How firewalld to-addr work

[Hamado Dene]

Hello firewalld Community,

I'm trying to understand how the to-addr feature works in firewalld. I haven’t found much information in the documentation.We use RHEL 9 and have firewalld version 1.2.1.We have an interface with a primary IP and other secondary IPs. The scenario is as follows:
ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000    link/ether 50:6b:8d:d8:2d:84 brd ff:ff:ff:ff:ff:ff    altname enp0s3    inet 10.104.112.5/24 brd 10.104.112.255 scope global noprefixroute ens3       valid_lft forever preferred_lft forever    inet 10.104.112.8/32 brd 10.104.112.255 scope global ens3       valid_lft forever preferred_lft forever

10.104.112.5 is the machine's primary IP, while 10.104.112.8 is a floating IP managed by Pacemaker.

We tried adding a rule like this:
rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"

By doing this, we noticed that the request is always forwarded to the machine’s primary IP, i.e., 10.104.112.5.However, I expected it to be forwarded to the IP 10.104.112.9.

How is the IP to forward the request to actually decided?The only way I see to force it to 10.104.112.9 is by specifying to-addr=10.104.112.9.

In CentOS 7 with firewalld version 0.6, by specifying only the rule:
rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"

without specifying to-addr, the request is correctly forwarded to IP 10.104.112.9.

Could anyone provide me with more information?

Thanks in advance.

Hamado Dene

[Andrei Borzenkov]

On Wed, Oct 30, 2024 at 1:09 PM Hamado Dene via firewalld-users
 wrote:
> Hello firewalld Community,
>
> I'm trying to understand how the to-addr feature works in firewalld. I haven’t found much information in the documentation. We use RHEL 9 and have firewalld version 1.2.1. We have an interface with a primary IP and other secondary IPs. The scenario is as follows:
>
> ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
>     link/ether 50:6b:8d:d8:2d:84 brd ff:ff:ff:ff:ff:ff
>     altname enp0s3
>     inet 10.104.112.5/24 brd 10.104.112.255 scope global noprefixroute ens3
>        valid_lft forever preferred_lft forever
>     inet 10.104.112.8/32 brd 10.104.112.255 scope global ens3
>        valid_lft forever preferred_lft forever
>
> 10.104.112.5 is the machine's primary IP, while 10.104.112.8 is a floating IP managed by Pacemaker.
>
> We tried adding a rule like this:
>
> rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
>
> By doing this, we noticed that the request is always forwarded to the machine’s primary IP, i.e., 10.104.112.5. However, I expected it to be forwarded to the IP 10.104.112.9.

"destination address" is used to match packets to which rule is
applied, not to set address to forward packets to.
> How is the IP to forward the request to actually decided? The only way I see to force it to 10.104.112.9 is by specifying to-addr=10.104.112.9.
>
> In CentOS 7 with firewalld version 0.6, by specifying only the rule:
>
> rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
>
> without specifying to-addr, the request is correctly forwarded to IP 10.104.112.9.
>
> Could anyone provide me with more information?
>
> Thanks in advance.
> Hamado Dene
>
> firewalld-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

[Hamado Dene]

Yet, it makes sense. But, ff to-addr is not specified, how is it decided which IP on the interface the request is forwarded to (considering the interface has multiple IP addresses)?

Hamado Dene

Il mercoledì 30 ottobre 2024 alle ore 11:35:29 CET, Andrei Borzenkov via firewalld-users  ha scritto:

On Wed, Oct 30, 2024 at 1:09 PM Hamado Dene via firewalld-users
 wrote:
> Hello firewalld Community,
>
> I'm trying to understand how the to-addr feature works in firewalld. I haven’t found much information in the documentation. We use RHEL 9 and have firewalld version 1.2.1. We have an interface with a primary IP and other secondary IPs. The scenario is as follows:
>
> ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
>     link/ether 50:6b:8d:d8:2d:84 brd ff:ff:ff:ff:ff:ff
>     altname enp0s3
>     inet 10.104.112.5/24 brd 10.104.112.255 scope global noprefixroute ens3
>         valid_lft forever preferred_lft forever
>     inet 10.104.112.8/32 brd 10.104.112.255 scope global ens3
>         valid_lft forever preferred_lft forever
>
> 10.104.112.5 is the machine's primary IP, while 10.104.112.8 is a floating IP managed by Pacemaker.
>
> We tried adding a rule like this:
>
> rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
>
> By doing this, we noticed that the request is always forwarded to the machine’s primary IP, i.e., 10.104.112.5. However, I expected it to be forwarded to the IP 10.104.112.9.

