# Firewall in Rocky 9 issue

**URL:** <https://forums.rockylinux.org/t/firewall-in-rocky-9-issue/13754>\
**Category:** Rocky Linux Help & Support\
**Created:** [April 26, 2024, 9:07am UTC](https://forums.rockylinux.org/t/firewall-in-rocky-9-issue/13754 "2024-04-26T09:07:17Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![liquasolutions](https://avatars.discourse-cdn.com/v4/letter/l/82dd89/32.png) [@liquasolutions](https://forums.rockylinux.org/u/liquasolutions)\
**Post date:** [April 26, 2024, 9:07am UTC](https://forums.rockylinux.org/t/firewall-in-rocky-9-issue/13754/1 "2024-04-26T09:07:17Z")

</div>

Hi,

I’m having very odd issue with firewalld.

So connection from outside router using VPN is can’t connect to the server.

This is my firewall rule in server:  
br0 is bridge interface that bridging with virtual server inside server.  
eno1 is connected to router.  
eno2 is not used.  
eno3 is connected to other server  
eno 4 is connected to Public IP

> nmcli c  
> NAME UUID TYPE DEVICE  
> eno4 479875f5-537d-4aba-95d5-e0d96b4635e5 ethernet eno4  
> br0 7a010243-b220-4b2b-9357-d5998c6d8e80 bridge br0  
> eno2 0bf0f8ff-0dc6-4db4-ab85-d91643ef2386 ethernet eno2  
> eno3 6bc358b6-1193-3f7e-a16e-4c06a6377d3e ethernet eno3  
> lo a767791c-cd40-499c-a667-16706ffdd429 loopback lo  
> virbr0 b9f12251-f2e8-49b8-9799-19ae3542e53b bridge virbr0  
> vnet0 a1c87b39-21e9-44b2-bdec-0acd4416f85a tun vnet0  
> bridge-slave-eno1 f59f3584-004c-4700-bdc9-ea29882fe960 ethernet eno1

> firewall-cmd --list-all  
> public (active)  
> target: default  
> icmp-block-inversion: no  
> interfaces: br0 eno1 eno2 eno3 eno4  
> sources:  
> services: cockpit dhcpv6-client freeipa-ldap freeipa-ldaps ssh  
> ports: 1812/udp 1813/udp 8069/tcp 8072/tcp 135/tcp 138/tcp 139/tcp 445/tcp 1024-1300/tcp 3268/tcp 138/udp 139/udp 389/udp 445/udp 8086/tcp  
> protocols:  
> forward: yes  
> masquerade: no  
> forward-ports:  
> source-ports:  
> icmp-blocks:  
> rich rules:

this happen when I tried to remove interface eno4 from public zone because I want use different zone for eno4 who is using Public IP

> sudo firewall-cmd --zone=public --remove-interface=eno4 --permanent

but every time I run that cmd, when I see in the list, it’s still in public zone  
and then I tried using this command:

> sudo firewall-cmd --zone=public --remove-interface=eno4 --runtime-to-permanen  
> sudo firewall-cmd --runtime-to-permanen

After his connection from outside router that using VPN can’t connect to server.  
I can’t find any solutions why this is happen.

Any help is very appreciate as not really familliar with firewalld.

Thank you

---

<div class="post-metadata">

**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\
**Post date:** [April 26, 2024, 9:32am UTC](https://forums.rockylinux.org/t/firewall-in-rocky-9-issue/13754/2 "2024-04-26T09:32:05Z")

</div>

> [@liquasolutions](#):
>
> sudo firewall-cmd --zone=public --remove-interface=eno4 --permanent

Two things:

- Every interface must be on some zone. Therefore, one cannot “remove” – one has to “set” the interface to new zone. Besides, the “public” in the default; if interface is not explicitly in any zone, then it is in the default …
- Use NetworkManager to set the zone of the connection:  
`nmcli con mod ${connection_of_eno4} connection.zone ${newzone}`

---

<div class="post-metadata">

**Author:** ![liquasolutions](https://avatars.discourse-cdn.com/v4/letter/l/82dd89/32.png) [@liquasolutions](https://forums.rockylinux.org/u/liquasolutions)\
**Post date:** [April 26, 2024, 9:37am UTC](https://forums.rockylinux.org/t/firewall-in-rocky-9-issue/13754/3 "2024-04-26T09:37:06Z")

</div>

Hi jlehtone,

Yes, I already add the zone again but still no luck.

> nmcli -p con show br0|grep connection.zone  
> connection.zone: public
> 
> nmcli -p con show eno4|grep connection.zone  
> connection.zone: public

All interface that are missing connection.zone I had added it again but still no luck.

> firewall-cmd --get-active-zones  
> libvirt  
> interfaces: virbr0  
> public  
> interfaces: br0 eno4 eno3 eno2 eno1

Thank you

---

<div class="post-metadata">

**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\
**Post date:** [April 26, 2024, 10:37am UTC](https://forums.rockylinux.org/t/firewall-in-rocky-9-issue/13754/4 "2024-04-26T10:37:34Z")

</div>

> [@liquasolutions](#):
>
> I want use different zone for eno4

> [@liquasolutions](#):
>
> Yes, I already add the zone again but still no luck.

Did you already tell what zone you want to use and was it the one that you did add?

This is how I would put eno4 to zone ‘external’ and check what happens:

```bash
nmcli -f connection.zone con show eno4
nft list ruleset | grep eno4
nmcli con mod eno4 connection.zone external
nmcli -f connection.zone con show eno4
nft list ruleset | grep eno4

```

* * *

> [@liquasolutions](#):
>
> After his connection from outside router that using VPN can’t connect to server.

Once you do get the connection to a different zone than the ‘public’, you have to do (up to two) things:

- Modify the new zone (e.g. ‘external’) to allow the VPN tunnel
- Add FirewallD _policies_ that define how/if traffic is allowed (to be routed/forwarded) between zones

---

<div class="post-metadata">

**Author:** ![liquasolutions](https://avatars.discourse-cdn.com/v4/letter/l/82dd89/32.png) [@liquasolutions](https://forums.rockylinux.org/u/liquasolutions)\
**Post date:** [April 26, 2024, 1:05pm UTC](https://forums.rockylinux.org/t/firewall-in-rocky-9-issue/13754/5 "2024-04-26T13:05:27Z")

</div>

Hi jlehtone,

> [@jlehtone](#):
>
> Did you already tell what zone you want to use and was it the one that you did add?

After broken the connection, I added back eno4 to public zone just to hope it will back again as before I removed eno4 from public.

Yes, before I broke it, I want eno4 in external zone.  
But now I just want to back it to public first before I decided moving to new zone.

> nmcli -f connection.zone con show eno4  
> connection.zone: public

> nft list ruleset | grep eno4  
> iifname “eno4” goto mangle\_PRE\_public  
> iifname “eno4” goto nat\_PRE\_public  
> oifname “eno4” goto nat\_POST\_public  
> iifname “eno4” goto filter\_IN\_public  
> iifname “eno4” goto filter\_FWD\_public  
> oifname “eno4” accept

as reference this is for br0:

> nft list ruleset | grep br0  
> iifname “virbr0” udp dport 53 counter packets 0 bytes 0 accept  
> iifname “virbr0” tcp dport 53 counter packets 0 bytes 0 accept  
> iifname “virbr0” udp dport 67 counter packets 0 bytes 0 accept  
> iifname “virbr0” tcp dport 67 counter packets 0 bytes 0 accept  
> oifname “virbr0” udp dport 53 counter packets 0 bytes 0 accept  
> oifname “virbr0” tcp dport 53 counter packets 0 bytes 0 accept  
> oifname “virbr0” udp dport 68 counter packets 0 bytes 0 accept  
> oifname “virbr0” tcp dport 68 counter packets 0 bytes 0 accept  
> iifname “virbr0” ip saddr 192.168.122.0/24 counter packets 0 bytes 0 accept  
> iifname “virbr0” counter packets 0 bytes 0 reject  
> oifname “virbr0” ip daddr 192.168.122.0/24 ct state related,established counter packets 0 bytes 0 accept  
> oifname “virbr0” counter packets 0 bytes 0 reject  
> iifname “virbr0” oifname “virbr0” counter packets 0 bytes 0 accept  
> oifname “virbr0” udp dport 68 counter packets 0 bytes 0 # CHECKSUM fill  
> iifname “br0” goto mangle\_PRE\_public  
> iifname “virbr0” goto mangle\_PRE\_libvirt  
> iifname “br0” goto nat\_PRE\_public  
> iifname “virbr0” goto nat\_PRE\_libvirt  
> oifname “br0” goto nat\_POST\_public  
> oifname “virbr0” goto nat\_POST\_libvirt  
> iifname “br0” goto filter\_IN\_public  
> iifname “virbr0” goto filter\_IN\_libvirt  
> iifname “br0” goto filter\_FWD\_public  
> iifname “virbr0” goto filter\_FWD\_libvirt  
> oifname “br0” accept

So. help me to back it to public zone first please.  
My subnet is 192.168.10.0/24  
My server IP 192.168.10.10  
My second server IP 192.168.10.5

Second server is normal, can be accessed from outside route using VPN.  
As information, I have 192.168.20.0/24 subnet that I used for openvpn user and work normal when user outside LAN connect to this subnet.

But other subnet can’t connect to 192.168.10.10 only as other IP in this subnet accessable.

Other subnet is using openvpn too.

In my mind, I thought to remove firewald and reinstall again in hope it will back to normal but I’m afraid will make worse.

Btw, I tried stop the firewalld service too but no luck, so don’t know what bloking other subnet to this server.

Thank you

---

<div class="post-metadata">

**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\
**Post date:** [April 26, 2024, 8:48pm UTC](https://forums.rockylinux.org/t/firewall-in-rocky-9-issue/13754/6 "2024-04-26T20:48:03Z")

</div>

Everything that you have shown indicates that the eno4 is in zone public.

Have you restarted the relevant services or whole server? A service that listens on port (like openvpn) could be affected by interfaces going down and up, so “fall off the boat” due to runtime changes. (Although, changes in firewall rules _ought_ to not affect.)

* * *

All FirewallD customizations are stored under /etc/firewalld/, so cleaning there would “reset to defaults”, except the ‘connection.zone’ that is stored in connections.

* * *

It would probably help to modify the ‘external’ zone (and policies) before you assign it to use in eno4.

---

<div class="post-metadata">

**Author:** ![liquasolutions](https://avatars.discourse-cdn.com/v4/letter/l/82dd89/32.png) [@liquasolutions](https://forums.rockylinux.org/u/liquasolutions)\
**Post date:** [April 27, 2024, 2:43am UTC](https://forums.rockylinux.org/t/firewall-in-rocky-9-issue/13754/7 "2024-04-27T02:43:31Z")

</div>

I think I find what is the culprit.  
It’s the routing.

After I deactivated the eno4, it’s normal.

So sorry for the trouble.

Seen now I have to configure the routing so it will work both with interface br0 and eno4.

Thank you

---

<div class="post-metadata">

**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\
**Post date:** [April 27, 2024, 9:53am UTC](https://forums.rockylinux.org/t/firewall-in-rocky-9-issue/13754/8 "2024-04-27T09:53:04Z")

</div>

Routing has three components:

#### Forwarding

The `net.ipv4.ip_forward` has to be `1` for at least IPv4 traffic to be forwarded from one interface to another. The ‘external’ zone seems to set that when active, but otherwise one has to set it explicitly.

Was `net.ipv4.ip_forward` affected by your earlier changes?

#### Netfilter

The firewall rules dictate whether the forwarded packets are allowed to pass through, or are dropped.  
The default is to allow replies on existing connections and one has to explicitly allow just the desired new connections.

In some cases it might be necessary to have dNAT or sNAT (aka masquerade) as well. (The ‘external’ enables that too for its interfaces.)

Shutting down FirewallD removes all filtering. Therefore, everything gets through and is not blocked; no effect on routing. It also removes NAT rules and if connections did depend on NAT, then that disturbs routed traffic.

#### Routes

Routes dictate where the packets are delivered to. To this machine or via which interface.

When interface gets IP address, the system gets a _link-local_ route to the subnet that the address is member of. The machine may also (optionally) get a _default route_ and static routes.

Logically, machine has at most one (active) default route. A “roadwarrior” VPN config changes default route when tunnel interface activates – “everything” outbound is sent via the tunnel. However, the VPN process must still continue to talk to the VPN partner through original interface.

One can see routes with `ip ro` (and also in output of `nmcli`).

---

<div class="post-metadata">

**Author:** ![liquasolutions](https://avatars.discourse-cdn.com/v4/letter/l/82dd89/32.png) [@liquasolutions](https://forums.rockylinux.org/u/liquasolutions)\
**Post date:** [April 28, 2024, 2:11am UTC](https://forums.rockylinux.org/t/firewall-in-rocky-9-issue/13754/9 "2024-04-28T02:11:28Z")

</div>

Hi jlehtone,

> [@jlehtone](#):
>
> #### Forwarding
> 
> The `net.ipv4.ip_forward` has to be `1` for at least IPv4 traffic to be forwarded from one interface to another. The ‘external’ zone seems to set that when active, but otherwise one has to set it explicitly.
> 
> Was `net.ipv4.ip_forward` affected by your earlier changes?

yes, the server already had this setting.

Thank you for the explanation about routing.  
It’s long time since I done some routing in server as most routing in our place is handle by mikrotik.

One again, thank you very much for the help

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/rockylinux/original/1X/91b7219eec10e30013422e4df76c1d898711a5d5.svg) [@system](https://forums.rockylinux.org/u/system)\
**Post date:** [June 27, 2024, 2:11am UTC](https://forums.rockylinux.org/t/firewall-in-rocky-9-issue/13754/10 "2024-06-27T02:11:41Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.