RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 2029211 - firewalld - new (mis)behaviour - when a box want's to be a gateway
Summary: firewalld - new (mis)behaviour - when a box want's to be a gateway
Alias: None
Product: Red Hat Enterprise Linux 9
Classification: Red Hat
Component: firewalld
Version: CentOS Stream
Hardware: x86_64
OS: Unspecified
Target Milestone: rc
: ---
Assignee: Eric Garver
QA Contact: qe-baseos-daemons
Jaroslav Klech
Depends On:
TreeView+ depends on / blocked
Reported: 2021-12-05 19:54 UTC by lejeczek
Modified: 2022-05-27 11:54 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: Enhancement
Doc Text:
.Changed behavior in `firewalld` when transmitting packets between zones In zone-based firewalls, packets enter only one zone. Implicit packet transmission is the concept violation and can allow traffic or services unexpectedly. In Red Hat Enterprise Linux 9 the `firewalld` service no longer allows implicit packet transmission between two different zones. For more information about this change, see link:https://access.redhat.com/articles/6570501[Changed behavior in `firewalld` when transmitting packets between zones] Knowledge Article.
Clone Of:
Last Closed: 2021-12-06 13:26:26 UTC
Type: Bug
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker RHELPLAN-104775 0 None None None 2021-12-05 19:57:59 UTC

Description lejeczek 2021-12-05 19:54:19 UTC
Description of problem:

I see this is different from firewalld version with Centos 8 Stream, here in 9 if I want a box to gateway/masquerade then box's lan iface (or any iface via which I'd like to got out) must be in the same zone as the iface connecting outside)
With firewalld-0.9.3-11.el8.noarch it suffices to add 'masquerade' to the zone if the zone host an iface with default route then that does it - no need for extra direct rules, box is the gateway for the lan.

Is that really the intention with firewalld-1.0.0-2.el9.noarch

thanks, L.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:

Actual results:

Expected results:

Additional info:

Comment 1 Eric Garver 2021-12-06 13:26:26 UTC
(In reply to lejeczek from comment #0) 
> Is that really the intention with firewalld-1.0.0-2.el9.noarch

Yes. See bug 2020974 comment 1.

Solution: `firewalld-cmd --permanent --zone <zone> --add-forward`

Comment 2 lejeczek 2021-12-06 13:58:26 UTC
Nope. The zone (and most by default I think) have forwarding already:

-> $ firewall-cmd --zone=external --list-all
external (active)
  target: default
  icmp-block-inversion: no
  interfaces: virgincable
  services: http https ipsec rsyncd ssh
  ports: 9001/tcp 22067/tcp 22070/tcp 8443/tcp
  forward: yes
  masquerade: yes
  rich rules:

unless I add other(s) iface(s) via/from which I want communicate to the outside word (virgincable iface) to that zone, there is no traffic passing through:
From icmp_seq=238 Packet filtered

I tried some rules for that zone, one basic such as here:

	rule priority="-32768" family="ipv4" source address="" masquerade

But none of those worked and.. naturally I'd be nice(desired & expected) to not have to tamper with nft directly for such a basic concept as "gateway"

regards, L.

Comment 3 Eric Garver 2021-12-06 14:18:55 UTC
You need to explicitly allow the forwarding between zones. It sounds like your were relying on the "fall through" behavior mentioned the commit [1] - see the paragraph that starts with "Secondly". The commit changes the behavior of the "default" --set-target. As the commit notes, this "fall through" behavior was unexpected. Packets should not implicitly flow between zones. That's a violation of the zone concept.

The solution is to explicitly allow forwarding between the zones. This can be done in two ways:

  1. use the `trusted` zone on the LAN side
    - trusted uses --set-target=ACCEPT, so the forwarded traffic is allowed
    - this is what podman, libvirt, etc use.

  2. use a policy to allow the forwarded traffic

    # firewall-cmd --permanent --new-policy masqueradePolicy
    # firewall-cmd --permanent --policy masqueradePolicy --add-ingress-zone public
    # firewall-cmd --permanent --policy masqueradePolicy --add-egress-zone external
    # firewall-cmd --permanent --policy masqueradePolicy --add-masquerade


[1]: https://github.com/firewalld/firewalld/commit/f2896e43c3a548a299f87675a01e1a421b8897b8

Comment 4 Eric Garver 2021-12-06 14:19:35 UTC
Additionally, the upstream blog about v1.0.0 may be useful to skim.


Comment 5 lejeczek 2021-12-06 14:35:27 UTC
Guys, put it every place an admin might go first to look for what-is-new, be it change-logs, blogs, official manuals, etc.
I see many admins if not all! the admins, will stumble over it day-0, as all this time - Centos for certain - between-zone communication just worked (still does with CentOS 8 Stream's firewalld) without lifting a finger.

many thanks, L

Comment 6 Eric Garver 2021-12-06 15:30:09 UTC
(In reply to lejeczek from comment #5)
> Guys, put it every place an admin might go first to look for what-is-new, be
> it change-logs, blogs, official manuals, etc.

I linked the commit and the blog already. It's also in the upstream release notes.

I'm flagging this bug for a RHEL-9.0 release note.

Note You need to log in before you can comment on or make changes to this bug.