About F19 Firewall

[Thomas Woerner]

On 09/24/2013 06:53 PM, Thomas Woerner wrote:
> On 09/21/2013 12:22 AM, Chuck Anderson wrote:
>> On Fri, Sep 20, 2013 at 04:17:21PM +0200, Thomas Woerner wrote:
>>> If a static firewall configuration fits your needs, just disable
>>> firewalld and use the ip*tables firewall services:
>>>
>>> https://fedoraproject.org/wiki/FirewallD?rd=FirewallD/#Using_static_firewall_rules_with_the_iptables_and_ip6tables_services
>>>
>>>
>>> BTW: If are not configuring an IPv6 firewall, I would highly
>>> recommend to either also add an IPv6 firewall with the ip6tables
>>> service or to deactivate IPv6 on your machine.
>>
>> Speaking of which, I have a somewhat strange scenario.  I have a
>> global IPv4 address on one interface, so I put that interface into the
>> Public zone.  I have a private IPv4 address (RFC1918 on my LAN) on
>> another interface.  I want to put that on the Home zone so I can do
>> mDNS, etc.  BUT this same "private" NIC also has a public IPv6 address
>> because the private LAN's router is a Hurricane Electric IPv6 tunnel
>> endpoint...I don't want the ip6tables rules to be in the Home zone,
>> but rather Public.
>>
>> Does firewalld support non-congruent rules between IPv4 and IPv6?  How
>> about different zones for different IP addresses on the same interface
>> (mixed IPv4/IPv6 or even multiple IPv4 or multiple IPv6 for that
>> matter)?
>>
> You can bind IP addresses and address ranges to zones already.
>
> With firewall-cmd:
>
> firewall-cmd [--permanent] --zone=<zone> --add-source=<source>[/<mask>]
>
> Example:
>
> firewall-cmd --zone=home --add-source=192.168.0.3
> firewall-cmd --permanent --zone=home --add-source=192.168.0.3
>
> This will add it for the current run time environment and also permanently.
>
> You can also use IPv6 addresses for this.
>
> See man firewall-cmd at "Options to Handle Bindings of Sources"
You can also use firewall-config. Please have a look at the Sources tab 
for the zone you want to bind the source to.