[SOLVED] firewalld not opening ports

baldur_1 · 01-08-2023, 06:33 PM

okay, just to be clear, i have several threads opens under different titles but i THINK they are all related. i have traced the issue down to firewalld. i can add a service to firewall...

Code:

firewall-cmd --zone=xxx --add-service=samba
firewall-cmd --zone=xxx --add-service=samba --permanent

then i go to check...

Code:

firewall-cmd --zone=xxx --list-all

[root@Bor samba]# firewall-cmd --zone=xxx --list-all
xxx (active)
  target: default
  icmp-block-inversion: no
  interfaces: enp7s0f0
  sources: 192.168.0.10
  services: dhcp dhcpv6-client mdns samba samba-client ssh
  ports: 139/tcp 445/tcp
  protocols:
  forward: yes
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

i even added the ports as you can see above but when i nmap from my pc to my server...

Code:

[root@Odin bor]# nmap 192.168.0.1
Starting Nmap 7.93 ( https://nmap.org ) at 2023-01-08 18:17 CST
Nmap scan report for japru.com (192.168.0.1)
Host is up (0.00019s latency).
Not shown: 988 filtered tcp ports (no-response), 11 filtered tcp ports (admin-prohibited)
PORT   STATE SERVICE
22/tcp open  ssh
MAC Address: xxx

Nmap done: 1 IP address (1 host up) scanned in 5.10 seconds

and netstat -nlpn | grep smb

Code:

[root@Bor samba]# netstat -nlpn | grep smbd
tcp        0      0 0.0.0.0:445             0.0.0.0:*               LISTEN      1915/smbd
tcp        0      0 0.0.0.0:139             0.0.0.0:*               LISTEN      1915/smbd
tcp6       0      0 :::445                  :::*                    LISTEN      1915/smbd
tcp6       0      0 :::139                  :::*                    LISTEN      1915/smbd

shows it is not binding to the ip. the firewall is blocking it from working right. when i take the firewall down, everything immediately works but when i put it back up, it no longer works. when i initially installed fc36, it worked fine. however i was getting another error so i took it down and restarted it and it no longer opens ports like it should. in fc37, it doesnt open them at all.

like i said, i am now 100% certain it is firewalld not opening ports but i am not sure where to go with that from here...

ferrari · 01-08-2023, 08:37 PM

Can you show the interface name and IP address?

Code:

ip a

Just so we can compare it with your zone assignment explicitly.

Also, the output from...

Code:

ss -tlpn | grep smb

ferrari · 01-08-2023, 08:40 PM

Just in case this is relevant (re Fedora zones)...
https://unix.stackexchange.com/quest...ll-is-disabled

baldur_1 · 01-09-2023, 04:20 AM

the first...(i removed my external ips and some macs)

Code:

[root@Bor daniel]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: enp4s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN group default qlen 1000
    link/ether xxxx brd xxxx
3: enp3s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN group default qlen 1000
    link/ether xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff
4: enp7s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.1/24 brd 192.168.0.255 scope global noprefixroute enp7s0f0
       valid_lft forever preferred_lft forever
    inet6 fe80::a236:9fff:fe28:a2c/64 scope link noprefixroute
       valid_lft forever preferred_lft forever
5: enp7s0f1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff
    inet xx.xx.xx.xx brd xx.xx.xx.xx scope global dynamic noprefixroute enp7s0f1
       valid_lft 4975sec preferred_lft 4975sec
    inet6 xx:xx:xx:xx:xx scope link noprefixroute
       valid_lft forever preferred_lft forever

the other...

