Bug 1391143 - rich rules do not drop host(s) in masquerading zone
Summary: rich rules do not drop host(s) in masquerading zone
Keywords:
Status: CLOSED WORKSFORME
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: firewalld
Version: 7.2
Hardware: x86_64
OS: Linux
medium
high
Target Milestone: rc
: ---
Assignee: Thomas Woerner
QA Contact: qe-baseos-daemons
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-11-02 15:57 UTC by lejeczek
Modified: 2021-08-11 11:55 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-06-26 16:50:09 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description lejeczek 2016-11-02 15:57:44 UTC
Description of problem:

is this not a bug?:

yes, to me too it sort of defines basic logic - one would expect to be able with a "rich rule" to block/ban a host (actually there are quite few articles on the net stating it should be doing that)

public (active)
  interfaces: em3
  sources:
  services: dhcpv6-client ssh
  ports:
  masquerade: yes
  forward-ports:
  icmp-blocks:
  rich rules:
        rule family="ipv4" source address="192.168.2.0/24" reject

yet host from 192.168.2.0/24 (which is firewalld's zone work) are able to masquerade and access all (in this case whole Internet) behind em3 interface.
It smells like a bug to me.


Version-Release number of selected component (if applicable):
0.3.9

How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 2 Thomas Woerner 2016-11-04 14:13:59 UTC
The external address 192.168.2.0/24 will be blocked, not an internal.

There is a solution: Masquerade all but 192.168.2.0/24 with a rich rule

rule family="ipv4" source NOT address="192.168.2.0/24" masquerade

And deactivate masquerading in the zone. Please do not forget to enable masquerading for IPv6 if needed.

Comment 3 Phil Sutter 2017-06-26 16:50:09 UTC
Hi,

(In reply to Thomas Woerner from comment #2)
> The external address 192.168.2.0/24 will be blocked, not an internal.
> 
> There is a solution: Masquerade all but 192.168.2.0/24 with a rich rule
> 
> rule family="ipv4" source NOT address="192.168.2.0/24" masquerade
> 
> And deactivate masquerading in the zone. Please do not forget to enable
> masquerading for IPv6 if needed.

This ticket didn't receive an update for quite a while, therefore I assume the above advice resolved reporter's issue. Please feel free to reopen in case I am wrong.

Thanks, Phil

Comment 4 lejeczek 2021-08-11 11:55:57 UTC
ok


Note You need to log in before you can comment on or make changes to this bug.