Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #211631 > unrolled thread

usenet and firewalld

Back to article view | Back to linux.debian.user

Contents

  usenet and firewalld Charles Zeitler <cfzeitler@gmail.com> - 2019-07-22 15:30 +0200
    Re: usenet and firewalld Reco <recoverym4n@enotuniq.net> - 2019-07-22 18:40 +0200
      Re: usenet and firewalld Charles Zeitler <cfzeitler@gmail.com> - 2019-07-22 23:20 +0200
        Re: usenet and firewalld Reco <recoverym4n@enotuniq.net> - 2019-07-23 09:00 +0200

#211631 — usenet and firewalld

how do i configure firewalld to allow nntp?

thanks

charles zeitler

-- 
 The Perfect Is The Enemy Of
 The Good Enough

[toc] | [next] | [standalone]

#211644

	Hi.

On Mon, Jul 22, 2019 at 08:22:41AM -0500, Charles Zeitler wrote:
> how do i configure firewalld to allow nntp?

Unless you did something very unconventional, firewalld should not
prevent you from establishing outbound connections from your host.
Therefore no configuration should be required.

But, since you have to ask I assume that it's not that simple.
So, please post the output of "/sbin/iptables-save" executed as root.

Reco

[toc] | [prev] | [next] | [standalone]

#211657

On Mon, Jul 22, 2019 at 11:33 AM Reco <recoverym4n@enotuniq.net> wrote:
>
>         Hi.
>
> On Mon, Jul 22, 2019 at 08:22:41AM -0500, Charles Zeitler wrote:
> > how do i configure firewalld to allow nntp?
>
> Unless you did something very unconventional, firewalld should not
> prevent you from establishing outbound connections from your host.
> Therefore no configuration should be required.
>
> But, since you have to ask I assume that it's not that simple.
> So, please post the output of "/sbin/iptables-save" executed as root.
>
> Reco
>
# Generated by iptables-save v1.6.0 on Mon Jul 22 15:57:15 2019
*mangle
:PREROUTING ACCEPT [1355280:3797326792]
:INPUT ACCEPT [1354790:3797305824]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1029141:87693717]
:POSTROUTING ACCEPT [1029141:87693717]
:FORWARD_direct - [0:0]
:INPUT_direct - [0:0]
:OUTPUT_direct - [0:0]
:POSTROUTING_direct - [0:0]
:PREROUTING_ZONES - [0:0]
:PREROUTING_ZONES_SOURCE - [0:0]
:PREROUTING_direct - [0:0]
:PRE_public - [0:0]
:PRE_public_allow - [0:0]
:PRE_public_deny - [0:0]
:PRE_public_log - [0:0]
-A PREROUTING -j PREROUTING_direct
-A PREROUTING -j PREROUTING_ZONES_SOURCE
-A PREROUTING -j PREROUTING_ZONES
-A INPUT -j INPUT_direct
-A FORWARD -j FORWARD_direct
-A OUTPUT -j OUTPUT_direct
-A POSTROUTING -j POSTROUTING_direct
-A PREROUTING_ZONES -i enp5s0 -g PRE_public
-A PREROUTING_ZONES -g PRE_public
-A PRE_public -j PRE_public_log
-A PRE_public -j PRE_public_deny
-A PRE_public -j PRE_public_allow
COMMIT
# Completed on Mon Jul 22 15:57:15 2019
# Generated by iptables-save v1.6.0 on Mon Jul 22 15:57:15 2019
*security
:INPUT ACCEPT [1352234:3797001380]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1029141:87693717]
:FORWARD_direct - [0:0]
:INPUT_direct - [0:0]
:OUTPUT_direct - [0:0]
-A INPUT -j INPUT_direct
-A FORWARD -j FORWARD_direct
-A OUTPUT -j OUTPUT_direct
COMMIT
# Completed on Mon Jul 22 15:57:15 2019
# Generated by iptables-save v1.6.0 on Mon Jul 22 15:57:15 2019
*raw
:PREROUTING ACCEPT [1355280:3797326792]
:OUTPUT ACCEPT [1029141:87693717]
:OUTPUT_direct - [0:0]
:PREROUTING_ZONES - [0:0]
:PREROUTING_ZONES_SOURCE - [0:0]
:PREROUTING_direct - [0:0]
:PRE_public - [0:0]
:PRE_public_allow - [0:0]
:PRE_public_deny - [0:0]
:PRE_public_log - [0:0]
-A PREROUTING -j PREROUTING_direct
-A PREROUTING -j PREROUTING_ZONES_SOURCE
-A PREROUTING -j PREROUTING_ZONES
-A OUTPUT -j OUTPUT_direct
-A PREROUTING_ZONES -i enp5s0 -g PRE_public
-A PREROUTING_ZONES -g PRE_public
-A PRE_public -j PRE_public_log
-A PRE_public -j PRE_public_deny
-A PRE_public -j PRE_public_allow
COMMIT
# Completed on Mon Jul 22 15:57:15 2019
# Generated by iptables-save v1.6.0 on Mon Jul 22 15:57:15 2019
*nat
:PREROUTING ACCEPT [2926:320612]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [22023:1400876]
:POSTROUTING ACCEPT [22023:1400876]
:OUTPUT_direct - [0:0]
:POSTROUTING_ZONES - [0:0]
:POSTROUTING_ZONES_SOURCE - [0:0]
:POSTROUTING_direct - [0:0]
:POST_public - [0:0]
:POST_public_allow - [0:0]
:POST_public_deny - [0:0]
:POST_public_log - [0:0]
:PREROUTING_ZONES - [0:0]
:PREROUTING_ZONES_SOURCE - [0:0]
:PREROUTING_direct - [0:0]
:PRE_public - [0:0]
:PRE_public_allow - [0:0]
:PRE_public_deny - [0:0]
:PRE_public_log - [0:0]
-A PREROUTING -j PREROUTING_direct
-A PREROUTING -j PREROUTING_ZONES_SOURCE
-A PREROUTING -j PREROUTING_ZONES
-A OUTPUT -j OUTPUT_direct
-A POSTROUTING -j POSTROUTING_direct
-A POSTROUTING -j POSTROUTING_ZONES_SOURCE
-A POSTROUTING -j POSTROUTING_ZONES
-A POSTROUTING_ZONES -o enp5s0 -g POST_public
-A POSTROUTING_ZONES -g POST_public
-A POST_public -j POST_public_log
-A POST_public -j POST_public_deny
-A POST_public -j POST_public_allow
-A PREROUTING_ZONES -i enp5s0 -g PRE_public
-A PREROUTING_ZONES -g PRE_public
-A PRE_public -j PRE_public_log
-A PRE_public -j PRE_public_deny
-A PRE_public -j PRE_public_allow
COMMIT
# Completed on Mon Jul 22 15:57:15 2019
# Generated by iptables-save v1.6.0 on Mon Jul 22 15:57:15 2019
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1029141:87693717]
:FORWARD_IN_ZONES - [0:0]
:FORWARD_IN_ZONES_SOURCE - [0:0]
:FORWARD_OUT_ZONES - [0:0]
:FORWARD_OUT_ZONES_SOURCE - [0:0]
:FORWARD_direct - [0:0]
:FWDI_public - [0:0]
:FWDI_public_allow - [0:0]
:FWDI_public_deny - [0:0]
:FWDI_public_log - [0:0]
:FWDO_public - [0:0]
:FWDO_public_allow - [0:0]
:FWDO_public_deny - [0:0]
:FWDO_public_log - [0:0]
:INPUT_ZONES - [0:0]
:INPUT_ZONES_SOURCE - [0:0]
:INPUT_direct - [0:0]
:IN_public - [0:0]
:IN_public_allow - [0:0]
:IN_public_deny - [0:0]
:IN_public_log - [0:0]
:OUTPUT_direct - [0:0]
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -j INPUT_direct
-A INPUT -j INPUT_ZONES_SOURCE
-A INPUT -j INPUT_ZONES
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i lo -j ACCEPT
-A FORWARD -j FORWARD_direct
-A FORWARD -j FORWARD_IN_ZONES_SOURCE
-A FORWARD -j FORWARD_IN_ZONES
-A FORWARD -j FORWARD_OUT_ZONES_SOURCE
-A FORWARD -j FORWARD_OUT_ZONES
-A FORWARD -m conntrack --ctstate INVALID -j DROP
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A OUTPUT -j OUTPUT_direct
-A FORWARD_IN_ZONES -i enp5s0 -g FWDI_public
-A FORWARD_IN_ZONES -g FWDI_public
-A FORWARD_OUT_ZONES -o enp5s0 -g FWDO_public
-A FORWARD_OUT_ZONES -g FWDO_public
-A FWDI_public -j FWDI_public_log
-A FWDI_public -j FWDI_public_deny
-A FWDI_public -j FWDI_public_allow
-A FWDI_public -p icmp -j ACCEPT
-A FWDO_public -j FWDO_public_log
-A FWDO_public -j FWDO_public_deny
-A FWDO_public -j FWDO_public_allow
-A INPUT_ZONES -i enp5s0 -g IN_public
-A INPUT_ZONES -g IN_public
-A IN_public -j IN_public_log
-A IN_public -j IN_public_deny
-A IN_public -j IN_public_allow
-A IN_public -p icmp -j ACCEPT
-A IN_public_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
COMMIT
# Completed on Mon Jul 22 15:57:15 2019
d