"destination address" is used to match packets to which rule is
applied, not to set address to forward packets to.
> How is the IP to forward the request to actually decided? The only way I see to force it to 10.104.112.9 is by specifying to-addr=10.104.112.9.
>
> In CentOS 7 with firewalld version 0.6, by specifying only the rule:
>
> rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
>
> without specifying to-addr, the request is correctly forwarded to IP 10.104.112.9.
>
> Could anyone provide me with more information?
>
> Thanks in advance.
> Hamado Dene
>
> firewalld-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

[Andrei Borzenkov]

On Wed, Oct 30, 2024 at 1:53 PM Hamado Dene  wrote:
> Yet, it makes sense. But, ff to-addr is not specified, how is it decided which IP on the interface the request is forwarded to

Destination address in packets is not changed, so whatever destination
address this packet has.
> (considering the interface has multiple IP addresses)?
>
> Hamado Dene
>
> Il mercoledì 30 ottobre 2024 alle ore 11:35:29 CET, Andrei Borzenkov via firewalld-users  ha scritto:
>
> On Wed, Oct 30, 2024 at 1:09 PM Hamado Dene via firewalld-users
>  wrote:
> > Hello firewalld Community,
> >
> > I'm trying to understand how the to-addr feature works in firewalld. I haven’t found much information in the documentation. We use RHEL 9 and have firewalld version 1.2.1. We have an interface with a primary IP and other secondary IPs. The scenario is as follows:
> >
> > ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
> >    link/ether 50:6b:8d:d8:2d:84 brd ff:ff:ff:ff:ff:ff
> >    altname enp0s3
> >    inet 10.104.112.5/24 brd 10.104.112.255 scope global noprefixroute ens3
> >        valid_lft forever preferred_lft forever
> >    inet 10.104.112.8/32 brd 10.104.112.255 scope global ens3
> >        valid_lft forever preferred_lft forever
> >
> > 10.104.112.5 is the machine's primary IP, while 10.104.112.8 is a floating IP managed by Pacemaker.
> >
> > We tried adding a rule like this:
> >
> > rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
> >
> > By doing this, we noticed that the request is always forwarded to the machine’s primary IP, i.e., 10.104.112.5. However, I expected it to be forwarded to the IP 10.104.112.9.
>
> "destination address" is used to match packets to which rule is
> applied, not to set address to forward packets to.
> > How is the IP to forward the request to actually decided? The only way I see to force it to 10.104.112.9 is by specifying to-addr=10.104.112.9.
> >
> > In CentOS 7 with firewalld version 0.6, by specifying only the rule:
> >
> > rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
> >
> > without specifying to-addr, the request is correctly forwarded to IP 10.104.112.9.
> >
> > Could anyone provide me with more information?
> >
> > Thanks in advance.
> > Hamado Dene
> >
> > firewalld-users mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
> > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
>
> --
> _______________________________________________
> firewalld-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

[Hamado Dene]

From the tests I've done, with destination 10.104.112.8, the packet was routed through the primary IP 10.104.112.5.

The same rule without to-addr on CentOS 7 with firewalld 0.6 is not forwarded correctly, while in version 1.2.1 it isn’t. I'll try to debug further.

As a workaround, I forced it with to-addr

Hamado Dene

Il mercoledì 30 ottobre 2024 alle ore 12:07:34 CET, Andrei Borzenkov via firewalld-users  ha scritto:

On Wed, Oct 30, 2024 at 1:53 PM Hamado Dene  wrote:
> Yet, it makes sense. But, ff to-addr is not specified, how is it decided which IP on the interface the request is forwarded to

Destination address in packets is not changed, so whatever destination
address this packet has.
> (considering the interface has multiple IP addresses)?
>
> Hamado Dene
>
> Il mercoledì 30 ottobre 2024 alle ore 11:35:29 CET, Andrei Borzenkov via firewalld-users  ha scritto:
>
> On Wed, Oct 30, 2024 at 1:09 PM Hamado Dene via firewalld-users
>  wrote:
> > Hello firewalld Community,
> >
> > I'm trying to understand how the to-addr feature works in firewalld. I haven’t found much information in the documentation. We use RHEL 9 and have firewalld version 1.2.1. We have an interface with a primary IP and other secondary IPs. The scenario is as follows:
> >
> > ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
> >     link/ether 50:6b:8d:d8:2d:84 brd ff:ff:ff:ff:ff:ff
> >     altname enp0s3
> >     inet 10.104.112.5/24 brd 10.104.112.255 scope global noprefixroute ens3
> >         valid_lft forever preferred_lft forever
> >     inet 10.104.112.8/32 brd 10.104.112.255 scope global ens3
> >         valid_lft forever preferred_lft forever
> >
> > 10.104.112.5 is the machine's primary IP, while 10.104.112.8 is a floating IP managed by Pacemaker.
> >
> > We tried adding a rule like this:
> >
> > rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
> >
> > By doing this, we noticed that the request is always forwarded to the machine’s primary IP, i.e., 10.104.112.5. However, I expected it to be forwarded to the IP 10.104.112.9.
>
> "destination address" is used to match packets to which rule is
> applied, not to set address to forward packets to.
> > How is the IP to forward the request to actually decided? The only way I see to force it to 10.104.112.9 is by specifying to-addr=10.104.112.9.
> >
> > In CentOS 7 with firewalld version 0.6, by specifying only the rule:
> >
> > rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
> >
> > without specifying to-addr, the request is correctly forwarded to IP 10.104.112.9.
> >
> > Could anyone provide me with more information?
> >
> > Thanks in advance.
> > Hamado Dene
> >
> > firewalld-users mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
> > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
>
> --
> _______________________________________________
> firewalld-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

[Eric Garver]

On Wed, Oct 30, 2024 at 11:33:50AM +0000, Hamado Dene via firewalld-users wrote:
> > From the tests I've done, with destination 10.104.112.8, the packet was routed through the primary IP 10.104.112.5.
>
> The same rule without to-addr on CentOS 7 with firewalld 0.6 is not forwarded correctly, while in version 1.2.1 it isn’t. I'll try to debug further.

