On 6/19/23 11:07, Chris Adams wrote:
Once upon a time, Amadeus WM <amadeus84@xxxxxxxxxxx> said:
2. The command that I tried
firewall-cmd --permanent --add-rich-rule="rule family='ipv4' protocol
value="tcp" destination address='aa.bb.0.0/16' reject"
One quirk of fireall-cmd is that there are two distinct modes - one that
operates on the stored configuration (with --permanent) and one that
operates on the running config (without --permanent). When you make a
change with --permanent, it is stored, and will take effect on future
boots, but it is not applied to the current config. You need to run the
same command without the --permanent to apply to the current running
config.
Alternately, you can make all your changes to the running config (no
--permanent), and then store them all at once with firewall-cmd
--runtime-to-permanent (but if you have something making dynamic
changes, like fail2ban for example, that would get stored as well). Or
you can make all your changes to the permanent config and then load them
to running all at once with firewall-cmd --reload.
didn't put anything in iptables, i.e. iptables --list shows no rules. On
the other hand, I do have this reject rule in /etc/firewalld/zones/
FedoraWorkstation.xml.
iptables only exists as a compat layer on top of nftables, and not
everything in nftables will be reflected in the output of iptables. To
see the full nftables running config use "nft list ruleset".
If you are going to use firewalld, you need to either _only_ use
firewalld, or use nft with separate rulesets along side the firewalld
managed rulesets. Trying to mix in iptables rules is unlikely to work
how you'd like.
Hi Chris,
All of firewalld's rules are contained in custom chains. iptables is
just a frontend to nftables so using iptables rather than nftables to
enter rules shouldn't really matter.
I tested this:
iptables -t filter -A OUTPUT -d 192.168.1.1/32 -j DROP
and it was translated to this nft rule:
table ip filter {
chain OUTPUT {
type filter hook output priority filter; policy accept;
ip daddr 192.168.1.1 counter packets 0 bytes 0 drop
}
}
The filter:OUTPUT chain is predefined and is unused by firewalld so I
can't see how using iptables and its predefined chains to get rules into
nftables would make any difference whatsoever. Now, if I were to try
mucking around with any of firewalld's custom chains without knowing
what I was doing I could definitely envision being bitten by the laws of
unintended consequences which, as we all know, have very sharp teeth.
Thanks for your post. It got me digging around in all sorts of
unfamiliar territory :m
Mike Wright
_______________________________________________
users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
