Eric Garver comments

Results 181 comments of


                                            Eric Garver

Ability to add custom chains to firewalld's table

What is your use case for custom chains? The options are: 1. Use firewalld's policies 2. Use nftables directly

Ability to add custom chains to firewalld's table

firewalld will only ever touch the `firewalld` table. Additionally, newer firewalld will "lock" it's own table so other entities cannot modify it, e.g. `nft flush ruleset`. As such, the firewalld...

Ability to add custom chains to firewalld's table

> Oh, that's unfortunate. It means I can not ensure the tables are in the right order as nft flush ruleset will not work anymore. The "order" in which table/chains...

Error: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.

This may be fixed by #1515. That PR has a commit that offloads the ipset entry adds to the dbus mainloop while it's idle. The testsuite has a scale test...

Option --timeout does not work on Policies

Indeed. See also RHEL bug: https://issues.redhat.com/browse/RHEL-5795

Firewalld nftables > Forwarded Packets Target local IP Instead of Destination

nftables does support DNAT with only port change just like iptables. So we can match the iptables backend behavior. e.g. `iif "eth0" tcp dport 8080 dnat to :80` That being...

--change-interface with interface name of exactly sixteen characters in length causes nftables errors

Kernel limit is [IFNAMSIZ](https://www.man7.org/linux/man-pages/man7/netdevice.7.html). I would be great if nftables/iptables supported altname, but I think that's a lot of work. This bug is a can't fix. It has to be...

Policies priority handling issue

You're going to have to share your config. I think you may be confusing zone dispatch with policy priority.

Policies priority handling issue

Needinfo not provided.

feat req: ipsets take effect immediately when set, without reloading

In firewalld most "object" creation requires a `--reload`. That being said, I'm not aware of a reason why creating as `ipset` can't be runtime only. On the plus side, firewalld...