Matthew Miller wrote:
On Fri, Oct 24, 2014 at 11:45:10AM -0400, Bill Davidsen wrote:
I have a complex firewall setup running on an older version of
Fedora, and I'd like to upgrade to RHEL7 or recent Fedora.
Unfortunately, I can't really do what I need using firewalld, so two
questions:
1 - has anyone done this and were there any serious gotcha's?
2 - is it as easy as removing firewalld and installing networkmanager with yum?
NetworkManager should already be installed by default (in everything
but Fedora Cloud). Firewalld can be removed and replaced with something
else — although it might be nice to file an RFE so that it has support
for the hoops you need jumped, because the eventual intention is to
make it _easier_ to support complex setups like this.
This is such a custom setup, I'm not sure that resources would be justified in
doing so, although I would be happy to see it.
Off the top of my head:
- source IP is forced for some outgoing connections:
by protocol (port, actually)
by destination IP
- Packets with a given source IP must go out of the appropriate interface.
Why Linux does any other thing is either politics or religion, but
must happen.
- FORWARDing rules based on the NIC getting the connection, not the IP
address.
I didn't make up the requirements, I did actually write the rules which make the
magic happen.
--
Bill Davidsen <davidsen@xxxxxxx>
"We have more to fear from the bungling of the incompetent than from
the machinations of the wicked." - from Slashdot
--
users mailing list
users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org