Without "to-addr" the packet will be redirected to the local host. It
will not be forwarded.

Quoting the nft man page:

The redirect statement is a special form of dnat which always
  translates the destination address to the local host’s one. It comes
  in handy if one only wants to alter the destination port of incoming
  traffic on different interfaces.
> As a workaround, I forced it with to-addr
>
> Hamado Dene
> Il mercoledì 30 ottobre 2024 alle ore 12:07:34 CET, Andrei Borzenkov via firewalld-users <[e-mail]> ha scritto:  
>
> On Wed, Oct 30, 2024 at 1:53 PM Hamado Dene  wrote:
> > Yet, it makes sense. But, ff to-addr is not specified, how is it decided which IP on the interface the request is forwarded to
>
> Destination address in packets is not changed, so whatever destination
> address this packet has.
> > (considering the interface has multiple IP addresses)?
> >
> > Hamado Dene
> >
> > Il mercoledì 30 ottobre 2024 alle ore 11:35:29 CET, Andrei Borzenkov via firewalld-users  ha scritto:
> >
> > On Wed, Oct 30, 2024 at 1:09 PM Hamado Dene via firewalld-users
> >  wrote:
> > > Hello firewalld Community,
> > >
> > > I'm trying to understand how the to-addr feature works in firewalld. I haven’t found much information in the documentation. We use RHEL 9 and have firewalld version 1.2.1. We have an interface with a primary IP and other secondary IPs. The scenario is as follows:
> > >
> > > ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
> > >     link/ether 50:6b:8d:d8:2d:84 brd ff:ff:ff:ff:ff:ff
> > >     altname enp0s3
> > >     inet 10.104.112.5/24 brd 10.104.112.255 scope global noprefixroute ens3
> > >         valid_lft forever preferred_lft forever
> > >     inet 10.104.112.8/32 brd 10.104.112.255 scope global ens3
> > >         valid_lft forever preferred_lft forever
> > >
> > > 10.104.112.5 is the machine's primary IP, while 10.104.112.8 is a floating IP managed by Pacemaker.
> > >
> > > We tried adding a rule like this:
> > >
> > > rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
> > >
> > > By doing this, we noticed that the request is always forwarded to the machine’s primary IP, i.e., 10.104.112.5. However, I expected it to be forwarded to the IP 10.104.112.9.
> >
> > "destination address" is used to match packets to which rule is
> > applied, not to set address to forward packets to.
> > > How is the IP to forward the request to actually decided? The only way I see to force it to 10.104.112.9 is by specifying to-addr=10.104.112.9.
> > >
> > > In CentOS 7 with firewalld version 0.6, by specifying only the rule:
> > >
> > > rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
> > >
> > > without specifying to-addr, the request is correctly forwarded to IP 10.104.112.9.
> > >
> > > Could anyone provide me with more information?
> > >
> > > Thanks in advance.
> > > Hamado Dene
> > >
> > > firewalld-users mailing list -- [e-mail]
> > > To unsubscribe send an email to [e-mail]
> > > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> > > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
> >
> > --
> > _______________________________________________
> > firewalld-users mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
> > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
>
> -- 
> _______________________________________________
> firewalld-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
> -- 
> _______________________________________________
> firewalld-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

[Andrei Borzenkov]

On Wed, Oct 30, 2024 at 2:51 PM Eric Garver  wrote:
> On Wed, Oct 30, 2024 at 11:33:50AM +0000, Hamado Dene via firewalld-users wrote:
> > > From the tests I've done, with destination 10.104.112.8, the packet was routed through the primary IP 10.104.112.5.
> >
> > The same rule without to-addr on CentOS 7 with firewalld 0.6 is not forwarded correctly, while in version 1.2.1 it isn’t. I'll try to debug further.
>
> Without "to-addr" the packet will be redirected to the local host. It
> will not be forwarded.
>
> Quoting the nft man page:
>
> The redirect statement is a special form of dnat which always
>   translates the destination address to the local host’s one. It comes
>   in handy if one only wants to alter the destination port of incoming
>   traffic on different interfaces.

That explicitly breaks compatibility with iptables backend. Discussing
nftables behavior is out of scope on this list, but then firewalld
should not use nft redirect because its semantic is different from
iptables DNAT. Quoting iptables-extensions DNAT man page

If no IP address is specified then *only the destination port will be modified*.

I would say it is a bug in firewalld. It should be using something
different. Apparently nftables dnat requires destination IP, the only
way to rewrite port without changing destination (as DNAT iptables
did) is

nft add rule raw prerouting tcp dport 8080 tcp dport set 80

If it is not feasible, then this needs a big read warning in manual
and release notes.

