Hi all!
I'n wondering if it is possible to have Centos-7 automatically change
firewall zones, depending on the network we conect to.
my default zone is "home" and it has some ports open that probably
shouldn't be open when I'm on someone elose's network.
so I'm thinking that if there's a way to have it always use home when
I'm at home, and external when I'm not, it would be great.
I see that firewall-cmd has a ton of options, but not sure which one(s)
I'd need for switching. (I see one for setting default zone, but I
didn't
see one for setting current zone--maybe I'm blind).
I'm also not at all sure how to invoke it at a proper time,... perhaps
some udev rules?
anyone got any wisdom they can drop on me?
thanks!
--
---- Fred Smith -- fredex at fcshome.stoneham.ma.us
-----------------------------
God made him who had no sin
to be sin for us, so that in him
we might become the righteousness of God."
--------------------------- Corinthians 5:21 ---------------------------------
On 24 March 2016 at 18:01, Fred Smith <fredex at fcshome.stoneham.ma.us> wrote:> Hi all! > > I'n wondering if it is possible to have Centos-7 automatically change > firewall zones, depending on the network we conect to. > > my default zone is "home" and it has some ports open that probably > shouldn't be open when I'm on someone elose's network. > > so I'm thinking that if there's a way to have it always use home when > I'm at home, and external when I'm not, it would be great. > > I see that firewall-cmd has a ton of options, but not sure which one(s) > I'd need for switching. (I see one for setting default zone, but I didn't > see one for setting current zone--maybe I'm blind). > > I'm also not at all sure how to invoke it at a proper time,... perhaps > some udev rules? > > > anyone got any wisdom they can drop on me? > >The default zones are poorly named and should never have been included - especially given most of them aren't in use on any given system. For a look into how to make use of firewalld take a look at this: https://www.hogarthuk.com/?q=node/9 The best way to handle the scenario you describe would be multiple NM connection profiles (don't have it set to auto) so that you can set connection.zone correctly on each for the right network profile. Then when you nmcli c up work (or home or whatever) to bring up that connection profile it'll come up in the right zone. This manual nmcli c up is only needed if these are ethernet profiles as there's no link between subnet and connection profile If these are WiFi connections NM already has different connection profiles and picks one to match the SSID - so you could set the right connection.zone in that. The NM article goes into some details on connection profiles https://www.hogarthuk.com/?q=node/8 Alternatively if you know the subnets that will be connecting to you at work and home you could set your default profile to reject and create zones with appropriate incoming rules bound to the source subnets contacting your system.
On Thu, Mar 24, 2016 at 02:01:55PM -0400, Fred Smith wrote:> I'n wondering if it is possible to have Centos-7 automatically change > firewall zones, depending on the network we conect to.The way to do this is changing the zone for the network in NetworkManager. (This works easily for wifi networks and is kind of a pain for wired ones, unfortunately, since there's not necessarily a good way to distinguish.) I don't have a CentOS (or RHEL) desktop and I don't remember offhand when this hit, but in Fedora, run the NetworkManager config panel, hit config on a network, and change the zone on the Security tab. Or, put "ZONE=public" or "ZONE=work" or whatever in the ifcfg file for the network. I'm hoping in the future to make this better, but there are actually a lot of different parts involved so it's hard to get everyone to agree on the best approach. I personally make "public" my default zone, and then add zones that should be more trusted to networks that should be more open. -- Matthew Miller <mattdm at fedoraproject.org> Fedora Project Leader
On Thu, Mar 24, 2016 at 09:18:16PM +0000, James Hogarth wrote: Thanks, James, that looks pretty good. I'll look into it and probably give it a try. Fred> On 24 March 2016 at 18:01, Fred Smith <fredex at fcshome.stoneham.ma.us> wrote: > > > Hi all! > > > > I'n wondering if it is possible to have Centos-7 automatically change > > firewall zones, depending on the network we conect to. > > > > my default zone is "home" and it has some ports open that probably > > shouldn't be open when I'm on someone elose's network. > > > > so I'm thinking that if there's a way to have it always use home when > > I'm at home, and external when I'm not, it would be great. > > > > I see that firewall-cmd has a ton of options, but not sure which one(s) > > I'd need for switching. (I see one for setting default zone, but I didn't > > see