[CentOS] Firewalld

[Emmett Culley]

On 10/12/2015 10:17 AM, Gordon Messmer wrote:
> On 10/11/2015 03:00 PM, Emmett Culley wrote:
>> I just noticed that when rebooting a CentOS 7 server the firewall comes back up with both interfaces set to REJECT, instead of the eth1 interface set to ACCEPT as defined in 'permanent' firewalld configuration files.
> 
> Rather than paraphrasing, could you show the specific rules, chains, or policies you're talking about?  A standard firewalld rule set has the INPUT policy set to ACCEPT, with a terminal REJECT rule.  An INPUT_ZONES table will direct to an IN_public table, with log, deny, and accept rules.
> 
> Typically, the only rule that references an interface is the one in INPUT_ZONES that "goto"s IN_public_allow.  It is neither REJECT nor ACCEPT, so it's really hard to guess what you're seeing that you don't expect to see.
> 
> _______________________________________________
> CentOS mailing list
> CentOS at centos.org
> https://lists.centos.org/mailman/listinfo/centos
> 

Contents of iptables INPUT_ZONE upon reboot

-----------------------------------------------
[root at dev2 ~]# iptables -nL INPUT_ZONES
Chain INPUT_ZONES (1 references)
target     prot opt in     out     source               destination         
IN_public all  -- eth0 * 0.0.0.0/0 0.0.0.0/0
IN_public all  -- eth1 * 0.0.0.0/0 0.0.0.0/0
IN_public all  -- +      *       0.0.0.0/0            0.0.0.0/0           

-----------------------------------------------

Contents on iptables INPUT_ZONE after running 'systemctl restrat firewalld'

-----------------------------------------------
[root at dev2 ~]# iptables -nL INPUT_ZONES
Chain INPUT_ZONES (1 references)
target     prot opt in     out     source               destination         
IN_trusted  all  --  eth1   *       0.0.0.0/0            0.0.0.0/0           
IN_public  all  --  eth0   *       0.0.0.0/0            0.0.0.0/0           
IN_public  all  --  +      *       0.0.0.0/0            0.0.0.0/0           

-----------------------------------------------

I expect to see the second output upon reboot.

Emmett