Re: OpenVPN server and firewalld

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]



On Fri, Dec 29, 2017 at 10:32 AM, Kenneth Porter <shiva@xxxxxxxxxxxxxxx>
wrote:

> How do I insert the iptables rule below using firewalld?
>
> I'm moving up from CentOS 6 to 7 on an office gateway and I'm trying to
> get OpenVPN working to allow home workers to access PCs at the office. I've
> got it all working but only by manually inserting an ACCEPT rule in the
> FORWARD iptables chain:
>
> iptables -I FORWARD 3 -i tun+ -j ACCEPT
>
> This rule was extracted from my iptables firewall under CentOS6. The 3
> puts it after the accepts for established connections and loopback
> connections, but before any firewalld sub-chains. With this I can connect
> to an internal Windows 10 system with Remote Desktop.
>
> How can I inject this rule using firewalld, either as a direct rule or as
> some more firewalld-approved kind of rule?
>
>
Hello,
in case your need is not covered by the "--add-service" and/or the
"--add-port" you can still use a direct rule for it.

I think it should be something like this to test:
firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i tun+ -j ACCEPT

Manual page and some examples with
man firewalld.direct

The "iptables like" rule will be added into the pre-built chain named
FORWARD_direct
The 0 above means it is put at top of FORWARD_direct chain. In your example
appears "3" and it is not clear what are lines 1 and 2.
With iptables -L command you will see:

# iptables -v -L FORWARD_direct
Chain FORWARD_direct (1 references)
 pkts bytes target     prot opt in     out     source
destination
    0     0 ACCEPT     all  --  tun+   any     anywhere
anywhere
#

With firewall-cmd you can see with
# firewall-cmd --direct --get-all-rules
ipv4 filter FORWARD 0 -i tun+ -j ACCEPT
#

If it works ok as expected, you can make it permanent with

firewall-cmd --permanent --direct --add-rule ipv4 filter FORWARD 0 -i tun+
-j ACCEPT
firewall-cmd --reload

HIH digging into,
Gianluca
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
https://lists.centos.org/mailman/listinfo/centos



[Index of Archives]     [CentOS]     [CentOS Announce]     [CentOS Development]     [CentOS ARM Devel]     [CentOS Docs]     [CentOS Virtualization]     [Carrier Grade Linux]     [Linux Media]     [Asterisk]     [DCCP]     [Netdev]     [Xorg]     [Linux USB]


  Powered by Linux