About F19 Firewall

Chuck Anderson cra at WPI.EDU
Fri Sep 20 22:22:07 UTC 2013


On Fri, Sep 20, 2013 at 04:17:21PM +0200, Thomas Woerner wrote:
> If a static firewall configuration fits your needs, just disable
> firewalld and use the ip*tables firewall services:
> 
> https://fedoraproject.org/wiki/FirewallD?rd=FirewallD/#Using_static_firewall_rules_with_the_iptables_and_ip6tables_services
> 
> BTW: If are not configuring an IPv6 firewall, I would highly
> recommend to either also add an IPv6 firewall with the ip6tables
> service or to deactivate IPv6 on your machine.

Speaking of which, I have a somewhat strange scenario.  I have a
global IPv4 address on one interface, so I put that interface into the
Public zone.  I have a private IPv4 address (RFC1918 on my LAN) on
another interface.  I want to put that on the Home zone so I can do
mDNS, etc.  BUT this same "private" NIC also has a public IPv6 address
because the private LAN's router is a Hurricane Electric IPv6 tunnel
endpoint...I don't want the ip6tables rules to be in the Home zone,
but rather Public.

Does firewalld support non-congruent rules between IPv4 and IPv6?  How
about different zones for different IP addresses on the same interface
(mixed IPv4/IPv6 or even multiple IPv4 or multiple IPv6 for that
matter)?


More information about the devel mailing list