firewalld port knocking with nftables backend? - firewalld-users - Fedora mailing-lists

16 Oct 2020


      Hi all, quick question to see if anybody has done any port knocking in a firewalld compatible way?
I've set up a proof of concept directly in nftables:
table inet knock {
        set set1 {
                type ipv4_addr
                size 65535
                timeout 5s
        }
set set2 {
                type ipv4_addr
                size 65535
                timeout 5s
        }
set set3 {
                type ipv4_addr
                size 65535
                timeout 5s
        }
chain knock {
                type filter hook input priority raw; policy accept;
                ip saddr @set2 tcp dport 789 log prefix "KNOCK3 " level info add @set3 { ip saddr } return
                ip saddr @set1 tcp dport 456 log prefix "KNOCK2 " level info add @set2 { ip saddr } return
                tcp dport 123 log prefix "KNOCK1 " level info add @set1 { ip saddr } return
                ip saddr @set3 tcp dport 22 log prefix "ALLOWED " level info accept
        }
}
To do the same thing in a firewalld compatible way, I was thinking that the firewalld ssh allow rule (in nft table inet firewalld chain filter_IN_public_allow) could refer to @set3 but then I would also need to have the add @set3 (and @set3 itself) be defined in the same inet firewalld table.  I can define that by hand with nft adding the chain to table inet firewalld, but the problem with doing that is any firewall-cmd --reload will clear out my "knock" chain.
Doing firewall-cmd to define sets with timeouts also seems a bit problematic (I'm in CentOS 8 BTW) as I can define a set with a timeout:
firewall-cmd --permanent --new-ipset set3 --type=hash:ip --family=inet --option=timeout=5
firewall-cmd --reload
however listing the set shows it doesn't have a timeout:
nft list table inet firewalld|grep -A4 set
        set set3 {
                type ipv4_addr
                flags interval
        }
and in fact when I add something to the running set it doesn't disappear after 5 seconds:
# firewall-cmd --ipset=set3 --add-entry=1.2.3.4
success
# nft list table inet firewalld|grep -A4 set
        set set3 {
                type ipv4_addr
                flags interval
                elements = { 1.2.3.4 }
        }
firewalld documentation is clear that you can't list the set members for a set with timeouts since that's all handled by the kernel, which is fine but strange I guess, however it doesn't seem to be that the timeout is actually getting set into the nftables set.  (And actually, firewall-cmd could just do "nft list set inet firewalld set4" and extract the elements = {} list so possibly that's a future enhancement.)
But I digress.  Has anybody done any port knocking sort of thing in a firewalld compatible way here?  I'm interested in hearing some ideas or what has worked for people.
Thanks.
-nik