Code:

[root@Bor daniel]# ss -tlpn | grep smb
LISTEN 0      50           0.0.0.0:445        0.0.0.0:*    users:(("smbd",pid=1915,fd=31))         
LISTEN 0      50           0.0.0.0:139        0.0.0.0:*    users:(("smbd",pid=1915,fd=32))         
LISTEN 0      50              [::]:445           [::]:*    users:(("smbd",pid=1915,fd=29))         
LISTEN 0      50              [::]:139           [::]:*    users:(("smbd",pid=1915,fd=30))

one of the checks i did was add this to the trusted zone and check if i could connect through. that defaults to accept. it did not. i also took it down and was able to connect through...back up, no joy again...and i also checked the output of nftables the best i could and found no rules being put through.

right now i am reasonably certain that my server is secure otherwise i would pull it down. i might try putting the backend to iptables and see if that works with firewalld but more than likely, it will not. the problem is firewalld sending rules to nftables and nftables acting accordingly. i know that nftables is the backend to firewalld because it is in the config file.

here are things i dont know/understand yet how they work...basically i am trying to understand why this is failing and while i did a great deal of research on it, i was not able to answer all questions. here are some lingering ones...

1. i thought firewalld was a standalone with the ability to also work with iptables and nftables. so in the config file if i go backend="" or remove that line, will firewalld work or is it just a frontend to the two backends?
2. since nftables is the backend to firewalld, should that be a running service? ...because it is not right now...

there are some more i cannot think of right now.

that post, while it sounds similar is not. nftables didnt take over the fedora world until after 31. i believe it was 32 that started with nftables instead of iptables. that thread was 30/31 issues. but thanks for that ferrari. i appreciate the help...

at any rate, i have come up with a solution of sorts, to stop using firewalld and nftables. i am switching firewalls to one of my favorites because i cannot control the one it works with.

ferrari · 01-09-2023, 03:16 PM

Quote:

Originally Posted by baldur_1

here are things i dont know/understand yet how they work...basically i am trying to understand why this is failing and while i did a great deal of research on it, i was not able to answer all questions. here are some lingering ones...

1. i thought firewalld was a standalone with the ability to also work with iptables and nftables. so in the config file if i go backend="" or remove that line, will firewalld work or is it just a frontend to the two backends?
2. since nftables is the backend to firewalld, should that be a running service? ...because it is not right now...

Firewalld is a front-end for configuring the Linux backends: iptables or nftables (now the latter by default). It is reasonably well documented here:
https://firewalld.org/2018/07/nftables-backend

I'm not sure what is going on in your Fedora server. For me using openSUSE Leap 15.4 with Firewalld (nftables backend by default), it just works. I only have a single interface assigned to the default Public zone with samba access configured.

Quote:

at any rate, i have come up with a solution of sorts, to stop using firewalld and nftables. i am switching firewalls to one of my favorites because i cannot control the one it works with.

Consider casting your support net wider by posting in the Fedora Forums. Other than that use what works for you I guess.

baldur_1 · 01-14-2023, 10:01 AM

i was able to solve this with help from bugzilla. this is the explanation...

when i could not get masquerade yes on the firewall to work (i believe this is a bug), i added a source 192.168.0.0/24 to allow the under computers to access the internet. this caused all subsequent issues. as a result packets would go by the internal interface where samba was to external maybe or whatever and not mount right. i fixed this my adding a new policy that essentially, if not actually, did the maquerading...

firewall not configurable

Code:

firewall-cmd --zone=external --remove-source=192.168.0.0/24

to fix the pass-through...

to fix masquerade...

Code:

# firewall-cmd --permanent --new-policy intToExt
  # firewall-cmd --permanent --policy intToExt --set-target ACCEPT
  # firewall-cmd --permanent --policy intToExt --add-ingress-zone internal
  # firewall-cmd --permanent --policy intToExt --add-egress-zone external
  # firewall-cmd --reload

...and now everything works. i was able to samba mount again.

ferrari · 01-14-2023, 03:47 PM

Quote:

Originally Posted by baldur_1

i was able to solve this with help from bugzilla. this is the explanation...

when i could not get masquerade yes on the firewall to work (i believe this is a bug), i added a source 192.168.0.0/24 to allow the under computers to access the internet. this caused all subsequent issues. as a result packets would go by the internal interface where samba was to external maybe or whatever and not mount right. i fixed this my adding a new policy that essentially, if not actually, did the maquerading...

Ah, an important bit of information (customization) not disclosed in the opening post. Anyway, good that you've sorted it now.