# Firewall Configuration **URL:** \ **Category:** Rocky Linux Help & Support\ **Tags:** rocky-linux-9\ **Created:** [January 19, 2024, 11:09am UTC](https://forums.rockylinux.org/t/firewall-configuration/12564 "2024-01-19T11:09:54Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![barani\_pd](https://avatars.discourse-cdn.com/v4/letter/b/9f8e36/32.png) [@barani\_pd](https://forums.rockylinux.org/u/barani_pd)\ **Post date:** [January 19, 2024, 11:09am UTC](https://forums.rockylinux.org/t/firewall-configuration/12564/1 "2024-01-19T11:09:54Z")
Hi, Greetings! I need some help in configuring firewalld for my Rocky Linux 9.3 setup as a router. My setup is appended below: - Two NICs configured with in on zone “internal” and on zone “external”. A static route is created to which routed via on . With firewalld service running I am able to ping any host on from a host on . but not able to avail services on . If I stop firewalld service I am able to access the services on but no internet access through . Please help me. Thanking everyone in advance. ---
**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\ **Post date:** [January 19, 2024, 11:33am UTC](https://forums.rockylinux.org/t/firewall-configuration/12564/2 "2024-01-19T11:33:33Z")
See [RL9.3 firewalld 2 zones - #3 by jlehtone](https://forums.rockylinux.org/t/rl9-3-firewalld-2-zones/12418/3) ---
**Author:** ![barani\_pd](https://avatars.discourse-cdn.com/v4/letter/b/9f8e36/32.png) [@barani\_pd](https://forums.rockylinux.org/u/barani_pd)\ **Post date:** [January 19, 2024, 12:23pm UTC](https://forums.rockylinux.org/t/firewall-configuration/12564/3 "2024-01-19T12:23:02Z")
Hi @jlehtone Thanks for the response. With the static routing, firewalld rules and policies I am able to browse internet from all internal hosts. But unable to avail services from another private network. The data has to flow through internal nic to another gateway which is not happening. ---
**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\ **Post date:** [January 19, 2024, 11:01pm UTC](https://forums.rockylinux.org/t/firewall-configuration/12564/4 "2024-01-19T23:01:31Z")
Lets try to be more clear. There are clearly at least two subnets? I’ll call the first two “LAN” and “WAN”. Lets say the LAN is 10.0.0.0/24 and WAN is 10.20.0.0/24 for the example. Everyone, who has interface on LAN does have automatic, link-local route `to 10.0.0.0/24 from interface`. The Rocky router has interface “internal” on LAN and it has address 10.0.0.254. Everybody else on LAN has `default via 10.0.0.254` The Rocky router has interface “external” on LAN and it has address 10.20.0.1. Therefore, it has another link-local route `to 10.20.0.0/24 from external`. Presumably, the WAN has an another router (10.20.0.254) too, the gateway _to elsewhere_, and the Rocky has therefore route `default via 10.20.0.254` * * * Given that base, what/where is the “another private network”? ---
**Author:** ![barani\_pd](https://avatars.discourse-cdn.com/v4/letter/b/9f8e36/32.png) [@barani\_pd](https://forums.rockylinux.org/u/barani_pd)\ **Post date:** [January 20, 2024, 6:35am UTC](https://forums.rockylinux.org/t/firewall-configuration/12564/5 "2024-01-20T06:35:57Z")
The another router is not on the WAN, but on LAN. I have another network 10.10.0.0/24 for which the route is via 10.0.0.253 (which is same LAN, static routed). If I stop firewalld, I could avail services from the network 10.10.0.0/24 but no internet on WAN. If I start firewalld, I could avail service of internet from WAN but no services from network 10.10.0.0/24. ---
**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\ **Post date:** [January 20, 2024, 9:43am UTC](https://forums.rockylinux.org/t/firewall-configuration/12564/6 "2024-01-20T09:43:51Z")
In other words, the LAN has a _second_ router with address 10.0.0.253 that is the gateway to SRV 10.10.0.0/24? Logically, every member of LAN has additional route: `to 10.10.0.0/24 via 10.0.0.253` (that I would give them via DHCP). Since this would have nothing to do with the Rocky router, its config should not matter. ---
**Author:** ![barani\_pd](https://avatars.discourse-cdn.com/v4/letter/b/9f8e36/32.png) [@barani\_pd](https://forums.rockylinux.org/u/barani_pd)\ **Post date:** [January 20, 2024, 10:36am UTC](https://forums.rockylinux.org/t/firewall-configuration/12564/7 "2024-01-20T10:36:24Z")
Yes. All the windows hosts in 10.0.0.0/24 has 10.0.0.254 as gateway. So traffic has path like host \> 10.0.0.254 \> 10.0.0.253 \> 10.10.0.0/24 and back. This is working with my other similar setup. In it is Rocky Linux 9.0. As the HDD of that system is about fail I am installing latest Rocky Linux 9.3 but encountering this problem. However I planning to re-install Rocky Linux 9.0 and hope that will work. Thank you for your responses. ---
**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\ **Post date:** [January 20, 2024, 12:18pm UTC](https://forums.rockylinux.org/t/firewall-configuration/12564/8 "2024-01-20T12:18:09Z")
> [@barani\_pd](#): > > So traffic has path like host \> 10.0.0.254 \> 10.0.0.253 \> 10.10.0.0/24 and back. Ok, host (10.0.0.3) creates a packet: SRC=10.0.0.3 DST=10.10.0.7 Not link-local, so it goes to 10.0.0.254. Router A has route to 10.10.0.0/24, so it forwards the SRC=10.0.0.3 DST=10.10.0.7 to B 10.0.0.253. Router B forwards SRC=10.0.0.3 DST=10.10.0.7 towards destination. 10.10.0.7 creates a reply and it gets to router B. Where does B send SRC=10.10.0.7 DST=10.0.0.3? To link-local 10.0.0.3. All that seems ok, despite the asymmetry. Except perhaps the fact that A receives from internal zone and forwards it to internal zone. Same interface, nonetheless. Does internal zone allow such forwards? You can check the actual rules from kernel with: ```auto nft list ruleset ``` Are there rules to allow the intra-zone forward? * * * IMHO, it would be much cleaner if all the hosts on LAN had the static route. As said, one can (and should) use DHCP to configure them. ---
**Author:** ![barani\_pd](https://avatars.discourse-cdn.com/v4/letter/b/9f8e36/32.png) [@barani\_pd](https://forums.rockylinux.org/u/barani_pd)\ **Post date:** [January 22, 2024, 10:29am UTC](https://forums.rockylinux.org/t/firewall-configuration/12564/9 "2024-01-22T10:29:55Z")
Hi @jlehtone As said earlier, created the static routes during re-installation of Rocky Linux 9.3 and completed setup. Now my requirements are satisfied. Thanks for your support. ---
**Author:** ![achen](https://avatars.discourse-cdn.com/v4/letter/a/838e76/32.png) [@achen](https://forums.rockylinux.org/u/achen)\ **Post date:** [January 26, 2024, 5:06pm UTC](https://forums.rockylinux.org/t/firewall-configuration/12564/10 "2024-01-26T17:06:11Z")
If I want to use a Linux box as firewall, then I’d use iptables, and remove any other firewall tools and even NetworkManager. This makes my life 10 times easier. The OP’s issue can be fixed instead of the re-installation of the OS. Based on jlehtone’s analysis, I would like to fix the asymmetrical path. I put two options here: Option 1: To allow asymmetry in this case, add a FORWARD rule like this: FORWARD -s 10.0.0.0/24 -d 10.10.0.0/24 -m state --state INVALID -j ACCEPT Be care of the order of this rule. Put it before a similar DROP rule, something like this: FORWARD -m state --state INVALID -j DROP Option 2: To avoid asymmetry, then add a POSTROUTING rule: POSTROUTING -s 10.0.0.0/24 -d 10.10.0.0/24 -j MASQUERADE So choose one of options, it should work. But anyway we need a clear picture of firewall rules. ---
**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\ **Post date:** [January 26, 2024, 7:06pm UTC](https://forums.rockylinux.org/t/firewall-configuration/12564/11 "2024-01-26T19:06:57Z")
> [@achen](#): > > If I want to use a Linux box as firewall, then I’d use iptables, and remove any other firewall tools and even NetworkManager. This makes my life 10 times easier. When you know what you are doing, (although with FirewallD knowing does not seem to help as much). RHEL 8 and RHEL 9 (and hence both Rocky) does have _nf-tables_ in kernel. (In fact, Red Hat did backport nf-tables into RHEL 7 kernel too.) There is thus no more legacy iptables in Rocky, the command ‘iptables’ is a mere wrapper to nftables, the tool to use is `nft`, and the corresponding alternative to firewalld.service is `nftables.service`. Therefore, > If I want to use a Linux box as firewall, then I’d use _nftables_, … * * * Red Hat does push NetworkManager, and with package `NetworkManager-config-server` it “behaves” decently. Add use of _Ansible_ role `rhel-system-roles.network` and you don’t have to talk to NetworkManager directly. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/rockylinux/original/1X/91b7219eec10e30013422e4df76c1d898711a5d5.svg) [@system](https://forums.rockylinux.org/u/system)\ **Post date:** [March 26, 2024, 7:07pm UTC](https://forums.rockylinux.org/t/firewall-configuration/12564/12 "2024-03-26T19:07:13Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.