Explanation how "destination address of the local host" is determined
in case of multiple addresses would not hurt as well.
> > As a workaround, I forced it with to-addr
> >
> > Hamado Dene
> > Il mercoledì 30 ottobre 2024 alle ore 12:07:34 CET, Andrei Borzenkov via firewalld-users <[e-mail]> ha scritto:
> >
> > On Wed, Oct 30, 2024 at 1:53 PM Hamado Dene  wrote:
> > > Yet, it makes sense. But, ff to-addr is not specified, how is it decided which IP on the interface the request is forwarded to
> >
> > Destination address in packets is not changed, so whatever destination
> > address this packet has.
> > > (considering the interface has multiple IP addresses)?
> > >
> > > Hamado Dene
> > >
> > > Il mercoledì 30 ottobre 2024 alle ore 11:35:29 CET, Andrei Borzenkov via firewalld-users  ha scritto:
> > >
> > > On Wed, Oct 30, 2024 at 1:09 PM Hamado Dene via firewalld-users
> > >  wrote:
> > > > Hello firewalld Community,
> > > >
> > > > I'm trying to understand how the to-addr feature works in firewalld. I haven’t found much information in the documentation. We use RHEL 9 and have firewalld version 1.2.1. We have an interface with a primary IP and other secondary IPs. The scenario is as follows:
> > > >
> > > > ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
> > > >    link/ether 50:6b:8d:d8:2d:84 brd ff:ff:ff:ff:ff:ff
> > > >    altname enp0s3
> > > >    inet 10.104.112.5/24 brd 10.104.112.255 scope global noprefixroute ens3
> > > >        valid_lft forever preferred_lft forever
> > > >    inet 10.104.112.8/32 brd 10.104.112.255 scope global ens3
> > > >        valid_lft forever preferred_lft forever
> > > >
> > > > 10.104.112.5 is the machine's primary IP, while 10.104.112.8 is a floating IP managed by Pacemaker.
> > > >
> > > > We tried adding a rule like this:
> > > >
> > > > rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
> > > >
> > > > By doing this, we noticed that the request is always forwarded to the machine’s primary IP, i.e., 10.104.112.5. However, I expected it to be forwarded to the IP 10.104.112.9.
> > >
> > > "destination address" is used to match packets to which rule is
> > > applied, not to set address to forward packets to.
> > > > How is the IP to forward the request to actually decided? The only way I see to force it to 10.104.112.9 is by specifying to-addr=10.104.112.9.
> > > >
> > > > In CentOS 7 with firewalld version 0.6, by specifying only the rule:
> > > >
> > > > rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
> > > >
> > > > without specifying to-addr, the request is correctly forwarded to IP 10.104.112.9.
> > > >
> > > > Could anyone provide me with more information?
> > > >
> > > > Thanks in advance.
> > > > Hamado Dene
> > > >
> > > > firewalld-users mailing list -- [e-mail]
> > > > To unsubscribe send an email to [e-mail]
> > > > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > > List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> > > > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
> > >
> > > --
> > > _______________________________________________
> > > firewalld-users mailing list -- [e-mail]
> > > To unsubscribe send an email to [e-mail]
> > > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> > > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
> >
> > --
> > _______________________________________________
> > firewalld-users mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
> > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
> > --
> > _______________________________________________
> > firewalld-users mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
> > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

[Hamado Dene]

I agree with Andrei... The most logical thing, in my opinion, would be to add a warning to the documentation that specifies this behavior so that users are aware of it.

I am new to this mailing list. In this case, how do we proceed? Should we open an issue on GitHub or start a thread on the dev mailing list to address this case?

Hamado Dene

Il mercoledì 30 ottobre 2024 alle ore 13:59:52 CET, Andrei Borzenkov via firewalld-users  ha scritto:

On Wed, Oct 30, 2024 at 2:51 PM Eric Garver  wrote:
> On Wed, Oct 30, 2024 at 11:33:50AM +0000, Hamado Dene via firewalld-users wrote:
> > > From the tests I've done, with destination 10.104.112.8, the packet was routed through the primary IP 10.104.112.5.
> >
> > The same rule without to-addr on CentOS 7 with firewalld 0.6 is not forwarded correctly, while in version 1.2.1 it isn’t. I'll try to debug further.
>
> Without "to-addr" the packet will be redirected to the local host. It
> will not be forwarded.
>
> Quoting the nft man page:
>
> The redirect statement is a special form of dnat which always
>   translates the destination address to the local host’s one. It comes
>   in handy if one only wants to alter the destination port of incoming
>   traffic on different interfaces.

That explicitly breaks compatibility with iptables backend. Discussing
nftables behavior is out of scope on this list, but then firewalld
should not use nft redirect because its semantic is different from
iptables DNAT. Quoting iptables-extensions DNAT man page

If no IP address is specified then *only the destination port will be modified*.

I would say it is a bug in firewalld. It should be using something
different. Apparently nftables dnat requires destination IP, the only
way to rewrite port without changing destination (as DNAT iptables
did) is

nft add rule raw prerouting tcp dport 8080 tcp dport set 80

If it is not feasible, then this needs a big read warning in manual
and release notes.

