Bug 904336 - Unable to configure Firewall using new GUI in F18
Unable to configure Firewall using new GUI in F18
Status: CLOSED DUPLICATE of bug 892801
Product: Fedora
Classification: Fedora
Component: firewalld (Show other bugs)
18
All Linux
unspecified Severity high
: ---
: ---
Assigned To: Thomas Woerner
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2013-01-26 06:22 EST by Michael Monreal
Modified: 2013-01-31 05:14 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-01-30 09:12:09 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Michael Monreal 2013-01-26 06:22:20 EST
This report is really about firewall-config, but that package does not seem to have its own component. Please reassign if a better one exists.

The problem about firewalld/firewall-config compared to iptables/system-config-firewall is that I am unable to configure it correctly. I have some background in networking and firewalling, but the new GUI is very confusing and does not work the way I expect. Partly this seems to be caused by the concept of "Zones" which seems to be introduced by firewalld. What are "Zones" and how do they work? 

The GUI looks similar to the old one but it behaves differently. The user is left in the dark and there is no manual.
Comment 1 Michael Monreal 2013-01-26 06:33:41 EST
To explain the situation a bit better: I originally wondered why I could not access my DLNA shares. At some point I noticed that the firewall was probably blocking connections, so I first tried to allow these connections. 

1.) There is no end user friendly setting like "allow home media sharing" or something like that.

2.) There is a list of predefined services. I happen to know that I need UPnP/DLNA but sadly this is not in the list.

3.) I looked up the ports and added them manually. Still things did not work so I began to wonder about the Zones but was unable to understand the concept (do I need to allow the ports in multiple zones? Do I need to reload something?)

4.) After experimenting and still not getting any positive result I wanted to disable the firewall. The old GUI had an option for this, the new one does not...

5.) I ended up running "iptables --flush" and things started to work right away, so the problem was definitely related to the firewall. Sadly I did not find any word on the "official" way to disable the firewall permanently.

So in the end I managed to work around the problem but not really solve it. An average user would probably given up much sooner, so this is really a problem I think.
Comment 2 Jiri Popelka 2013-01-30 08:35:32 EST
(In reply to comment #0)
> What are "Zones" and how do they work? 

man firewalld.zones
Comment 3 Jiri Popelka 2013-01-30 09:08:33 EST
(In reply to comment #1)
> 1.) There is no end user friendly setting like "allow home media sharing" or
> something like that.

proposed feature
https://fedoraproject.org/wiki/FirewallD?rd=FirewallD/#Port_metadata_information_.28proposed_by_Lennart_Poettering.29

> 2.) There is a list of predefined services. I happen to know that I need
> UPnP/DLNA but sadly this is not in the list.

duplicate of bug #892801 ?

> 3.) I looked up the ports and added them manually. Still things did not work
> so I began to wonder about the Zones but was unable to understand the
> concept (do I need to allow the ports in multiple zones? Do I need to reload
> something?)

You need to change only zone which your connection is in. If you did not change it all connections are in default='public' zone.
Which ports did you add ?
From bug #892801 it seems that one needs to add *source* port 1900, which is not feasible at the moment. We can continue this UPnP related problem in bug #892801.

> 4.) After experimenting and still not getting any positive result I wanted
> to disable the firewall. The old GUI had an option for this, the new one
> does not...
> 
> 5.) I ended up running "iptables --flush" and things started to work right
> away, so the problem was definitely related to the firewall. Sadly I did not
> find any word on the "official" way to disable the firewall permanently.

systemctl stop firewalld.service
systemctl disable firewalld.service
Comment 4 Jiri Popelka 2013-01-30 09:12:09 EST
Closing as duplicate of bug #892801 as the inability to allow UPnP is the main problem here too.

*** This bug has been marked as a duplicate of bug 892801 ***
Comment 5 Michael Monreal 2013-01-30 12:13:19 EST
Jiri, thansk for your reply. I have read some Wiki pages now, so I finally understand what Zones means. The concept is great, but it's really not intuitive to use. The worst part is that there is no documentation accessible from the GUI. Even a link to the Fedora wiki under "Help" would have saved me a lot of frustration.
Comment 6 Jiri Popelka 2013-01-31 05:14:26 EST
(In reply to comment #5)
> Even a link to the Fedora wiki under "Help" would
> have saved me a lot of frustration.

Added:
http://git.fedorahosted.org/cgit/firewalld.git/commit/?id=4dbb4e53e5faf4f6219210854b4c59c199655f3d

Note You need to log in before you can comment on or make changes to this bug.