FirewallD allows all port

[Chintan Mishra from Rebhu]

All ingress, egress traffic are allowed to an AWS EC2 using Security Groups.

The goal is to manage traffic and ports using FirewallD.

I have only allowed certain ports in FirewallD, but I can access 
services that belong outside the open ports.

Here is the output of publicly accessible services:

$ nmap -Pn <my-ip>
Host discovery disabled (-Pn). All addresses will be marked 'up' and 
scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2022-10-16 17:58 UTC
Nmap scan report for ec2-<my-ip>.*.compute.amazonaws.com (<my-ip>)
Host is up (0.57s latency).
Not shown: 992 filtered ports
PORT      STATE SERVICE
22/tcp    open  ssh
5432/tcp  open  postgresql
8080/tcp  open  http-proxy
8081/tcp  open  blackice-icecap
8082/tcp  open  blackice-alerts
8083/tcp  open  us-srv
9090/tcp  open  zeus-admin
50000/tcp open  ibm-db2

And, here is the output for services and ports opened with FirewallD

$ sudo firewall-cmd --list-all
public (active)
   target: default
   icmp-block-inversion: no
   interfaces: eth0
   sources:
   services: cockpit dhcpv6-client ssh
   ports: 8080/tcp 8081/tcp 50000/tcp 8082/tcp 9980/tcp
   protocols:
   forward: yes
   masquerade: no
   forward-ports:
   source-ports:
   icmp-blocks:
   rich rules:

_*What is missing in this setup to prevent access to port 8083 from 
public internet to the EC2 instance?*_

Thank you.

--
Chintan Mishra

[Chintan Mishra from Rebhu]

After reading more on the topic, it appears that this is a feature of 
running podman and FirewallD together.

`podman` instructs FirewallD to allow the ports whenever `podman run` 
command specifies a port binding with the host.

Thank you.

--
Chintan Mishra

On 16/10/22 23:51, Chintan Mishra from Rebhu wrote:
>  All ingress, egress traffic are allowed to an AWS EC2 using Security 
>  Groups.
>
>  The goal is to manage traffic and ports using FirewallD.
>
>  I have only allowed certain ports in FirewallD, but I can access 
>  services that belong outside the open ports.
>
>  Here is the output of publicly accessible services:
>
>  $ nmap -Pn <my-ip>
>  Host discovery disabled (-Pn). All addresses will be marked 'up' and 
>  scan times will be slower.
>  Starting Nmap 7.91 ( https://nmap.org ) at 2022-10-16 17:58 UTC
>  Nmap scan report for ec2-<my-ip>.*.compute.amazonaws.com (<my-ip>)
>  Host is up (0.57s latency).
>  Not shown: 992 filtered ports
>  PORT      STATE SERVICE
>  22/tcp    open  ssh
>  5432/tcp  open  postgresql
>  8080/tcp  open  http-proxy
>  8081/tcp  open  blackice-icecap
>  8082/tcp  open  blackice-alerts
>  8083/tcp  open  us-srv
>  9090/tcp  open  zeus-admin
>  50000/tcp open  ibm-db2
>
>  And, here is the output for services and ports opened with FirewallD
>
>  $ sudo firewall-cmd --list-all
>  public (active)
>    target: default
>    icmp-block-inversion: no
>    interfaces: eth0
>    sources:
>    services: cockpit dhcpv6-client ssh
>    ports: 8080/tcp 8081/tcp 50000/tcp 8082/tcp 9980/tcp
>    protocols:
>    forward: yes
>    masquerade: no
>    forward-ports:
>    source-ports:
>    icmp-blocks:
>    rich rules:
>
>  _*What is missing in this setup to prevent access to port 8083 from 
>  public internet to the EC2 instance?*_
>
>  Thank you.
>
>  --
>  Chintan Mishra
>
>  _______________________________________________
>  firewalld-users mailing list --firewalld-users(a)lists.fedorahosted.org
>  To unsubscribe send an email tofirewalld-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct:https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines:https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List
> Archives:https://lists.fedorahosted.org/archives/list/firewalld-users@lis...
>  Do not reply to spam, report it:https://pagure.io/fedora-infrastructure/new_issue

[Eric Garver]

You are correct. podman and docker open the port for all interfaces. You
need to specify the host's listening address if you want to limit the
DNAT. e.g. '-p <host_addr>:<host_port>:<container_port>'

See this bug for discussion:
https://github.com/firewalld/firewalld/issues/869

On Mon, Oct 17, 2022 at 12:08:13AM +0530, Chintan Mishra from Rebhu wrote:
>  After reading more on the topic, it appears that this is a feature
> of
>  running podman and FirewallD together.
>  
>  `podman` instructs FirewallD to allow the ports whenever `podman run`
>  command specifies a port binding with the host.
>  
>  Thank you.
>  
>  --
>  Chintan Mishra
>  
>  On 16/10/22 23:51, Chintan Mishra from Rebhu wrote:
>  > 
>  > All ingress, egress traffic are allowed to an AWS EC2 using Security
>  > Groups.
>  > 
>  > The goal is to manage traffic and ports using FirewallD.
>  > 
>  > I have only allowed certain ports in FirewallD, but I can access
>  > services that belong outside the open ports.
>  > 
>  > Here is the output of publicly accessible services:
>  > 
>  > $ nmap -Pn <my-ip>
>  > Host discovery disabled (-Pn). All addresses will be marked 'up' and
>  > scan times will be slower.
>  > Starting Nmap 7.91 ( https://nmap.org ) at 2022-10-16 17:58 UTC
>  > Nmap scan report for ec2-<my-ip>.*.compute.amazonaws.com (<my-ip>)
>  > Host is up (0.57s latency).
>  > Not shown: 992 filtered ports
>  > PORT      STATE SERVICE
>  > 22/tcp    open  ssh
>  > 5432/tcp  open  postgresql
>  > 8080/tcp  open  http-proxy
>  > 8081/tcp  open  blackice-icecap
>  > 8082/tcp  open  blackice-alerts
>  > 8083/tcp  open  us-srv
>  > 9090/tcp  open  zeus-admin
>  > 50000/tcp open  ibm-db2
>  > 
>  > And, here is the output for services and ports opened with FirewallD
>  > 
>  > $ sudo firewall-cmd --list-all
>  > public (active)
>  >   target: default
>  >   icmp-block-inversion: no
>  >   interfaces: eth0
>  >   sources:
>  >   services: cockpit dhcpv6-client ssh
>  >   ports: 8080/tcp 8081/tcp 50000/tcp 8082/tcp 9980/tcp
>  >   protocols:
>  >   forward: yes
>  >   masquerade: no
>  >   forward-ports:
>  >   source-ports:
>  >   icmp-blocks:
>  >   rich rules:
>  > 
>  > _*What is missing in this setup to prevent access to port 8083 from
>  > public internet to the EC2 instance?*_
>  > 
>  > Thank you.
>  > 
>  > --
>  > Chintan Mishra
>  > 
>  > _______________________________________________
>  > firewalld-users mailing list --firewalld-users(a)lists.fedorahosted.org
>  > To unsubscribe send an email tofirewalld-users-leave(a)lists.fedorahosted.org
>  > Fedora Code of
> Conduct:https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  > List Guidelines:https://fedoraproject.org/wiki/Mailing_list_guidelines
>  > List
> Archives:https://lists.fedorahosted.org/archives/list/firewalld-users@lis...
>  > Do not reply to spam, report it:https://pagure.io/fedora-infrastructure/new_issue
>  _______________________________________________
>  firewalld-users mailing list -- firewalld-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to firewalld-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>  Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue