1:07 p.m.
Firewalld is just not workable enough for me. For instance I need to have quirky
netfilter rules to make my squid proxy setup to work properly. There is no easy way to do
this with firewalld. Also I set up an iptables queue so that netfilter supports suricata
ips mode. This also, no easy way...
Netfilter is just so diverse and firewalld seems to strip a lot of that diversity away.
What about the idea that people who want to write their own iptables custom scripts that
can be, after wiriting the script and implementening it, a smart way for the script to be
imported...the whole script, into firewalld. Last I tried, my nat rules weren't
compatible with firewalld. Like maybe a simpe iptables-save then a firewalld-save or the
like. Then maybe ask if to import it into firewalld's 'home', 'work',
'public', etc.
Lance
Kurt Seifried <kseifried(a)redhat.com> wrote:
>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>Some random thoughts:
>
>1) it would be nice to have capabilities like "do you want to let
>program X talk to the internet/receive connections" for client
>software with a GUI notification (like basically all the windows
>client/Mac OS X client firewall stuff). I would say this is probably
>the biggest capability needed for normal end users.
>
>2) Tying firewall into networking detection, e.g. windows "is this
>your home/business/public network" and then remembering it (I assume
>IP/Mac address of default gateway would be a reasonably good way to
>identify networks).
>
>3) Make it easy to modify policy, e.g. in section 1) if you choose to
>block/deny something and realize that was the wrong decision how do
>you go in an modify it? In Windows this is a PITA for normal users.
>
>Overall I'm not really sure firewalld solves much, anyone running a
>server will probably be able to tweak iptables to allow incoming
>services they want. So do we aim it at the end user/workstation style
>usage primarily (especially ones that move around networks)?
>
>- --
>Kurt Seifried Red Hat Security Response Team (SRT)
>PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
>-----BEGIN PGP SIGNATURE-----
>Version: GnuPG v1.4.14 (GNU/Linux)
>
>iQIcBAEBAgAGBQJSQdXYAAoJEBYNRVNeJnmTC6wQAIW3HNlAqfSkMSZqbFG6kbj/
>GOlnzjJOrUzt/LWwOGPCTmg/GgSOHrT4t1gT1577sL2LM5wPGCF/oll84RehiZd8
>PXNiyq3QnsOJFLjmEbm1YfGpDGae5+uR4IR3Bm1MVHBjvquhlqaje0b1yI2gs8Do
>LY9sXeGmYh+YjKIUDJrOCCS/I/xE8Zl4D+aU/s1BumV9LxwsOURTzXv5x32C8zwS
>5MH5rvX9LO5vJn0VMByRsoXrCSybyLnRmsDvAH9yYx+WjforKsU4wq2QVLYDtjU/
>0TO/n7qP1WO7doixYLymxwm+Fnk8J7HGa2t/2of2ZvX2AB3eRLmzj+tKzKohZR4H
>jxCLImHLx/puPr6VA/4ENSrHltCCbTSDvlZGxTHAeHwszmQzYMXZ8Qv/leRf4ThO
>E3wvuoIpgUWSEbE8RjVmXjX/Cd1GYz6ns35ydy2kZgHr4AfQifF+hdWHPP63/hrJ
>C21iZylvIMJKF2cWOXwR4X+Zr9tDthf+UDeEE3J/uQAfj3LDvjdHXqd0xcgOSrae
>nP0hPHj0apZrzY0zJfcn3JNipRDDl3qNgs8Q8tFAut5WvubCdLlVFXvLWMs6mOA2
>6TmN4ZzEh0zfeGLq+LZ1kAY0ZsIds9ziyKsxAPGlTQz3Ax9rjb40BOwClHc4wbOF
>6DzOg7WN87fRSO/wCTy3
>=dDnL
>-----END PGP SIGNATURE-----
>--
>security mailing list
>security(a)lists.fedoraproject.org
>https://admin.fedoraproject.org/mailman/listinfo/security
9:12 a.m.
