Sample Header Ad - 728x90

why is firewalld not processing rich rules

0 votes
0 answers
439 views
Using this configuration:
$ sudo firewall-cmd --list-all --zone=myzone
myzone (active)
  target: default
  icmp-block-inversion: no
  interfaces:
  sources: 192.168.0.10/32
  services:
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:
    rule family="ipv4" destination address="0.0.0.0/0" reject
access to ip address 192.168.0.20 on all ports is being allowed, where it appears it should be rejected, according to the rich rule. By changing the zone target to reject, all traffic is now rejected, even with a corresponding rich rule which should be allowing the traffic.
$ sudo firewall-cmd --list-all --zone=myzone
myzone (active)
  target: %%REJECT%%
  icmp-block-inversion: no
  interfaces:
  sources: 192.168.0.10/32
  services:
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:
    rule family="ipv4" destination address="0.0.0.0/0" allow
Note that I have tried to add 'priority' values above and below 0, but these have not had any effect. Why are my rich-rules being ignored?
Asked by StampyCode (101 rep)
Dec 27, 2024, 02:36 PM