[SOLVED] I want to add/convert an iptables rule to Firewalld

RadicalDreamer · 11-14-2020, 05:41 PM

Here is the iptables rule I wish to add to Firewalld:

Code:

iptables -A OUTPUT -o eth0 -m owner --gid-owner 1001 -j DROP

I'm helping someone get openSUSE Leap 15.2 working and I want to keep one of their groups from accessing the internet through a specific interface.

ferrari · 11-14-2020, 07:18 PM

It is firewalld direct rules that you need to investigate...
https://firewalld.org/documentation/...ld.direct.html

Based on the rule you supplied, something like the following...

Code:

firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 -o eth0 -m owner --gid-owner 1001 -j DROP

The direct rule is added to /etc/firewalld/direct.xml, and will take effect when firewalld is next restarted

Code:

systemctl restart firewalld

Some examples to hep give you more of an idea about this...
https://serverfault.com/questions/70...h-firewall-cmd
https://access.redhat.com/discussions/3238521

ferrari · 11-14-2020, 07:20 PM

PS: You can make a similar rule for IPv6 if required.

RadicalDreamer · 11-14-2020, 11:17 PM

Thank you ferrai, that rule you gave me worked!

ferrari · 11-15-2020, 12:17 AM

Glad to have been of guidance. The rule wasn't mine - it was the rule you posted, but applied as a firewalld direct rule (and as per the documentation I linked to).