New subject: F19 Firewall
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
On Wed, Sep 25, 2013 at 01:07:59PM -0500, Lance Lassetter wrote:
Firewalld is just not workable enough for me. For instance I need to
have quirky netfilter rules to make my squid proxy setup to work properly. There is no
easy way to do this with firewalld. Also I set up an iptables queue so that netfilter
supports suricata ips mode. This also, no easy way...
Netfilter is just so diverse and firewalld seems to strip a lot of that diversity away.
What about the idea that people who want to write their own iptables custom scripts that
can be, after wiriting the script and implementening it, a smart way for the script to be
imported...the whole script, into firewalld. Last I tried, my nat rules weren't
compatible with firewalld. Like maybe a simpe iptables-save then a firewalld-save or the
like. Then maybe ask if to import it into firewalld's 'home', 'work',
'public', etc.
It sounds a bit like you are trying to use firewalld on a server. I would not recommend
using firewalld for anything but client boxes and, specifically, client boxes with simple
rules. If you are using this on a server I would uninstall firewalld and not use the
complexity that it adds to iptables but rather just use iptables (and ip6tables). There
is nothing wrong with using your scripts on iptables and not using firewalld. You seem to
know how to configure iptables which is what firewalld aims to fix for people that
don't.
- -- Eric
- --------------------------------------------------
Eric "Sparks" Christensen
Red Hat, Inc - Product Security Team
sparks(a)redhat.com - sparks(a)fedoraproject.org
097C 82C3 52DF C64A 50C2 E3A3 8076 ABDE 024B B3D1
- --------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)
iQGcBAEBCgAGBQJSRECuAAoJEB/kgVGp2CYvMg4L/i8HCunAahLtrCT0up514ag8
S+z9CLNr7f6SrdzGNDyBKfq4uM+Vgg8kJIf4AZNj9/F1DE55sKQB0rRSXVxZ1qZ1
qu7A8c+okUCaZ95LuBLzS7iGC7RIpfIGmNdd/sLlbF7G0nbN+GjWIVtpVw4JGbua
2ENKU/BOBceA+sfruBU9FXWDl3zreNU5ucVsiZjHJ8LwJclTSURSwaqrY+cTfaUq
xEuOtwxNV+hBf0lvSHffvPeyCsToEJLu2ZIKGGLmI6Kf7vtzGXRp4TTzKrDTu8nF
THfzxX3XtN5RE1JBpx44bThd6lj38Mt/qqEY4sdtMfsihF9l2JQdJvxitb9EiBdF
g2HJpRggMjfMpZH+m4nthEb+oFzscweBg5qcEe+5EnimiRB30+NsdBLgtsthk8tP
3+jeQPfAaINlaGStVEpugr5bGVRstANIRyKLSSKqbJy+w8JQAN8RYRivMeJMn5YI
E1U8QWv/TBSFvWmHn+bj7zhY3siDwOM+G+i7P7B3gA==
=rFhQ
-----END PGP SIGNATURE-----
11:29 p.m.
New subject: F19 Firewall
On Thu, Sep 26, 2013 at 10:12:00AM -0400, Eric H. Christensen wrote:
On Wed, Sep 25, 2013 at 01:07:59PM -0500, Lance Lassetter wrote:
> Firewalld is just not workable enough for me. For instance I need to have quirky
netfilter rules to make my squid proxy setup to work properly. There is no easy way to do
this with firewalld. Also I set up an iptables queue so that netfilter supports suricata
ips mode. This also, no easy way...
>
> Netfilter is just so diverse and firewalld seems to strip a lot of that diversity
away.
>
> What about the idea that people who want to write their own iptables custom scripts
that can be, after wiriting the script and implementening it, a smart way for the script
to be imported...the whole script, into firewalld. Last I tried, my nat rules weren't
compatible with firewalld. Like maybe a simpe iptables-save then a firewalld-save or the
like. Then maybe ask if to import it into firewalld's 'home', 'work',
'public', etc.
