ICMP echo working but still getting a block message in log

[Koen Drai]

Hi,

I am running into a firewalld behavior again that I cannot understand.

Running firewalld on a Debian 11 box.

The zone file contains the following:

<icmp-block-inversion/>
   <icmp-block name="echo-reply"/>
   <icmp-block name="echo-request"/>

A ping from a client results in a reply, but I am still getting the following error message in syslog:

"filter_zone_knet_HOST_ICMP_BLOCK: "IN=enp2s0 OUT= MAC=<ANOM> SRC=192.168.1.9 DST=192.168.1.1 LEN=60 TOS=0x00 PREC=0x00 TTL=128 ID=56385 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=509

What's happening?

Thanks for your help and best regards,

Koen

[Kenneth Porter]

On 2/8/2022 2:27 PM, Koen Drai wrote:
> I am still getting the following error message in syslog:
>
> "filter_zone_knet_HOST_ICMP_BLOCK: "IN=enp2s0 OUT= MAC=<ANOM> 
> SRC=192.168.1.9 DST=192.168.1.1 LEN=60 TOS=0x00 PREC=0x00 TTL=128 
> ID=56385 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=509

Can you dump the whole nftables rule list to a pastebin and post the 
link here?

[R C]

On 2/8/22 20:26, Kenneth Porter wrote:
> On 2/8/2022 2:27 PM, Koen Drai wrote:
> > I am still getting the following error message in syslog:
> >
> > "filter_zone_knet_HOST_ICMP_BLOCK: "IN=enp2s0 OUT= MAC=<ANOM> 
> > SRC=192.168.1.9 DST=192.168.1.1 LEN=60 TOS=0x00 PREC=0x00 TTL=128 
> > ID=56385 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=509
>
> Can you dump the whole nftables rule list to a pastebin and post the 
> link here?

when I was talking to rhel support (different issues), I was told there 
are some (serious) issues with netfilters, and they advised me to use 
iptables instead for now.  You can change that in the firewall setup
> firewalld-users mailing list -- [e-mail]
> To unsubscribe send an email to 
> [e-mail]
> Fedora Code of Conduct: 
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: 
> https://lists.fedorahosted.org/archives/list/[e-mail]...
> Do not reply to spam on the list, report it: 
> https://pagure.io/fedora-infrastructure

[Eric Garver]

On Tue, Feb 08, 2022 at 09:02:34PM -0700, R C wrote:
> On 2/8/22 20:26, Kenneth Porter wrote:
> > On 2/8/2022 2:27 PM, Koen Drai wrote:
> > > I am still getting the following error message in syslog:
> > >
> > > "filter_zone_knet_HOST_ICMP_BLOCK: "IN=enp2s0 OUT= MAC=<ANOM>
> > > SRC=192.168.1.9 DST=192.168.1.1 LEN=60 TOS=0x00 PREC=0x00 TTL=128
> > > ID=56385 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=509
> >
> > Can you dump the whole nftables rule list to a pastebin and post the
> > link here?
>
> when I was talking to rhel support (different issues), I was told there are
> some (serious) issues with netfilters, and they advised me to use iptables
> instead for now.  You can change that in the firewall setup

I assure you this is a misunderstanding. This statement does not make
sense as iptables is part of netfilter.

netfilter is the umbrella term for all of Linux kernel packet filter,
mangling, connection tracking, etc.

Netfilter includes (non-exhaustive list):

- iptables
  - nftables
  - ebtables
  - arptables
  - ipset
  - conntrack

[Eric Garver]

On Tue, Feb 08, 2022 at 11:27:57PM +0100, Koen Drai wrote:
> Hi,
>
> I am running into a firewalld behavior again that I cannot understand.
>
> Running firewalld on a Debian 11 box.
>
> The zone file contains the following:
>
>   <icmp-block-inversion/>
>   <icmp-block name="echo-reply"/>
>   <icmp-block name="echo-request"/>
>
> A ping from a client results in a reply, but I am still getting the following error message in syslog:
>
> "filter_zone_knet_HOST_ICMP_BLOCK: "IN=enp2s0 OUT= MAC=<ANOM> SRC=192.168.1.9 DST=192.168.1.1 LEN=60 TOS=0x00 PREC=0x00 TTL=128 ID=56385 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=509
>
> What's happening?

This has been fixed.

https://github.com/firewalld/firewalld/issues/696

Fixed in: v0.9.5, v1.0.2