[SOLVED] firewalld doesn't appear to be blocking traffic.

archexplorer · 2024-12-19 02:12:48

I'm testing firewalld by enabling ssh on my client to see if the firewall blocks the port.

I accidentally installed ufw but have uninstalled it.

I installed firewalld and it's components with pacman -Syu firewalld ipset ebtables

I've enabled firewalld with sudo systemctl enable --now firewalld

I'm able to use the GUI and the terminal to make changes to firewalld, and I disabled ssh permanently, and reloaded the tables.

After enabling ssh by running sudo systemctl enable --now sshd, when i run an nmap of my machine, I can see port 22 is open, and when I try to make ssh connections to it, it does ask for a keyfile (I obviously disabled passwords for security purposes).

Can anyone explain too me what is probably happening here?

Last edited by archexplorer (2024-12-19 16:34:39)

archexplorer · 2024-12-19 02:23:06

For added context, it appears like it's doing nothing, because my KVM windows machine can see the internet.

-thc · 2024-12-19 05:35:10

archexplorer wrote:

[...] it appears like it's doing nothing. [...]

It can't. firewalld creates nftables rules.

pacman -Rsn ipset ebtables
pacman -S nftables iptables-nft

cryptearth · 2024-12-19 07:22:25

-thc wrote:

archexplorer wrote:
[...] it appears like it's doing nothing. [...]
It can't. firewalld creates nftables rules.
pacman -Rsn ipset ebtables
pacman -S nftables iptables-nft

according to its docs firewalld can use iptables, nftables and ebtables as its backends - so it shouldn't matter which is used

@OP
by default a firewall does nothing because it has no rules to act on - so there's no "default: block all" - for that you have to set the required rules
also: order is important: when you want to allow something the allow rule has to come before any deny rule - as if something is denied first it can't be allowed afterwards

seth · 2024-12-19 08:34:50

nb that nftables might hit you with a simple stateful (and aggressive) firewall set of rules by default, https://wiki.archlinux.org/title/Nftabl … e_firewall

cryptearth · 2024-12-19 13:52:24

in addition to seth:
be aware when using the firewall-cmd frontend with ipv6 - that doesn't work directly but requires rich rules
all regular syntax only work with ipv4 properly
example: if you add a ipv6 to a block list like so it will block all incoming traffic due to this issue

firewall-cmd --permanent --add-source=ipv6
firewall-cmd --reload

the proper way for ipv6 requires rich rules

archexplorer · 2024-12-19 16:30:09

Thanks for the help, everyone! But goodness, ignore me. I didn't have access to another machine, and termux was being weird. I found out it was because I was performing an nmap from the local machine, so it was showing me ssh, even though the firewall must have been filtering it. I tested this on a VPS I spun up really quickly, and found when I ran

firewall-cmd --zone=public --remove-service=ssh --permanent
firewall-cmd --reload / systemctl restart firewalld

And then tried to initiate an SSH session, which I couldn't. In the terminal of the VPS, however, when running an nmap of my IP, I saw ssh still there on port 22.
When running the nmap from my laptop to the vps, the port was closed!

It looks like the firewall is behaving normally.

Last edited by archexplorer (2024-12-19 16:31:49)

cryptearth · 2024-12-20 00:40:10

if you want to play around with local stuff you require some tricks like this:
ipv6 rich rules https://major.io/p/forwarding-ports-with-firewalld/
local stuff https://serverfault.com/questions/10047 … k-redirect
I use this on my mail server to redirect the common ports to some above 1024 to run the mailserver as non-root - and have the netfilter do its stuff

-thc · 2024-12-20 05:56:27

Off topic:

cryptearth wrote:

according to its docs firewalld can use iptables, nftables and ebtables as its backends [...]

Yep - my bad. I installed firewalld on an Arch system without any *tables and it only pulled nftables as a dependency. Wrong assumption.

Arch Linux

#1 2024-12-19 02:12:48

[SOLVED] firewalld doesn't appear to be blocking traffic.

#2 2024-12-19 02:23:06

Re: [SOLVED] firewalld doesn't appear to be blocking traffic.

#3 2024-12-19 05:35:10

Re: [SOLVED] firewalld doesn't appear to be blocking traffic.

#4 2024-12-19 07:22:25

Re: [SOLVED] firewalld doesn't appear to be blocking traffic.

#5 2024-12-19 08:34:50

Re: [SOLVED] firewalld doesn't appear to be blocking traffic.

#6 2024-12-19 13:52:24

Re: [SOLVED] firewalld doesn't appear to be blocking traffic.

#7 2024-12-19 16:30:09

Re: [SOLVED] firewalld doesn't appear to be blocking traffic.

#8 2024-12-20 00:40:10

Re: [SOLVED] firewalld doesn't appear to be blocking traffic.

#9 2024-12-20 05:56:27

Re: [SOLVED] firewalld doesn't appear to be blocking traffic.

Board footer