Explanation how "destination address of the local host" is determined
in case of multiple addresses would not hurt as well.
> > As a workaround, I forced it with to-addr
> >
> > Hamado Dene
> >
> > Il mercoledì 30 ottobre 2024 alle ore 12:07:34 CET, Andrei Borzenkov via firewalld-users  ha scritto:
> >
> > On Wed, Oct 30, 2024 at 1:53 PM Hamado Dene  wrote:
> > > Yet, it makes sense. But, ff to-addr is not specified, how is it decided which IP on the interface the request is forwarded to
> >
> > Destination address in packets is not changed, so whatever destination
> > address this packet has.
> > > (considering the interface has multiple IP addresses)?
> > >
> > > Hamado Dene
> > >
> > > Il mercoledì 30 ottobre 2024 alle ore 11:35:29 CET, Andrei Borzenkov via firewalld-users  ha scritto:
> > >
> > > On Wed, Oct 30, 2024 at 1:09 PM Hamado Dene via firewalld-users
> > >  wrote:
> > > > Hello firewalld Community,
> > > >
> > > > I'm trying to understand how the to-addr feature works in firewalld. I haven’t found much information in the documentation. We use RHEL 9 and have firewalld version 1.2.1. We have an interface with a primary IP and other secondary IPs. The scenario is as follows:
> > > >
> > > > ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
> > > >     link/ether 50:6b:8d:d8:2d:84 brd ff:ff:ff:ff:ff:ff
> > > >     altname enp0s3
> > > >     inet 10.104.112.5/24 brd 10.104.112.255 scope global noprefixroute ens3
> > > >         valid_lft forever preferred_lft forever
> > > >     inet 10.104.112.8/32 brd 10.104.112.255 scope global ens3
> > > >         valid_lft forever preferred_lft forever
> > > >
> > > > 10.104.112.5 is the machine's primary IP, while 10.104.112.8 is a floating IP managed by Pacemaker.
> > > >
> > > > We tried adding a rule like this:
> > > >
> > > > rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
> > > >
> > > > By doing this, we noticed that the request is always forwarded to the machine’s primary IP, i.e., 10.104.112.5. However, I expected it to be forwarded to the IP 10.104.112.9.
> > >
> > > "destination address" is used to match packets to which rule is
> > > applied, not to set address to forward packets to.
> > > > How is the IP to forward the request to actually decided? The only way I see to force it to 10.104.112.9 is by specifying to-addr=10.104.112.9.
> > > >
> > > > In CentOS 7 with firewalld version 0.6, by specifying only the rule:
> > > >
> > > > rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
> > > >
> > > > without specifying to-addr, the request is correctly forwarded to IP 10.104.112.9.
> > > >
> > > > Could anyone provide me with more information?
> > > >
> > > > Thanks in advance.
> > > > Hamado Dene
> > > >
> > > > firewalld-users mailing list -- [e-mail]
> > > > To unsubscribe send an email to [e-mail]
> > > > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > > List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> > > > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
> > >
> > > --
> > > _______________________________________________
> > > firewalld-users mailing list -- [e-mail]
> > > To unsubscribe send an email to [e-mail]
> > > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> > > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
> >
> > --
> > _______________________________________________
> > firewalld-users mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
> > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
> > --
> > _______________________________________________
> > firewalld-users mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
> > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

[Eric Garver]

On Wed, Oct 30, 2024 at 01:29:27PM +0000, Hamado Dene wrote:
> I agree with Andrei... The most logical thing, in my opinion, would be to add a warning to the documentation that specifies this behavior so that users are aware of it.
>
> I am new to this mailing list. In this case, how do we proceed? Should we open an issue on GitHub or start a thread on the dev mailing list to address this case?