It sounds a bit like you are trying to use firewalld on a server. I would not recommend
using firewalld for anything but client boxes and, specifically, client boxes with simple
rules. If you are using this on a server I would uninstall firewalld and not use the
complexity that it adds to iptables but rather just use iptables (and ip6tables). There
is nothing wrong with using your scripts on iptables and not using firewalld. You seem to
know how to configure iptables which is what firewalld aims to fix for people that
don't.
-- Eric
--------------------------------------------------
Eric "Sparks" Christensen
Red Hat, Inc - Product Security Team
sparks(a)redhat.com - sparks(a)fedoraproject.org
097C 82C3 52DF C64A 50C2 E3A3 8076 ABDE 024B B3D1
--------------------------------------------------
I thought in the Fedora world firewalld was supposed to replace iptables completely? So
firewalld is just for cliet machines? Then IMHO this needs to be stated explicitley, say,
upon launch of firewalld? Or something.... I saw a lot of confusion at the first launch
of firewalld because of the complete replacement factor and "How am I going to do
this on a server?" If it is to be a complete replacement (which maybe it should be
for the simplification of Netfilter tobl the end user), what about a wizard upon launch as
well as the flexibility of importing complex rulesets into firewalld no matter what?
Lance
7:06 a.m.
New subject: F19 Firewall
On 09/27/2013 06:29 AM, Lance Lassetter wrote:
On Thu, Sep 26, 2013 at 10:12:00AM -0400, Eric H. Christensen wrote:
> On Wed, Sep 25, 2013 at 01:07:59PM -0500, Lance Lassetter wrote:
>> Firewalld is just not workable enough for me. For instance I need to have quirky
netfilter rules to make my squid proxy setup to work properly. There is no easy way to do
this with firewalld. Also I set up an iptables queue so that netfilter supports suricata
ips mode. This also, no easy way...
>>
>> Netfilter is just so diverse and firewalld seems to strip a lot of that diversity
away.
>>
>> What about the idea that people who want to write their own iptables custom
scripts that can be, after wiriting the script and implementening it, a smart way for the
script to be imported...the whole script, into firewalld. Last I tried, my nat rules
weren't compatible with firewalld. Like maybe a simpe iptables-save then a
firewalld-save or the like. Then maybe ask if to import it into firewalld's
'home', 'work', 'public', etc.
>
> It sounds a bit like you are trying to use firewalld on a server. I would not
recommend using firewalld for anything but client boxes and, specifically, client boxes
with simple rules. If you are using this on a server I would uninstall firewalld and not
use the complexity that it adds to iptables but rather just use iptables (and ip6tables).
There is nothing wrong with using your scripts on iptables and not using firewalld. You
seem to know how to configure iptables which is what firewalld aims to fix for people that
don't.
>
> -- Eric
I thought in the Fedora world firewalld was supposed to replace iptables completely? So
firewalld is just for cliet machines? Then IMHO this needs to be stated explicitley, say,
upon launch of firewalld? Or something.... I saw a lot of confusion at the first launch
of firewalld because of the complete replacement factor and "How am I going to do
this on a server?" If it is to be a complete replacement (which maybe it should be
for the simplification of Netfilter tobl the end user), what about a wizard upon launch as
well as the flexibility of importing complex rulesets into firewalld no matter what?
FirewallD has never been intended only for clients. AFAIR it even
started as solution for servers. The aim of FirewallD has already very
nicely described Mirek in
https://lists.fedoraproject.org/pipermail/security/2013-September/001667....
https://lists.fedoraproject.org/pipermail/security/2013-September/001669....
--
Jiri
8:04 a.m.
