Bug 842321 - nat requires manual adjustment
Summary: nat requires manual adjustment
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: firewalld
Version: 17
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Thomas Woerner
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-07-23 13:27 UTC by Serge Pavlovsky
Modified: 2013-02-15 12:16 UTC (History)
2 users (show)

Fixed In Version: firewalld-0.2.6-1.fc18
Clone Of:
Environment:
Last Closed: 2013-02-15 12:16:55 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Serge Pavlovsky 2012-07-23 13:27:31 UTC
Description of problem:

when i add interface to external zone, firewalld does not create rules jumping from POSTROUTING_ZONES to POST_ZONE_external in nat table. in sources i can only see handling of INPUT and FORWARD in filter table, but no POSTROUTING in nat table. it actually applies to all zones, not just to external, but i only need postrouting in external atm.
so i have to manually add rules like
-A POSTROUTING_ZONES -o eth1 -j POST_ZONE_external
-A POSTROUTING_ZONES -o ppp0 -j POST_ZONE_external
and i guess they will be lost after reboot

Version-Release number of selected component (if applicable):
firewalld-0.2.5-1.fc17.noarch

How reproducible:
add interface to external zone
sudo iptable-save | grep _ZONES
  
Actual results:
see jump from POSTROUTING to POSTROUTING_ZONES, but no jump from POSTROUTING_ZONES to POST_ZONE_external
on the other hand FORWARD and INPUT have jumps both to *_ZONES and from *_ZONES


Expected results:
jumps from POSTROUTING_ZONES like with INPUT and FORWARD

Comment 1 Serge Pavlovsky 2012-07-23 14:05:02 UTC
s/iptable-save/iptables-save/

Comment 3 Serge Pavlovsky 2012-07-25 10:15:36 UTC
i see
for some reason i need to add -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu to forward chain in mangle table
so, while you're at it, it would be nice to also add forward to mangle
and may be even shortcut parameter for this rule like for masquerade

Comment 4 Jiri Popelka 2013-02-15 12:16:55 UTC
Fedora-18 has had this fixed since firewalld-0.2.6-1.fc18.
This will most likely not be fixed in Fedora-17.


Note You need to log in before you can comment on or make changes to this bug.