-- 
 The Perfect Is The Enemy Of
 The Good Enough

[toc] | [prev] | [next] | [standalone]

#211666

	Hi.

On Mon, Jul 22, 2019 at 04:16:58PM -0500, Charles Zeitler wrote:
> On Mon, Jul 22, 2019 at 11:33 AM Reco <recoverym4n@enotuniq.net> wrote:
> >
> > On Mon, Jul 22, 2019 at 08:22:41AM -0500, Charles Zeitler wrote:
> > > how do i configure firewalld to allow nntp?
> >
> > Unless you did something very unconventional, firewalld should not
> > prevent you from establishing outbound connections from your host.
> > Therefore no configuration should be required.
> >
> > But, since you have to ask I assume that it's not that simple.
> > So, please post the output of "/sbin/iptables-save" executed as root.

Let's get started. This one could ruin your day (SELinux), but the rules
are empty:

> *security
...
> :OUTPUT_direct - [0:0]
> -A OUTPUT -j OUTPUT_direct

And this one too, but it can not:

> *filter
...
> :OUTPUT ACCEPT [1029141:87693717]
...
> :OUTPUT_direct - [0:0]
> -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
...
> -A OUTPUT -j OUTPUT_direct


So, unless you're trying to connect via IPv6 (and in this case it's
called "/sbin/ip6tables-save"), or have custom nft rules that cannot be
translated to conventional iptables syntax - firewalld should not
prevent you from using nntp.

Reco

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web