New subject: F19 Firewall
On Fri, Sep 27, 2013 at 02:06:42PM +0200, Jiri Popelka wrote:
On 09/27/2013 06:29 AM, Lance Lassetter wrote:
>On Thu, Sep 26, 2013 at 10:12:00AM -0400, Eric H. Christensen wrote:
>>On Wed, Sep 25, 2013 at 01:07:59PM -0500, Lance Lassetter wrote:
>>>Firewalld is just not workable enough for me. For instance I need to have
quirky netfilter rules to make my squid proxy setup to work properly. There is no easy
way to do this with firewalld. Also I set up an iptables queue so that netfilter supports
suricata ips mode. This also, no easy way...
>>>
>>>Netfilter is just so diverse and firewalld seems to strip a lot of that
diversity away.
>>>
>>>What about the idea that people who want to write their own iptables custom
scripts that can be, after wiriting the script and implementening it, a smart way for the
script to be imported...the whole script, into firewalld. Last I tried, my nat rules
weren't compatible with firewalld. Like maybe a simpe iptables-save then a
firewalld-save or the like. Then maybe ask if to import it into firewalld's
'home', 'work', 'public', etc.
>>
>>It sounds a bit like you are trying to use firewalld on a server. I would not
recommend using firewalld for anything but client boxes and, specifically, client boxes
with simple rules. If you are using this on a server I would uninstall firewalld and not
use the complexity that it adds to iptables but rather just use iptables (and ip6tables).
There is nothing wrong with using your scripts on iptables and not using firewalld. You
seem to know how to configure iptables which is what firewalld aims to fix for people that
don't.
>>
>>-- Eric
>
>I thought in the Fedora world firewalld was supposed to replace iptables completely?
So firewalld is just for cliet machines? Then IMHO this needs to be stated explicitley,
say, upon launch of firewalld? Or something.... I saw a lot of confusion at the first
launch of firewalld because of the complete replacement factor and "How am I going to
do this on a server?" If it is to be a complete replacement (which maybe it should
be for the simplification of Netfilter tobl the end user), what about a wizard upon launch
as well as the flexibility of importing complex rulesets into firewalld no matter what?
FirewallD has never been intended only for clients. AFAIR it even
started as solution for servers. The aim of FirewallD has already
very nicely described Mirek in
https://lists.fedoraproject.org/pipermail/security/2013-September/001667....
https://lists.fedoraproject.org/pipermail/security/2013-September/001669....
--
Jiri
so i have two simple questions:
with firewalld can i import this rule:
/sbin/iptables -I FORWARD -m mark ! --mark 1/1 -j NFQUEUE
and these rules:
/sbin/iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --gid-owner squid -j ACCEPT
/sbin/iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to 192.168.1.2:3129
/sbin/iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner squid -j ACCEPT
/sbin/iptables -t nat -A OUTPUT -p tcp --dport 3129 -m owner --uid-owner squid -j ACCEPT
/sbin/iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-ports 3129
hence, Netfilter rules by user/group and using NFQUEUE target.
because if firewalld alllows stuff like this, then problem solved. last checked, it does
not.
and, once again why not something simple like if 'execute some iptables script' ,
then 'iptables-save' , then 'firewalld-save' or even skip the middle
step!
if these type rules are not workable with firewalld, then it is fruitless at least for
me.
regards,
lance
10:42 a.m.
New subject: F19 Firewall
On 09/27/2013 03:04 PM, Lance Lassetter wrote:
with firewalld can i import this rule:
/sbin/iptables -I FORWARD -m mark ! --mark 1/1 -j NFQUEUE
and these rules:
/sbin/iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --gid-owner squid -j ACCEPT
/sbin/iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to 192.168.1.2:3129
/sbin/iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner squid -j ACCEPT
/sbin/iptables -t nat -A OUTPUT -p tcp --dport 3129 -m owner --uid-owner squid -j ACCEPT
/sbin/iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-ports 3129
hence, Netfilter rules by user/group and using NFQUEUE target.
because if firewalld alllows stuff like this, then problem solved. last checked, it does
not.
Should be possible with permanent direct rules.
I'd point you to firewalld.direct(5), but I've just noticed we actually
forgot to ship it :-(
So just create /etc/firewalld/direct.xml with something like:
<?xml version="1.0" encoding="utf-8"?>
<direct>
[ <rule ipv="ipv4" table="filter"
chain="FORWARD_direct"
priority="0"> -m mark ! --mark 1/1 -j NFQUEUE </rule> ]
[ <rule ipv="ipv4" table="nat"
chain="PREROUTING_direct"
priority="0"> -p tcp --dport 80 -j DNAT --to 192.168.1.2:3129 </rule>
]
[ <rule ipv="ipv4" table="nat"
chain="OUTPUT_direct"
priority="0"> -p tcp --dport 80 -m owner --gid-owner squid -j ACCEPT
</rule> ]
[ <rule ipv="ipv4" table="nat"
chain="OUTPUT_direct"
priority="1"> -p tcp --dport 80 -m owner --uid-owner squid -j ACCEPT
</rule> ]
[ <rule ipv="ipv4" table="nat"
chain="OUTPUT_direct"
priority="2"> -p tcp --dport 3129 -m owner --uid-owner squid -j ACCEPT
</rule> ]
[ <rule ipv="ipv4" table="nat"
chain="OUTPUT_direct"
priority="3"> -p tcp --dport 80 -j REDIRECT --to-ports 3129 </rule> ]
</direct>
The X_direct chains are created by firewalld and jumped into before
all the other chains (for zones etc.).
and, once again why not something simple like if 'execute some
iptables script' , then 'iptables-save' , then 'firewalld-save' or
even skip the middle step!
I'm CCing Thomas who has already tried to write something similar, but
it's not that simple according to his words.
--
Jiri
2:24 a.m.
New subject: F19 Firewall
On 09/30/2013 05:42 PM, Jiri Popelka wrote:
<direct>
[ <rule ipv="ipv4" table="filter"
chain="FORWARD_direct"
priority="0"> -m mark ! --mark 1/1 -j NFQUEUE </rule> ]
Without the [ and ] (no idea how it got there).
So once again:
<?xml version="1.0" encoding="utf-8"?>
<direct>
<rule ipv="ipv4" table="filter" chain="FORWARD_direct"
priority="0">
-m mark ! --mark 1/1 -j NFQUEUE </rule>
<rule ipv="ipv4" table="nat" chain="PREROUTING_direct"
priority="0">
-p tcp --dport 80 -j DNAT --to 192.168.1.2:3129 </rule>
<rule ipv="ipv4" table="nat" chain="OUTPUT_direct"
priority="0">
-p tcp --dport 80 -m owner --gid-owner squid -j ACCEPT </rule>
<rule ipv="ipv4" table="nat" chain="OUTPUT_direct"
priority="1">
-p tcp --dport 80 -m owner --uid-owner squid -j ACCEPT </rule>
<rule ipv="ipv4" table="nat" chain="OUTPUT_direct"
priority="2">
-p tcp --dport 3129 -m owner --uid-owner squid -j ACCEPT </rule>
<rule ipv="ipv4" table="nat" chain="OUTPUT_direct"
priority="3">
-p tcp --dport 80 -j REDIRECT --to-ports 3129 </rule>
</direct>
--
Jiri
2:51 a.m.
New subject: F19 Firewall
On Thu, Oct 03, 2013 at 09:24:34AM +0200, Jiri Popelka wrote:
On 09/30/2013 05:42 PM, Jiri Popelka wrote:
><direct>
> [ <rule ipv="ipv4" table="filter"
chain="FORWARD_direct"
>priority="0"> -m mark ! --mark 1/1 -j NFQUEUE </rule> ]
Without the [ and ] (no idea how it got there).
