我正在 ubuntu/jammy64 上尝试简单的防火墙设置,如下所示
Source (K1) ------ (fw int) | Firewall (FW1) | (fw ext) ------ Destination (K2)
┌──(vagrant㉿k1)-[~]
└─$ ip -4 a show eth1
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
inet 172.16.10.51/24 brd 172.16.10.255 scope global eth1
valid_lft forever preferred_lft forever
┌──(vagrant㉿k1)-[~]
└─$ ip r
default via 10.0.2.2 dev eth0
10.0.2.0/24 dev eth0 proto kernel scope link src 10.0.2.15
172.16.10.0/24 dev eth1 proto kernel scope link src 172.16.10.51
172.16.20.0/24 via 172.16.10.10 dev eth1
----------
vagrant@firewall:~$ ip -4 a show enp0s8
3: enp0s8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
inet 172.16.10.10/24 brd 172.16.10.255 scope global enp0s8
valid_lft forever preferred_lft forever
vagrant@firewall:~$ ip -4 a show enp0s9
4: enp0s9: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
inet 172.16.20.10/24 brd 172.16.20.255 scope global enp0s9
valid_lft forever preferred_lft forever
vagrant@firewall:~$ sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1
----------
┌──(vagrant㉿k2)-[~]
└─$ ip -4 a show eth1
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
inet 172.16.20.51/24 brd 172.16.20.255 scope global eth1
valid_lft forever preferred_lft forever
┌──(vagrant㉿k2)-[~]
└─$ ip r
default via 10.0.2.2 dev eth0
10.0.2.0/24 dev eth0 proto kernel scope link src 10.0.2.15
172.16.10.0/24 via 172.16.20.10 dev eth1
172.16.20.0/24 dev eth1 proto kernel scope link src 172.16.20.51
我尝试了向区域添加接口和源地址的各种组合Internal
,即使有允许流量的丰富规则,k1 也无法连接到 k2,并且调试日志显示拒绝消息。
vagrant@firewall:~$ sudo firewall-cmd --list-all --zone=internal
internal (active)
target: default
icmp-block-inversion: no
interfaces: enp0s8
sources: 172.16.10.51/32
services: ssh
ports:
protocols:
forward: yes
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule protocol value="icmp" accept
rule family="ipv4" source address="172.16.10.0/24" port port="5201" protocol="tcp" log prefix="iperf" level="debug" accept
Jun 30 02:18:13 firewall kernel: "filter_FWD_internal_REJECT: "IN=enp0s8 OUT=enp0s9 MAC=08:00:27:d0:db:54:08:00:27:35:72:b5:08:00 SRC=172.16.10.51 DST=172.16.20.51 LEN=60 TOS=0x10 PREC=0x00 TTL=63 ID=2173 DF PROTO=TCP SPT=43642 DPT=5201 WINDOW=64240 RES=0x00 SYN URGP=0
当我将两个接口添加到内部区域时,连接工作正常,但当其中一个接口不属于该区域时,连接就无法正常工作。
有人可以分享下一步该去哪里看的指示吗?
谢谢。
答案1
当我根据这个问题和我自己的问题制作一个 github 问题时,我被指示制作一个策略对象。
相关博文在这里: https://firewalld.org/2020/09/policy-objects-introduction
按照创建政策的指示解决了我的问题。我希望这有帮助。