Please open an issue on github. We can discuss and make a decision
there.
> Hamado Dene
> Il mercoledì 30 ottobre 2024 alle ore 13:59:52 CET, Andrei Borzenkov via firewalld-users <[e-mail]> ha scritto:  
>
> On Wed, Oct 30, 2024 at 2:51 PM Eric Garver  wrote:
> > On Wed, Oct 30, 2024 at 11:33:50AM +0000, Hamado Dene via firewalld-users wrote:
> > > > From the tests I've done, with destination 10.104.112.8, the packet was routed through the primary IP 10.104.112.5.
> > >
> > > The same rule without to-addr on CentOS 7 with firewalld 0.6 is not forwarded correctly, while in version 1.2.1 it isn’t. I'll try to debug further.
> >
> > Without "to-addr" the packet will be redirected to the local host. It
> > will not be forwarded.
> >
> > Quoting the nft man page:
> >
> > The redirect statement is a special form of dnat which always
> >   translates the destination address to the local host’s one. It comes
> >   in handy if one only wants to alter the destination port of incoming
> >   traffic on different interfaces.
>
> That explicitly breaks compatibility with iptables backend. Discussing
> nftables behavior is out of scope on this list, but then firewalld
> should not use nft redirect because its semantic is different from
> iptables DNAT. Quoting iptables-extensions DNAT man page
>
> If no IP address is specified then *only the destination port will be modified*.
>
> I would say it is a bug in firewalld. It should be using something
> different. Apparently nftables dnat requires destination IP, the only
> way to rewrite port without changing destination (as DNAT iptables
> did) is
>
> nft add rule raw prerouting tcp dport 8080 tcp dport set 80
>
> If it is not feasible, then this needs a big read warning in manual
> and release notes.
>
> Explanation how "destination address of the local host" is determined
> in case of multiple addresses would not hurt as well.
> > > As a workaround, I forced it with to-addr
> > >
> > > Hamado Dene
> > >
> > > Il mercoledì 30 ottobre 2024 alle ore 12:07:34 CET, Andrei Borzenkov via firewalld-users  ha scritto:
> > >
> > > On Wed, Oct 30, 2024 at 1:53 PM Hamado Dene  wrote:
> > > > Yet, it makes sense. But, ff to-addr is not specified, how is it decided which IP on the interface the request is forwarded to
> > >
> > > Destination address in packets is not changed, so whatever destination
> > > address this packet has.
> > > > (considering the interface has multiple IP addresses)?
> > > >
> > > > Hamado Dene
> > > >
> > > > Il mercoledì 30 ottobre 2024 alle ore 11:35:29 CET, Andrei Borzenkov via firewalld-users  ha scritto:
> > > >
> > > > On Wed, Oct 30, 2024 at 1:09 PM Hamado Dene via firewalld-users
> > > >  wrote:
> > > > > Hello firewalld Community,
> > > > >
> > > > > I'm trying to understand how the to-addr feature works in firewalld. I haven’t found much information in the documentation. We use RHEL 9 and have firewalld version 1.2.1. We have an interface with a primary IP and other secondary IPs. The scenario is as follows:
> > > > >
> > > > > ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
> > > > >     link/ether 50:6b:8d:d8:2d:84 brd ff:ff:ff:ff:ff:ff
> > > > >     altname enp0s3
> > > > >     inet 10.104.112.5/24 brd 10.104.112.255 scope global noprefixroute ens3
> > > > >         valid_lft forever preferred_lft forever
> > > > >     inet 10.104.112.8/32 brd 10.104.112.255 scope global ens3
> > > > >         valid_lft forever preferred_lft forever
> > > > >
> > > > > 10.104.112.5 is the machine's primary IP, while 10.104.112.8 is a floating IP managed by Pacemaker.
> > > > >
> > > > > We tried adding a rule like this:
> > > > >
> > > > > rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
> > > > >
> > > > > By doing this, we noticed that the request is always forwarded to the machine’s primary IP, i.e., 10.104.112.5. However, I expected it to be forwarded to the IP 10.104.112.9.
> > > >
> > > > "destination address" is used to match packets to which rule is
> > > > applied, not to set address to forward packets to.
> > > > > How is the IP to forward the request to actually decided? The only way I see to force it to 10.104.112.9 is by specifying to-addr=10.104.112.9.
> > > > >
> > > > > In CentOS 7 with firewalld version 0.6, by specifying only the rule:
> > > > >
> > > > > rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
> > > > >
> > > > > without specifying to-addr, the request is correctly forwarded to IP 10.104.112.9.
> > > > >
> > > > > Could anyone provide me with more information?
> > > > >
> > > > > Thanks in advance.
> > > > > Hamado Dene
> > > > >
> > > > > firewalld-users mailing list -- [e-mail]
> > > > > To unsubscribe send an email to [e-mail]
> > > > > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > > > List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> > > > > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
> > > >
> > > > --
> > > > _______________________________________________
> > > > firewalld-users mailing list -- [e-mail]
> > > > To unsubscribe send an email to [e-mail]
> > > > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > > List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> > > > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
> > >
> > > --
> > > _______________________________________________
> > > firewalld-users mailing list -- [e-mail]
> > > To unsubscribe send an email to [e-mail]
> > > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> > > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
> > > --
> > > _______________________________________________
> > > firewalld-users mailing list -- [e-mail]
> > > To unsubscribe send an email to [e-mail]
> > > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> > > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
>
> -- 
> _______________________________________________
> firewalld-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

[Hamado Dene]

I open issue github.com/firewalld/firewalld/issues/1413

Thanks,

Hamado Dene

Il mercoledì 30 ottobre 2024 alle ore 17:55:29 CET, Eric Garver via firewalld-users  ha scritto:

On Wed, Oct 30, 2024 at 01:29:27PM +0000, Hamado Dene wrote:
> I agree with Andrei... The most logical thing, in my opinion, would be to add a warning to the documentation that specifies this behavior so that users are aware of it.
>
> I am new to this mailing list. In this case, how do we proceed? Should we open an issue on GitHub or start a thread on the dev mailing list to address this case?