So once again:
<?xml version="1.0" encoding="utf-8"?>
<direct>
<rule ipv="ipv4" table="filter"
chain="FORWARD_direct"
priority="0"> -m mark ! --mark 1/1 -j NFQUEUE </rule>
<rule ipv="ipv4" table="nat"
chain="PREROUTING_direct"
priority="0"> -p tcp --dport 80 -j DNAT --to 192.168.1.2:3129
</rule>
<rule ipv="ipv4" table="nat"
chain="OUTPUT_direct"
priority="0"> -p tcp --dport 80 -m owner --gid-owner squid -j
ACCEPT </rule>
<rule ipv="ipv4" table="nat"
chain="OUTPUT_direct"
priority="1"> -p tcp --dport 80 -m owner --uid-owner squid -j ACCEPT
</rule>
<rule ipv="ipv4" table="nat"
chain="OUTPUT_direct"
priority="2"> -p tcp --dport 3129 -m owner --uid-owner squid -j
ACCEPT </rule>
<rule ipv="ipv4" table="nat"
chain="OUTPUT_direct"
priority="3"> -p tcp --dport 80 -j REDIRECT --to-ports 3129 </rule>
</direct>
--
Jiri
--
security mailing list
security(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/security
Sorry, top posted.
Has firewall.state been shipped yet?
Lance
8:09 a.m.
New subject: F19 Firewall
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
On Thu, Sep 26, 2013 at 11:29:34PM -0500, Lance Lassetter wrote:
I thought in the Fedora world firewalld was supposed to replace
iptables completely? So firewalld is just for cliet machines? Then IMHO this needs to be
stated explicitley, say, upon launch of firewalld? Or something.... I saw a lot of
confusion at the first launch of firewalld because of the complete replacement factor and
"How am I going to do this on a server?" If it is to be a complete replacement
(which maybe it should be for the simplification of Netfilter tobl the end user), what
about a wizard upon launch as well as the flexibility of importing complex rulesets into
firewalld no matter what?
Sorry, I should have said that in my opinion I would only use firewalld for client systems
and not computers. I trust ip*tables and know how to write the rules easily so I find
firewalld's interface and tools to be annoying. I haven't seen the benefit of it
just yet.
- -- Eric
- --------------------------------------------------
Eric "Sparks" Christensen
Red Hat, Inc - Product Security Team
sparks(a)redhat.com - sparks(a)fedoraproject.org
097C 82C3 52DF C64A 50C2 E3A3 8076 ABDE 024B B3D1
- --------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)
iQGcBAEBCgAGBQJSRYN6AAoJEB/kgVGp2CYvQHcL/jpogbokDxt7f6T0NCkryrtC
ztOwrwKLvVdL+t5VgFHXLeHAmG0dXqKZQoixmZWmir8iKkp7Nx67D47HxRhhn4/r
K7JLAnAz5iyL2zV4Hzt2h0NO22rENaJrWYvfMCYOU2pOJpL16EEFo6Bb76r0hnr3
a0kHqc86cpcJ77lxwlE+izrvgdjZDkQb7xYN5CpZ84SFPJZaFKXfCCngdqNdZTl6
sliFQOUQvqTxPSsEHctQwNyrNi802PpxoF8mdIsVdobavKLmRSFVV52IG3GCRe6f
aM7HTBoZBTj+f5w/D7uoAqp46VzoycVbGeMOLKU/2MlhBaB6gdoz8WcsP/mUg6ez
SClJJ0aG4y05yfIQ3267TNOJpZuC8dpZpmlmrJH0fOKqgywWgFTufsJvkZ6WHROB
Lz8xMPmTWjSPBnus8Hd8k0C1/tMLVSZG9DztrtCHzwIYDk3+rs3TseEGT4eDweFP
aEDeyEJvLxhYe/gfKzDUEnw99EhS61qsyfYYEzfz4A==
=6LQV
-----END PGP SIGNATURE-----
3857
days inactive
3865
days old
security@lists.fedoraproject.org
9 comments
4 participants
participants (4)
-
Eric Christensen -
Eric Christensen -
Jiri Popelka -
Lance Lassetter