Firewalld hard troubble on HTTP/HTTPS

T

Trackoow

New Member
Joined
Apr 11, 2022
Messages
3
Reaction score
0
Credits
88
Hello, I am in a really trouble i don't understand why it can't works, if someone could help me it would be really nice !
I run 3 machines on virtualbox described below, centos8 stream is the virtual router and firewall DHCP and DNS server
But I cant have access to web browsers or http/https requests from the clients machines (xubu and nakedeb)
DNS is working correctly and resolving addresses, Clients are on DHCP working correctly with gateway and DNS in network configuration (dig google.com resolving with centos address),
I am totally lost, and desesperate, can someone rescue me please ?

-------------------------------------------------------

Here is my network map

-------------------------------------------------------
nakedeb
| Adapter 2 : enp0s8 : 192.168.10.20/24
|
| network vboxnet0 192.168.10.0/24
|
| Adapter 2 : enp0s8 : 192.168.10.30/24
centos8
| Adapter 3 : enp0s9 : 192.168.20.31/24
|
| network vboxnet1 192.168.20.0/24
|
| Adapter 2 : enp0s8 : 192.168.20.40/24
xubuntu

-------------------------------------------------------

Here is my commands of my firewall configuration on Centos :

-------------------------------------------------------

## Firewall Centos :

### Not running firewalld
sudo systemctl stop firewalld

### Reset firewalld
sudo rm -rf /etc/firewalld/zones/*

### Running firewalld
sudo systemctl enable firewalld
sudo systemctl start firewalld

### Public zone config
sudo firewall-cmd --permanent --zone=public --add-interface=enp0s3
sudo firewall-cmd --permanent --zone=public --add-interface=enp0s8
sudo firewall-cmd --permanent --zone=public --add-interface=enp0s9
sudo firewall-cmd --permanent --zone=public --add-masquerade
sudo firewall-cmd --permanent --zone=public --remove-service=ssh
sudo firewall-cmd --permanent --zone=public --set-target=DROP

### nakedeb zone config
sudo firewall-cmd --permanent --new-zone=nakedeb
sudo firewall-cmd --permanent --zone=nakedeb --add-source=192.168.10.20/32
sudo firewall-cmd --permanent --zone=nakedeb --add-source=192.168.10.30/32
sudo firewall-cmd --permanent --zone=nakedeb --set-target=DROP
sudo firewall-cmd --permanent --zone=nakedeb --add-icmp-block=echo-request
sudo firewall-cmd --permanent --zone=nakedeb --add-icmp-block=echo-reply
sudo firewall-cmd --permanent --zone=nakedeb --add-icmp-block-inversion
sudo firewall-cmd --permanent --zone=nakedeb --add-service=ssh
sudo firewall-cmd --permanent --zone=nakedeb --add-service=dns
sudo firewall-cmd --permanent --zone=nakedeb --add-service=dhcp
sudo firewall-cmd --permanent --zone=nakedeb --add-service=http
sudo firewall-cmd --permanent --zone=nakedeb --add-service=https

### xubu zone config
sudo firewall-cmd --permanent --new-zone=xubu
sudo firewall-cmd --permanent --zone=xubu --add-source=192.168.20.40/32
sudo firewall-cmd --permanent --zone=xubu --add-source=192.168.20.31/32
sudo firewall-cmd --permanent --zone=xubu --set-target=DROP
sudo firewall-cmd --permanent --zone=xubu --add-icmp-block=echo-request
sudo firewall-cmd --permanent --zone=xubu --add-icmp-block=echo-reply
sudo firewall-cmd --permanent --zone=xubu --add-icmp-block-inversion
sudo firewall-cmd --permanent --zone=xubu --add-service=ssh
sudo firewall-cmd --permanent --zone=xubu --add-service=dns
sudo firewall-cmd --permanent --zone=xubu --add-service=dhcp
sudo firewall-cmd --permanent --zone=xubu --add-service=http
sudo firewall-cmd --permanent --zone=xubu --add-service=https


