From 0ed2817dd93b6fb631975bc30e4a56013ddfed52 Mon Sep 17 00:00:00 2001 From: Logan Blyth Date: Sep 06 2022 16:47:29 +0000 Subject: Use policy objects when setting up NAT / Masquerade Updated example to show the use of policies in firewalld. Based on the a conversation on the github issue https://github.com/firewalld/firewalld/issues/1015 and the blog posted linked within that github issue. here https://firewalld.org/2020/09/policy-objects-introduction --- diff --git a/docs/modules/ROOT/pages/sysadmin-dnsmasq.adoc b/docs/modules/ROOT/pages/sysadmin-dnsmasq.adoc index 3f1e6e3..fbbf7ec 100644 --- a/docs/modules/ROOT/pages/sysadmin-dnsmasq.adoc +++ b/docs/modules/ROOT/pages/sysadmin-dnsmasq.adoc @@ -249,14 +249,18 @@ FedoraServer interfaces: enp1s0 trusted interfaces: vbr2s0 enp2s0 -[…]# firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -o enp1s0 -j MASQUERADE +[…]# firewall-cmd --permanent --new-policy trustedToExt success -[…]# firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i vbr2s0 -o enp2s0 -j ACCEPT +[…]# firewall-cmd --permanent --policy trustedToExt --add-ingress-zone trusted success -[…]# firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i enp1s0 -o vbr2s0 -m state --state RELATED,ESTABLISHED -j ACCEPT +[…]# firewall-cmd --permanent --policy trustedToExt --add-egress-zone FedoraServer +success +[…]# firewall-cmd --permanent --policy trustedToExt --set-target ACCEPT +success +[…]# firewall-cmd --reload success ---- - +More information about policy objects can be seen in here https://firewalld.org/2020/09/policy-objects-introduction == Integrate libvirt's virtual interface In case libvirt and virualization including a virtual network for the virtual machines, libvirt installs and configures its own dnsmasq instance. In most cases it is just convenient, instead of replacing the libvirt _default_ network to integrate it in NetworkManagers dnsmasq plugin. Thus, two instances of dnsmasq operate along each other.