No connectivity after changing default TARGET

[Jorge Fábregas]

Hi,

I'm running 0.3.9.1 (Fedora 20) with the default "public" zone.  I'm
not
running any special rules (riched rules).  The only customization I did
to the default zone is to remove "mdns" and two or three more services
that come enabled out of the box.

Now, when I use firewall-config to modify the public zone:

- switch to permanent
- change the default target to DROP
- perform a firewalld reload

...I loose all connectivity. When I run "iptables -v -L -n" I see all
counters showing 0 packets/bytes.  I do notice the DROP lines in their
respective *public" chains (as it should after the change).  That is, if
you take a look at the iptables rules they all make sense (they should
work) but somehow, after changing the default target to DROP, it seems
packet aren't reaching netfilter at all.

Thanks,
Jorge

[Jorge Fábregas]

On 01/17/2014 01:54 PM, Jorge Fábregas wrote:
>   When I run "iptables -v -L -n" I see all counters showing
> 0 packets/bytes 
My mistake.  All counters show 0 except the OUTPUT chain that increases
after I perform some tests like pinging my gateway etc.  That's the only
place I see the counter increasing (OUTPUT chain).  The rule for
RELATED, ESTABLISHED connections is not being hit and the strange thing
is that I don't even see the final DROP counter increasing.

-- 
Jorge

[Jorge Fábregas]

On 01/17/2014 02:36 PM, Jorge Fábregas wrote:
>  The rule for RELATED, ESTABLISHED connections is not being hit and
>  the strange thing is that I don't even see the final DROP counter increasing. 
Ok, I found the root of the problem.  I had to remind myself that the
*filter* table is not the only one around...

I performed a comparisson of the *mangle* table before & after changing
the default target.  Here's where returning packets are being dropped
(after I source any new connection):

*mangle* chains following:
PREROUTING
..PREROUTING_ZONES
....PRE_public
........packets diverted to 3 more custom-chains
........DROP (dropped here as the last 3 chains have no rules)


This is definitely a bug, isn't it?

-- 
Jorge

[Jorge Fábregas]

I opened the bug report:

https://bugzilla.redhat.com/show_bug.cgi?id=1055190

-- 
Jorge