one for setting current zone--maybe I'm blind). > > > > I'm also not at all sure how to invoke it at a proper time,... perhaps > > some udev rules? > > > > > > anyone got any wisdom they can drop on me? > > > > > The default zones are poorly named and should never have been included - > especially given most of them aren't in use on any given system. > > For a look into how to make use of firewalld take a look at this: > > https://www.hogarthuk.com/?q=node/9 > > The best way to handle the scenario you describe would be multiple NM > connection profiles (don't have it set to auto) so that you can set > connection.zone correctly on each for the right network profile. > > Then when you nmcli c up work (or home or whatever) to bring up that > connection profile it'll come up in the right zone. > > This manual nmcli c up is only needed if these are ethernet profiles as > there's no link between subnet and connection profile > > If these are WiFi connections NM already has different connection profiles > and picks one to match the SSID - so you could set the right > connection.zone in that. > > The NM article goes into some details on connection profiles > > https://www.hogarthuk.com/?q=node/8 > > Alternatively if you know the subnets that will be connecting to you at > work and home you could set your default profile to reject and create zones > with appropriate incoming rules bound to the source subnets contacting your > system. > _______________________________________________ > CentOS mailing list > CentOS at centos.org > https://lists.centos.org/mailman/listinfo/centos-- ---- Fred Smith -- fredex at fcshome.stoneham.ma.us ----------------------------- God made him who had no sin to be sin for us, so that in him we might become the righteousness of God." --------------------------- Corinthians 5:21 ---------------------------------
On Thu, Mar 24, 2016 at 06:39:37PM -0400, Matthew Miller wrote: Thanks for the info, Matthew! Fred> On Thu, Mar 24, 2016 at 02:01:55PM -0400, Fred Smith wrote: > > I'n wondering if it is possible to have Centos-7 automatically change > > firewall zones, depending on the network we conect to. > > The way to do this is changing the zone for the network in > NetworkManager. (This works easily for wifi networks and is kind of a > pain for wired ones, unfortunately, since there's not necessarily a > good way to distinguish.) I don't have a CentOS (or RHEL) desktop and I > don't remember offhand when this hit, but in Fedora, run the > NetworkManager config panel, hit config on a network, and change the > zone on the Security tab. > > Or, put "ZONE=public" or "ZONE=work" or whatever in the ifcfg file for > the network. > > I'm hoping in the future to make this better, but there are actually a > lot of different parts involved so it's hard to get everyone to agree > on the best approach. > > I personally make "public" my default zone, and then add zones that > should be more trusted to networks that should be more open. > > -- > Matthew Miller > <mattdm at fedoraproject.org> > Fedora Project Leader > _______________________________________________ > CentOS mailing list > CentOS at centos.org > https://lists.centos.org/mailman/listinfo/centos-- ---- Fred Smith -- fredex at fcshome.stoneham.ma.us ----------------------------- "Not everyone who says to me, 'Lord, Lord,' will enter the kingdom of heaven, but only he who does the will of my Father who is in heaven." ------------------------------ Matthew 7:21 (niv) -----------------------------
Matthew Miller wrote:>> I'n wondering if it is possible to have Centos-7 automatically change >> firewall zones, depending on the network we conect to.> The way to do this is changing the zone for the network in > NetworkManager.Are there two different ways of setting firewalld zones, in firewalld and in NetworkManager? Which is taken if they differ?> (This works easily for wifi networks and is kind of a > pain for wired ones, unfortunately, since there's not necessarily a > good way to distinguish.) I don't have a CentOS (or RHEL) desktop and I > don't remember offhand when this hit, but in Fedora, run the > NetworkManager config panel, hit config on a network, and change the > zone on the Security tab. > > Or, put "ZONE=public" or "ZONE=work" or whatever in the ifcfg file for > the network. > > I'm hoping in the future to make this better, but there are actually a > lot of different parts involved so it's hard to get everyone to agree > on the best approach. > > I personally make "public" my default zone, and then add zones that > should be more trusted to networks that should be more open.I find the firewalld definition of "zones" rather confusing. I run shorewall on my home server, and that seems to me to have a much simpler definition of zones. -- Timothy Murphy gayleard /at/ eircom.net School of Mathematics, Trinity College, Dublin