case, the packet is accepted by iptables (--direct rule), but is dropped
by firewalld's nftables rules.

I'm currently working on full FORWARD/OUTPUT filtering support [1] which
will obsolete using direct rules in this scenario. I'm hoping it lands
in the next feature release.

[1] https://github.com/orgs/firewalld/projects/1#card-25963208

On Wed, Feb 12, 2020 at 12:47:15PM -0000, Bendt Mollerup wrote:
> I  have a setup with three different zones: external, internal & dmz.
> In the dmz i have a dns and in the internal i have a dhcp, these servers are setup with fixed address, another server is setup as router & with firewalld and this is connected to these 3 zones
> When I activate firewalld, nslookup from DHCP is blocked by the firewall. I made a tracing with tcpdump at port 53. I can see that the signals is received by the firewall at the incomming site (internal zone) but it is not send out to the dmz.
>  (PS! If I change FirewallBackend from nftables to iptables then it will work as in CentOS 7)
> Here are the rules that I use:
>
> # Assigning interface to the zones
> firewall-cmd --zone=external --change-interface=ens33
> firewall-cmd --zone=internal --change-interface=ens37
> firewall-cmd --zone=dmz --change-interface=ens38
>
> # From the trusted zone (internal) allow trafik to DMZ
> firewall-cmd --direct --add-rule ipv4 filter  FORWARD 0 -i ens37 -o ens38 -j ACCEPT  # This rule does not work with nftables
>
> # Only answer back is allowed from dmz
> firewall-cmd --direct --add-rule ipv4 filter  FORWARD 0 -i ens38 -o ens37 -m state --state RELATED,ESTABLISHED -j  ACCEPT
>
> firewall-cmd  --zone=dmz --add-service=mdns
> firewall-cmd  --zone=dmz --add-service=dns
>
> and much more but it is not relevant here.
> _______________________________________________
> firewalld-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...