firewalld example gateway

[Igor Gnatenko]

Hi,

many people using Fedora/CentOS/RHEL/.. for organizing gateways, with
transparent proxy or with many other options. And they using iptables.

I have not seen any examples for organizing gateway with/without
transparent proxy using firewalld.

I think would be good if we will have this how-to.

Thoughts?

P.S. I can't write this doc, because I can't set it up =(

[Andrus, Brian Contractor]

Igor,

That would be useful. I beat my head all over trying to figure out part of it.
The standard masquerade for a zone makes it possible to NAT outgoing traffic from internal boxes using the firewalld box as a default gateway.

firewall-cmd --permanenet --add-masquerade --zone=internal

You can also use --direct passthrough commands to set up specific forwarding:

firewall-cmd --permanent --direct --passthrough ipv4 -t nat -I PRE_public -d 204.1.8.12 -j DNAT --to 10.1.1.4
    firewall-cmd --permanent --direct --passthrough ipv4 -t nat -I POST_public -s 10.1.1.4 -j SNAT --to 204.1.8.12

Now here is the caveat:
If you are doing both, that masquerade command comes first. 
You would normally see '-A' in your /etc/sysconfig/iptables file. 
BUT, with firewalld, it  needs to INSERT it instead of APPEND. THAT is why you need the '-I' instead of '-A' for the rule.
I beat my head on the wall over that for a bit.... o.O

Hope this helps you and at least this will be in the archive now until someone remembers to add it to some example..

Brian Andrus
ITACS/Research Computing
Naval Postgraduate School
Monterey, California
voice: 831-656-6238

-----Original Message-----
From: [e-mail] [mailto:[e-mail]] On Behalf Of Igor Gnatenko
Sent: Tuesday, October 21, 2014 11:56 PM
To: Firewalld users discussion list
Subject: firewalld example gateway

Hi,

many people using Fedora/CentOS/RHEL/.. for organizing gateways, with transparent proxy or with many other options. And they using iptables.

I have not seen any examples for organizing gateway with/without transparent proxy using firewalld.

I think would be good if we will have this how-to.

Thoughts?

P.S. I can't write this doc, because I can't set it up =(
--
-Igor Gnatenko
_______________________________________________
firewalld-users mailing list
[e-mail]
https://lists.fedorahosted.org/mailman/listinfo/firewalld-users