What is the purpose of "default" target option of zone firewalld.

[Mihail Pol]

Hello team!

Documentation say https://firewalld.org/documentation/zone/options.html that firewalld zone has option "target" with possible values:
ACCEPT|%%REJECT%%|DROP

The ACCEPT target is used in trusted zone to accept every packet not matching any rule. 
The %%REJECT%% target is used in block zone to reject (with default firewalld reject type) every packet not matching any rule.
The DROP target is used in drop zone to drop every packet not matching any rule.

But firewall-cmd --list-all-zones give me a option "default" for target for some zones. What target "default" mean?

[Eric Garver]

On Wed, Jan 29, 2020 at 07:29:10PM -0000, Mihail Pol wrote:
> Hello team!
>
> Documentation say https://firewalld.org/documentation/zone/options.html that firewalld zone has option "target" with possible values:
> ACCEPT|%%REJECT%%|DROP
>
> The ACCEPT target is used in trusted zone to accept every packet not matching any rule. 
> The %%REJECT%% target is used in block zone to reject (with default firewalld reject type) every packet not matching any rule.
> The DROP target is used in drop zone to drop every packet not matching any rule.
>
> But firewall-cmd --list-all-zones give me a option "default" for target for some zones. What target "default" mean?

In most cases "default" can be thought equivalent to %%REJECT%%. That
being said there are a couple scenarios where it behaves differently.

1) source-based zone fall-though/drift to interface-based zones

- This is known as "zone drifting"
  - If a packet ingress (INPUT) a source-based zone, it may still enter
    an interface-based zone (including the default zone)

2) For FORWARD traffic, packets that ingress a zone with a "default"
   target will be allowed based on the target of the egress zone.

A forwarded packet that ingresses zoneA and egresses zoneB.

- if zoneA target is "ACCEPT", "DROP", or "%%REJECT%%" the packet
       accepted, dropped, or rejected repectively.
     - if zoneA target is "default", then the packet is
       accepted/dropped/rejected based on zoneB's target.

Hope the above helps.

Eric.