Red Hat Bugzilla – Bug 1459921
rich rules cannot apply ipv6-only ICMP types
Last modified: 2017-08-01 12:24:48 EDT
icmptypes that are unusable for ipv4 are not applied in ipv6tables. However ipv4-only icmptypes are applied in ipv4 tables and their application is skipped for ipv6 - thats expected. The issue seems to be that failure on ipv4 stops the process of adding to ipv6.
bad-header is not applied at all, see bellow. network-unreachable was applied to ip4table
2017-06-08 16:50:14 WARNING: INVALID_RULE: IcmpType network-prohibited not usable with ipv6
2017-06-08 16:50:51 WARNING: ALREADY_ENABLED: 'rule icmp-type name="bad-header" log' already in 'public'
2017-06-08 16:51:13 WARNING: INVALID_RULE: IcmpType bad-header not usable with ipv4
2017-06-08 16:52:43 WARNING: INVALID_RULE: IcmpType bad-header not usable with ipv4
2017-06-08 16:53:04 WARNING: INVALID_RULE: IcmpType network-unreachable not usable with ipv6
note that there's workaround via using less generic rules
firewall-cmd --add-rich-rule 'rule icmp-type name=bad-header log'
firewall-cmd --add-rich-rule 'rule family=ipv6 icmp-type name=bad-header log'
generic ipv4-only works no matter what:
firewall-cmd --add-rich-rule 'rule icmp-type name=network-unreachable log'
Fixed upstream: https://github.com/t-woerner/firewalld/commit/cf50bd0004418abe1294f53b58387a181dfd2b51
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.