help with firewalld

marozsas · 02-20-2024, 07:03 PM

Hi,

I am trying to replace a source IP (192.168.1.40) in the zone "trusted" by another IP (192.168.15.105), but the previous IP refuses to be removed and the new IP didn't show up , but the command says it already in...What I am doing wrong ?

Code:

mastodon:~ # firewall-cmd --get-zones
block dmz docker drop external home internal libvirt libvirt-routed nm-shared public trusted work
mastodon:~ # firewall-cmd --list-sources --zone=trusted
192.168.1.40
mastodon:~ # firewall-cmd --zone=trusted --remove-source=192.168.1.40 --permanent
success
mastodon:~ # firewall-cmd --list-sources --zone=trusted
192.168.1.40
mastodon:~ # firewall-cmd --zone=trusted --add-source=192.168.15.105 --permanent
success
mastodon:~ # firewall-cmd --list-sources --zone=trusted
192.168.1.40
mastodon:~ # firewall-cmd --zone=trusted --add-source=192.168.15.105 --permanent
Warning: ALREADY_ENABLED: 192.168.15.105
success
mastodon:~ # firewall-cmd --list-sources --zone=trusted
192.168.1.40
mastodon:~ #

PS: Never mind, I realized that `--permanent` only change the settings for the next reload of rules, not the current one. And that the `--list-sources` display the current set of rules that `--permanent` didn´t modified ! Ouch !
TLDR; run the add/remove commands, then `systemctl reload firewalld` and after that the listing will be updated.

ferrari · 02-20-2024, 07:32 PM

That is because you're applying changes to the permanent configuration, and reading from the runtime configuration.

Check

Code:

firewall-cmd --list-sources --zone=trusted --permanent

and reload firewall with

Code:

firewall-cmd --reload

then check runtime config again

Code:

firewall-cmd --list-sources --zone=trusted

ferrari · 02-20-2024, 07:46 PM

For your future reference:
https://docs.fedoraproject.org/en-US...anent_settings