ViciBox v.10 Beta 4 and MD image. 99% complete!

[Kumba]

Apparently the problem is even if I tell firewall-cmd to use an ipset, if I modify the ipset directly using the actual ipset utility, it does nothing. Cause firewalld/nftables get their feelings hurt that I didn't use firewall-cmd to modify the ipset.

So yeah, doing 'firewall-cmd --permanent --zone=external --add-source=ipset:whiteips' and then trying to add an IP directly with ipset like 'ipset add whiteips 1.2.3.4' doesn't work. Why?!?!? No earthly idea. It's the most ridiculous thing I've ran into yet with firewalld. But doing 'firewall-cmd --ipset=whiteips --add-entry=1.2.3.4' does work. The real problem is that firewall-cmd doesn't have a flush or swap feature for ipsets. That means I either need to parse the output of --get-entries and individually add/remove IPs that need it, or I have to delete the ipset which is likely going to be intrusive and cause audio problems.

Wrapping VB-firewall around firewall-cmd is almost a complete re-write. The only parts I can really re-use is some of the CLI parsing and database connectivity portions. All the rest essentially gets thrown away as it's no longer viable.

Plan B is to use direct and just throw some sort of iptables hackery in there but that's more short-term as iptables is deprecated more an more.

Blah. Double and triple blah even.

[carpenox]

damn thats a mission and a half, what about removing firewalld and just using iptables?

[Kumba]

damn thats a mission and a half, what about removing firewalld and just using iptables?

I've already got the WhiteList, BlackList, and DynamicList functionality re-written in VB-Firewall. I just need to add the VoIPBL.org and geoblock to it. Since I'm wrapping everything completely around firewalld that does make some things a lot easier and cleaner. About the only feature I wish firewalld had in it was a way to flush an IPSet. As it stands now I have to either add/remove individual entries or delete and recreate the ipset. That's not too bad for most things until I get to VoIPBL.org and GeoBlocking. those are easier to just flush the ipset and reinsert everything but meh. I'll have to think of a good way to approach those.

[Kumba]

So the new VB-firewall is ready to test. It's missing the geoblock portion but that's a pretty low priority compared to the rest.

You can do a zypper ref and zypper up to pull in the new version, but you will proably have to re-do some of the firewall config files.

Here's what you need to do
delete /etc/firewalld/direct.xml (unless you've made custom changes to this)

look in /etc/firewalld/zones for any files that end with "rpmnew". You'll probably need to copy these over the XML files but without the "rpmnew" extension. I.E. cp external.xml.rpmnew external.xml

That should more or less get the new firewall setup in place.

So the way it works is the 'external' zone is what the whitelist and dynamic list are tied to. So the 'public' zone is default zone. You would remove everything from the public zone you don't want the general internet having access to. If you're using the dynamic portal you'll want 'viciportal' and 'viciportal-ssl' in the 'public' zone.

In the External zone you should see asterisk, apache, rtp, etc, listed there. These are the services that the whitelist and dynamic list will have available.

And finally, the blacklist and voipbl.org list are now tied to the drop zone. This means the server will look like a literal black hole if they're on those lists.

I'll have to do documentation soon, but this makes it all a lot easier to deal with and manage.

[carpenox]

cool, ill give it a test later on today and report back

[Kumba]

Just dropped Beta4 which should have all the above goodies fixed in it. It's in the first post. Go ahead and do your testing. See if the dynamic portal and whitelist now work as you expect.

[carpenox]

ok cool ill try it out tonight, did you finish the firewall-cmd rewrite?

[carpenox]

ok so ive installed v10 now on 3 production boxes last night, and this seems to be an error accross the board when manually adding IP's to the firewall:

firewall-cmd --add-source=54.xx.113.xx0 --zone=trusted --permanent
ERROR:dbus.proxies:Introspect error on :1.3:/org/fedoraproject/FirewallD1/config: dbus.exceptions.DBusException: org.freedesktop.DBus.Error.NoReply: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.

[Kumba]

No clue. I've never gotten that error. Is firewalld running?

[carpenox]

Yes and it freezes the box when this happens

[Kumba]

No clue. I can't duplicate that issue. Below is where I ran the command just fine with a made up IP

Code: Select all

vicibox10:~ # firewall-cmd --permanent --zone=trusted --add-source=54.1.113.1
success


[carpenox]

and if u try a --reload afterwards it doesnt freeze for you?

[Kumba]

I didn't know you were doing that. It looks like it gave you the error just by running the command. I'll try the reload later. I am guessing that since I can't duplicate your initial issue, I'll likely not have an issue doing the --reload either.

and if u try a --reload afterwards it doesnt freeze for you?