Bug 1445918
| Summary: | firewalld does not allow port forwarding on localhost | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | David Biesack <david.biesack> |
| Component: | firewalld | Assignee: | Eric Garver <egarver> |
| Status: | CLOSED WONTFIX | QA Contact: | qe-baseos-daemons |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 7.2 | CC: | atragler, egarver, herrold, jscalf, mihai, psztoch, rkhan, sukulkar, todoleza |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-01-23 18:35:07 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
David Biesack
2017-04-26 18:52:13 UTC
I have similar problem. We are using: -A PREROUTING -d 192.168.18.16/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.18.16:8080 -A PREROUTING -d 192.168.18.16/32 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.18.16:8443 -A OUTPUT -d 192.168.18.16/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.18.16:8080 -A OUTPUT -d 192.168.18.16/32 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.18.16:8443 in RHEL 6 But in RHEL 7: <forward-port to-port="8080" protocol="tcp" port="80"/> <forward-port to-port="8443" protocol="tcp" port="443"/> generate rules only in PREROUTING chains. OUTPUT chains are ignored. psztoch in Comment #2 it loos as though you are trying a transparent squid redirect This post on the mailing list may help https://lists.fedoraproject.org/archives/list/firewalld-users@lists.fedorahosted.org/message/EBNJQXTFQDCGQAW3SJWTRSTXNO42CJOV/ I am still tinkering with it I also have a desire to intercept all outbound port 25 TCP, as the prior email in that thread indicates (In reply to Przemyslaw Sztoch from comment #2) [...] > But in RHEL 7: > <forward-port to-port="8080" protocol="tcp" port="80"/> > <forward-port to-port="8443" protocol="tcp" port="443"/> > generate rules only in PREROUTING chains. > > OUTPUT chains are ignored. OUTPUT support is a work-in-progress, see Bug 1492722. However, currently you can use a --direct rule to add rules to the OUTPUT chain. See the firewall-cmd man page. firewalld implements forward-ports using the iptables nat PREROUTING chain. This chain is not used for packets sent over the loopback interface as packets over the loopback should not be routed. The nat PREROUTING is used to allow conntrack.
e.g.
# iptables -v -t nat -L
...
Chain PRE_public_allow (1 references)
pkts bytes target prot opt in out source destination
8 480 DNAT tcp -- any any anywhere anywhere mark match 0x64 to::8080
...
__Solution__
However, you can get the desired affect with a --direct rule.
# firewall-cmd --permanent --direct --add-rule ipv4 nat OUTPUT 0 -p tcp -o lo --dport 80 -j REDIRECT --to-ports 8080
---->8----
# echo -e "GET index.html HTTP/1.1" | nc localhost 80
HTTP/1.0 200 OK
Server: SimpleHTTP/0.6 Python/2.7.5
Date: Fri, 17 Nov 2017 15:07:39 GMT
Content-type: text/html
Content-Length: 16
Last-Modified: Fri, 17 Nov 2017 15:05:21 GMT
This is a test.
Closing as WONTFIX. See comment 6 for a simple solution. I don't think adding special rules and adding code complexity to handle the loopback interface is worth it when there is an easy alterative. |