Please open an issue on github. We can discuss and make a decision
there.
> Hamado Dene
>
> Il mercoledì 30 ottobre 2024 alle ore 13:59:52 CET, Andrei Borzenkov via firewalld-users  ha scritto:  
>   
>   On Wed, Oct 30, 2024 at 2:51 PM Eric Garver  wrote:
> > On Wed, Oct 30, 2024 at 11:33:50AM +0000, Hamado Dene via firewalld-users wrote:
> > > > From the tests I've done, with destination 10.104.112.8, the packet was routed through the primary IP 10.104.112.5.
> > >
> > > The same rule without to-addr on CentOS 7 with firewalld 0.6 is not forwarded correctly, while in version 1.2.1 it isn’t. I'll try to debug further.
> >
> > Without "to-addr" the packet will be redirected to the local host. It
> > will not be forwarded.
> >
> > Quoting the nft man page:
> >
> > The redirect statement is a special form of dnat which always
> >   translates the destination address to the local host’s one. It comes
> >   in handy if one only wants to alter the destination port of incoming
> >   traffic on different interfaces.
>
> That explicitly breaks compatibility with iptables backend. Discussing
> nftables behavior is out of scope on this list, but then firewalld
> should not use nft redirect because its semantic is different from
> iptables DNAT. Quoting iptables-extensions DNAT man page
>
> If no IP address is specified then *only the destination port will be modified*.
>
> I would say it is a bug in firewalld. It should be using something
> different. Apparently nftables dnat requires destination IP, the only
> way to rewrite port without changing destination (as DNAT iptables
> did) is
>
> nft add rule raw prerouting tcp dport 8080 tcp dport set 80
>
> If it is not feasible, then this needs a big read warning in manual
> and release notes.
>
> Explanation how "destination address of the local host" is determined
> in case of multiple addresses would not hurt as well.
> > > As a workaround, I forced it with to-addr
> > >
> > > Hamado Dene
> > >
> > > Il mercoledì 30 ottobre 2024 alle ore 12:07:34 CET, Andrei Borzenkov via firewalld-users  ha scritto:
> > >
> > > On Wed, Oct 30, 2024 at 1:53 PM Hamado Dene  wrote:
> > > > Yet, it makes sense. But, ff to-addr is not specified, how is it decided which IP on the interface the request is forwarded to
> > >
> > > Destination address in packets is not changed, so whatever destination
> > > address this packet has.
> > > > (considering the interface has multiple IP addresses)?
> > > >
> > > > Hamado Dene
> > > >
> > > > Il mercoledì 30 ottobre 2024 alle ore 11:35:29 CET, Andrei Borzenkov via firewalld-users  ha scritto:
> > > >
> > > > On Wed, Oct 30, 2024 at 1:09 PM Hamado Dene via firewalld-users
> > > >  wrote:
> > > > > Hello firewalld Community,
> > > > >
> > > > > I'm trying to understand how the to-addr feature works in firewalld. I haven’t found much information in the documentation. We use RHEL 9 and have firewalld version 1.2.1. We have an interface with a primary IP and other secondary IPs. The scenario is as follows:
> > > > >
> > > > > ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
> > > > >     link/ether 50:6b:8d:d8:2d:84 brd ff:ff:ff:ff:ff:ff
> > > > >     altname enp0s3
> > > > >     inet 10.104.112.5/24 brd 10.104.112.255 scope global noprefixroute ens3
> > > > >         valid_lft forever preferred_lft forever
> > > > >     inet 10.104.112.8/32 brd 10.104.112.255 scope global ens3
> > > > >         valid_lft forever preferred_lft forever
> > > > >
> > > > > 10.104.112.5 is the machine's primary IP, while 10.104.112.8 is a floating IP managed by Pacemaker.
> > > > >
> > > > > We tried adding a rule like this:
> > > > >
> > > > > rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
> > > > >
> > > > > By doing this, we noticed that the request is always forwarded to the machine’s primary IP, i.e., 10.104.112.5. However, I expected it to be forwarded to the IP 10.104.112.9.
> > > >
> > > > "destination address" is used to match packets to which rule is
> > > > applied, not to set address to forward packets to.
> > > > > How is the IP to forward the request to actually decided? The only way I see to force it to 10.104.112.9 is by specifying to-addr=10.104.112.9.
> > > > >
> > > > > In CentOS 7 with firewalld version 0.6, by specifying only the rule:
> > > > >
> > > > > rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
> > > > >
> > > > > without specifying to-addr, the request is correctly forwarded to IP 10.104.112.9.
> > > > >
> > > > > Could anyone provide me with more information?
> > > > >
> > > > > Thanks in advance.
> > > > > Hamado Dene
> > > > >
> > > > > firewalld-users mailing list -- [e-mail]
> > > > > To unsubscribe send an email to [e-mail]
> > > > > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > > > List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> > > > > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
> > > >
> > > > --
> > > > _______________________________________________
> > > > firewalld-users mailing list -- [e-mail]
> > > > To unsubscribe send an email to [e-mail]
> > > > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > > List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> > > > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
> > >
> > > --
> > > _______________________________________________
> > > firewalld-users mailing list -- [e-mail]
> > > To unsubscribe send an email to [e-mail]
> > > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> > > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
> > > --
> > > _______________________________________________
> > > firewalld-users mailing list -- [e-mail]
> > > To unsubscribe send an email to [e-mail]
> > > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> > > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
>
> -- 
> _______________________________________________
> firewalld-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

[Eric Garver]