### nat zone config
sudo firewall-cmd --permanent --new-zone=nat
sudo firewall-cmd --permanent --zone=nat --add-masquerade
sudo firewall-cmd --permanent --zone=nat --add-source=10.0.2.2
sudo firewall-cmd --permanent --zone=nat --add-source=10.0.2.15
sudo firewall-cmd --permanent --zone=nat --set-target=DROP
sudo firewall-cmd --permanent --zone=nat --set-target=DROP
sudo firewall-cmd --permanent --zone=nat --add-icmp-block=echo-request
sudo firewall-cmd --permanent --zone=nat --add-icmp-block=echo-reply
sudo firewall-cmd --permanent --zone=nat --add-icmp-block-inversion
sudo firewall-cmd --permanent --zone=nat --add-service=ssh
sudo firewall-cmd --permanent --zone=nat --add-service=http
sudo firewall-cmd --permanent --zone=nat --add-service=https

### firewalld reboot and runtime permanent
sudo firewall-cmd --reload
sudo firewall-cmd --runtime-to-permanent

----------------------------------------------------------------

Here are the f****** not throwing rules, for exemple on xubu machine

----------------------------------------------------------------

avril 11 20:59:43 cento1 kernel: "filter_FWDI_xubu_DROP: "IN=enp0s9 OUT=enp0s3 MAC=08:00:27:8a:65:3f:08:00:27:b0:12:a3:08:00 SRC=192.168.20.40 DST=142.250.74.238 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=36105 DF PROTO=TCP SPT=43520 DPT=443 W>
avril 11 20:59:44 cento1 kernel: "filter_FWDI_xubu_DROP: "IN=enp0s9 OUT=enp0s3 MAC=08:00:27:8a:65:3f:08:00:27:b0:12:a3:08:00 SRC=192.168.20.40 DST=142.250.74.238 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=45802 DF PROTO=TCP SPT=43522 DPT=443 W>
avril 11 20:59:44 cento1 kernel: "filter_FWDI_xubu_DROP: "IN=enp0s9 OUT=enp0s3 MAC=08:00:27:8a:65:3f:08:00:27:b0:12:a3:08:00 SRC=192.168.20.40 DST=142.250.74.238 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=60210 DF PROTO=TCP SPT=43524 DPT=443 W>
avril 11 20:59:44 cento1 kernel: "filter_FWDI_xubu_DROP: "IN=enp0s9 OUT=enp0s3 MAC=08:00:27:8a:65:3f:08:00:27:b0:12:a3:08:00 SRC=192.168.20.40 DST=142.250.74.238 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=26114 DF PROTO=TCP SPT=43526 DPT=443 W>
avril 11 20:59:44 cento1 kernel: "filter_FWDI_xubu_DROP: "IN=enp0s9 OUT=enp0s3 MAC=08:00:27:8a:65:3f:08:00:27:b0:12:a3:08:00 SRC=192.168.20.40 DST=142.250.74.238 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=48559 DF PROTO=TCP SPT=43518 DPT=443 W>
avril 11 20:59:44 cento1 kernel: "filter_FWDI_xubu_DROP: "IN=enp0s9 OUT=enp0s3 MAC=08:00:27:8a:65:3f:08:00:27:b0:12:a3:08:00 SRC=192.168.20.40 DST=142.250.74.238 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=14493 DF PROTO=TCP SPT=43528 DPT=443 W>
avril 11 20:59:44 cento1 kernel: "filter_FWDI_xubu_DROP: "IN=enp0s9 OUT=enp0s3 MAC=08:00:27:8a:65:3f:08:00:27:b0:12:a3:08:00 SRC=192.168.20.40 DST=142.250.74.238 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=36106 DF PROTO=TCP SPT=43520 DPT=443 W>
avril 11 20:59:45 cento1 kernel: "filter_FWDI_xubu_DROP: "IN=enp0s9 OUT=enp0s3 MAC=08:00:27:8a:65:3f:08:00:27:b0:12:a3:08:00 SRC=192.168.20.40 DST=142.250.74.238 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=26115 DF PROTO=TCP SPT=43526 DPT=443 W>
avril 11 20:59:45 cento1 kernel: "filter_FWDI_xubu_DROP: "IN=enp0s9 OUT=enp0s3 MAC=08:00:27:8a:65:3f:08:00:27:b0:12:a3:08:00 SRC=192.168.20.40 DST=142.250.74.238 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=60211 DF PROTO=TCP SPT=43524 DPT=443 W>
avril 11 20:59:45 cento1 kernel: "filter_FWDI_xubu_DROP: "IN=enp0s9 OUT=enp0s3 MAC=08:00:27:8a:65:3f:08:00:27:b0:12:a3:08:00 SRC=192.168.20.40 DST=142.250.74.238 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=45803 DF PROTO=TCP SPT=43522 DPT=443 W>
avril 11 20:59:45 cento1 kernel: "filter_FWDI_xubu_DROP: "IN=enp0s9 OUT=enp0s3 MAC=08:00:27:8a:65:3f:08:00:27:b0:12:a3:08:00 SRC=192.168.20.40 DST=142.250.74.238 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=14494 DF PROTO=TCP SPT=43528 DPT=443 W>
avril 11 20:59:46 cento1 kernel: "filter_FWDI_xubu_DROP: "IN=enp0s9 OUT=enp0s3 MAC=08:00:27:8a:65:3f:08:00:27:b0:12:a3:08:00 SRC=192.168.20.40 DST=142.250.74.238 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=48560 DF PROTO=TCP SPT=43518 DPT=443 W>
avril 11 20:59:46 cento1 kernel: "filter_FWDI_xubu_DROP: "IN=enp0s9 OUT=enp0s3 MAC=08:00:27:8a:65:3f:08:00:27:b0:12:a3:08:00 SRC=192.168.20.40 DST=142.250.74.238 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=36107 DF PROTO=TCP SPT=43520 DPT=443 W>
 


A firewall isn't really a router. Simply allowing IPs and ports doesn't make it route them.
What are you routing to and from?
My guess is... you want to talk to your VMs directly from your home LAN?

The quickest and easiest way to accomplish this, is make the NIC on your VM bridged instead of NAT.
Just give it an IP address (or let DHCP do it) on your LAN network.

But even if you want to have a middle layer ( DNS/DHCP) you will still have to either a router
or a bridged interface.

Here is a link to setting up Linux as a router.
www.tecmint.com

How to Turn a Linux Server into a Router to Handle Traffic Statically and Dynamically - Part 10

In this article we will discuss, how to setup Linux server as router to route IP traffic statically and dynamically with specific applications in Linux.
www.tecmint.com www.tecmint.com

But I recommend, you get the easy stuff working before you tackle the harder stuff.
 
www.redhat.com

A beginner's guide to firewalld in Linux

The firewall is essential for controlling the flow of network traffic in and out of the Linux server. In this article, you'll display, add, and remove firewalld rules.
www.redhat.com www.redhat.com

Home

Welcome to the firewalld project homepage! Firewalld provides a dynamically managed firewall with support for network/firewall zones that defines the trust level of network connections or interfaces.
firewalld.org firewalld.org
 
Centos have routes to default, 0.0.0.0 on enp0s3
and 192.168.10.0/24 on enp0s8 and 192.168.20.0/24 on enp0s9. I already pushed it but i didn't mention it in the post.
I don't want especially access to the VM from the LAN, I just want that my VM could communicate with WAN by something else than ICMP.
 
I try this afternoon with bridging interface it could simplify few things eventually
 
You must log in or register to reply here.

Members online

Total: 414 (members: 5, guests: 409)

Latest posts

Top