#5392 Several FirewallD module bugs/inconsistencies
Hello,
I've found that the FirewallD module contains a few bugs and/or inconsistensies.
First, when a zone contains at least one source ip, the zone is in active use by FirewallD. This source adress is not reported in the module. Also, the module reports there are not open ports or services for that zone. This is not true as all traffic allowed from the defined source(s).
Lastly, to me it's unclear what the green "change" button does. Changing the zone in the pull down menu already triggers a pageload to the selected zone.
FirewallD output below and module output on "trusted" zone.
root@dexter:~# firewall-cmd --zone=trusted --list-all
trusted (active)
target: ACCEPT
icmp-block-inversion: no
interfaces:
sources: xx.xx.xx.155 [redacted]
services:
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
root@dexter:~# firewall-cmd --get-active-zones
public
interfaces: eth0
trusted
sources: xx.xx.xx.155 [redacted]
Thank you for reading. If there's anything I can do to help, please let me know!
Reach rules are not supported yet.
That works for me for default (public by default) zone.
Yes, this button is redundant, we'll fix it.
Change button will not be shown anymore.
https://github.com/webmin/webmin/commit/275967cb7dd66b1dca7c6486431bb69ad55bb04c
Ilia, thank you for responding so quickly.
I'm assuming you mean rich rules? This is not the case. The trusted zone is empty with no services or ports defined. It has a default target "ACCEPT". The zone is disabled by default but becomes active once you add a source ip. Because of this, the statement that there are no open ports or services on that zone is also false because all traffic is accepted from the source address once it is defined.