On Wed, Oct 30, 2024 at 03:59:31PM +0300, Andrei Borzenkov wrote:
> On Wed, Oct 30, 2024 at 2:51 PM Eric Garver  wrote:
> > On Wed, Oct 30, 2024 at 11:33:50AM +0000, Hamado Dene via firewalld-users wrote:
> > > > From the tests I've done, with destination 10.104.112.8, the packet was routed through the primary IP 10.104.112.5.
> > >
> > > The same rule without to-addr on CentOS 7 with firewalld 0.6 is not forwarded correctly, while in version 1.2.1 it isn’t. I'll try to debug further.
> >
> > Without "to-addr" the packet will be redirected to the local host. It
> > will not be forwarded.
> >
> > Quoting the nft man page:
> >
> > The redirect statement is a special form of dnat which always
> >   translates the destination address to the local host’s one. It comes
> >   in handy if one only wants to alter the destination port of incoming
> >   traffic on different interfaces.
>
> That explicitly breaks compatibility with iptables backend. Discussing
> nftables behavior is out of scope on this list, but then firewalld
> should not use nft redirect because its semantic is different from
> iptables DNAT. Quoting iptables-extensions DNAT man page

That presumes firewalld wants to behave like iptables. The iptables
backend is deprecated so matching the behavior of the iptables backend
is not necessary.

The question should be: what behavior do we want?

Then we need to document it better.
> If no IP address is specified then *only the destination port will be modified*.
>
> I would say it is a bug in firewalld. It should be using something
> different. Apparently nftables dnat requires destination IP, the only
> way to rewrite port without changing destination (as DNAT iptables
> did) is
>
> nft add rule raw prerouting tcp dport 8080 tcp dport set 80
>
> If it is not feasible, then this needs a big read warning in manual
> and release notes.
>
> Explanation how "destination address of the local host" is determined
> in case of multiple addresses would not hurt as well.
> > > As a workaround, I forced it with to-addr
> > >
> > > Hamado Dene
> > > Il mercoledì 30 ottobre 2024 alle ore 12:07:34 CET, Andrei Borzenkov via firewalld-users <[e-mail]> ha scritto:
> > >
> > > On Wed, Oct 30, 2024 at 1:53 PM Hamado Dene  wrote:
> > > > Yet, it makes sense. But, ff to-addr is not specified, how is it decided which IP on the interface the request is forwarded to
> > >
> > > Destination address in packets is not changed, so whatever destination
> > > address this packet has.
> > > > (considering the interface has multiple IP addresses)?
> > > >
> > > > Hamado Dene
> > > >
> > > > Il mercoledì 30 ottobre 2024 alle ore 11:35:29 CET, Andrei Borzenkov via firewalld-users  ha scritto:
> > > >
> > > > On Wed, Oct 30, 2024 at 1:09 PM Hamado Dene via firewalld-users
> > > >  wrote:
> > > > > Hello firewalld Community,
> > > > >
> > > > > I'm trying to understand how the to-addr feature works in firewalld. I haven’t found much information in the documentation. We use RHEL 9 and have firewalld version 1.2.1. We have an interface with a primary IP and other secondary IPs. The scenario is as follows:
> > > > >
> > > > > ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
> > > > >    link/ether 50:6b:8d:d8:2d:84 brd ff:ff:ff:ff:ff:ff
> > > > >    altname enp0s3
> > > > >    inet 10.104.112.5/24 brd 10.104.112.255 scope global noprefixroute ens3
> > > > >        valid_lft forever preferred_lft forever
> > > > >    inet 10.104.112.8/32 brd 10.104.112.255 scope global ens3
> > > > >        valid_lft forever preferred_lft forever
> > > > >
> > > > > 10.104.112.5 is the machine's primary IP, while 10.104.112.8 is a floating IP managed by Pacemaker.
> > > > >
> > > > > We tried adding a rule like this:
> > > > >
> > > > > rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
> > > > >
> > > > > By doing this, we noticed that the request is always forwarded to the machine’s primary IP, i.e., 10.104.112.5. However, I expected it to be forwarded to the IP 10.104.112.9.
> > > >
> > > > "destination address" is used to match packets to which rule is
> > > > applied, not to set address to forward packets to.
> > > > > How is the IP to forward the request to actually decided? The only way I see to force it to 10.104.112.9 is by specifying to-addr=10.104.112.9.
> > > > >
> > > > > In CentOS 7 with firewalld version 0.6, by specifying only the rule:
> > > > >
> > > > > rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
> > > > >
> > > > > without specifying to-addr, the request is correctly forwarded to IP 10.104.112.9.
> > > > >
> > > > > Could anyone provide me with more information?
> > > > >
> > > > > Thanks in advance.
> > > > > Hamado Dene
> > > > >
> > > > > firewalld-users mailing list -- [e-mail]
> > > > > To unsubscribe send an email to [e-mail]
> > > > > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > > > List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> > > > > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
> > > >
> > > > --
> > > > _______________________________________________
> > > > firewalld-users mailing list -- [e-mail]
> > > > To unsubscribe send an email to [e-mail]
> > > > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > > List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> > > > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
> > >
> > > --
> > > _______________________________________________
> > > firewalld-users mailing list -- [e-mail]
> > > To unsubscribe send an email to [e-mail]
> > > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> > > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
> > > --
> > > _______________________________________________
> > > firewalld-users mailing list -- [e-mail]
> > > To unsubscribe send an email to [e-mail]
> > > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> > > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue