After taking an update for firewalld, the config file is being replaced with a new one (Nov 4) with “new” config variables that the the updated firewalld doesn’t like. Oddly if I use the firewalld.conf from 9.4 against the updated firewalld it doesn’t have these Errors/Warnings.
I happened to check the github project for firewalld and see these config variables recently updated. Possible that the firewalld in the 9.5 repo and the config are out of sync regarding these new features?
firewalld-1.3.4-7.el9.noarch
Errors in /var/log/messages
firewalld[942]: ERROR: Invalid option: 'ReloadPolicy=INPUT:DROP,FORWARD:DROP,OUTPUT:DROP'
firewalld[942]: ERROR: Invalid option: 'NftablesTableOwner=yes'
firewalld[942]: WARNING: IPv6_rpfilter 'strict' is not valid, using default value True
firewalld[942]: ERROR: Invalid option: 'ReloadPolicy=INPUT:DROP,FORWARD:DROP,OUTPUT:DROP'
firewalld[942]: ERROR: Invalid option: 'NftablesTableOwner=yes'
firewalld[942]: WARNING: IPv6_rpfilter 'strict' is not valid, using default value True
Previous firewalld.conf vs new firewalld.conf
old
# IPv6_rpfilter
# Performs a reverse path filter test on a packet for IPv6. If a reply to the
# packet would be sent via the same interface that the packet arrived on, the
# packet will match and be accepted, otherwise dropped.
# The rp_filter for IPv4 is controlled using sysctl.
# Note: This feature has a performance impact. See man page FIREWALLD.CONF(5)
# for details.
# Default: yes
IPv6_rpfilter=yes
New (Nov 4)
# IPv6_rpfilter
# Performs reverse path filtering (RPF) on IPv6 packets as per RFC 3704.
# Possible values:
# - strict: Performs "strict" filtering as per RFC 3704. This check
# verifies that the in ingress interface is the same interface
# that would be used to send a packet reply to the source. That
# is, ingress == egress.
# - loose: Performs "loose" filtering as per RFC 3704. This check only
# verifies that there is a route back to the source through any
# interface; even if it's not the same one on which the packet
# arrived.
# - strict-forward: This is almost identical to "strict", but does not perform
# RPF for packets targeted to the host (INPUT).
# - loose-forward: This is almost identical to "loose", but does not perform
# RPF for packets targeted to the host (INPUT).
# - no: RPF is completely disabled.
#
# The rp_filter for IPv4 is controlled using sysctl.
# Note: This feature has a performance impact. See man page FIREWALLD.CONF(5)
# for details.
# Default: strict
IPv6_rpfilter=strict
Old
Reload Policy did not exist
New (Nov 4)
# ReloadPolicy
# Policy during reload. By default all traffic except for established
# connections is dropped while the rules are updated. Set to "DROP", "REJECT"
# or "ACCEPT". Alternatively, specify it per table, like
# "OUTPUT:ACCEPT,INPUT:DROP,FORWARD:REJECT".
# Default: ReloadPolicy=INPUT:DROP,FORWARD:DROP,OUTPUT:DROP
ReloadPolicy=INPUT:DROP,FORWARD:DROP,OUTPUT:DROP
Old
NfttablesTableOwner did not exist
New (Nov 4)
# NftablesTableOwner
# If set to yes, the generated nftables rule set will be owned exclusively by
# firewalld. This prevents other entities from mistakenly (or maliciously)
# modifying firewalld's rule set. If you intentionally modify firewalld's
# rules, then you will have to set this to "no".
# Defaults to "yes".
NftablesTableOwner=yes