Want to understand how firewalld works

[markLopez9]

So I was trying to see what the default configuration was like and I ran these commands:

u@localhost:~> firewall-cmd --get-default-zone
public
u@localhost:~> firewall-cmd --get-active-zones
docker
  interfaces: docker0
public
  interfaces: eth0

I know I have an Ethernet port, so eth0 in the public zone is normal, but I do not know about a docker interface in the docker zone. Dug deeper and this is what I found:

usudo firewall-cmd --info-zone=docker
[sudo] password for root: 
docker (active)
  target: ACCEPT
  icmp-block-inversion: no
  interfaces: docker0
  sources: 
  services: 
  ports: 
  protocols: 
  forward: no
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 
u@localhost:~> sudo firewall-cmd --info-zone=public
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources: 
  services: dhcpv6-client
  ports: 
  protocols: 
  forward: no
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules:

Reading through the Security Guide in documentation, my understanding is:

• Outbound = always allowed

• Inbound = allowed IF the corresponding service is allowed in the zone

So if I compare the zone info of docker and public, my questions are:

1. What is the “target” field in the zone info?

1-A. ACCEPTis pretty much self-explanatory but I’m not sure what “default” means in the public zone. What is it?

2. So basically since there are no listed services in the docker zone, that means inbound connections are…not allowed? (and only DHCPv6 client traffic inbound are accepted for the public zone?)

3. I did zypper search -d docker and I can see that docker is not installed. Why do I have a docker interface? Is this default in openSUSE?

[marel]

If you are starting better switch to nft.

See:

Need help understanding firewall configuration in Leap

The nftables packet filter implimentation is a successor to iptables (as part of the Netfilter Project). The latter is kept for compatibility/legacy reasons, but by default Firewalld is now using the nftables backend. Firewalld has a graphical front-end provided by the firewall-config package. YaST provides a simpler graphical front-end, albeit with less functionality, (and which I personally don’t tend to use at all). Some reading:

[deano_ferrari]

This thread may be of interest to you…,

Interface "docker0" in YaST Firewall?

Although an interface can be removed a number of ways (YaST > Network Settings, manually removing interface files, etc) IMO if your Firewall doesn’t enable and match a zone to the interface, it’s not likely going to be doing anything… But you can check by running the following which lists your active interfaces ip addr TSU

[arvidjaar]

@markLopez9

What is the “target” field in the zone info?

Default action for this zone.

@markLopez9

there are no listed services in the docker zone, that means inbound connections are…not allowed?

Default action is ACCEPT. You said earlier this is “self explanatory” and in the next sentence you are asking for the explanation?

@markLopez9

Why do I have a docker interface? Is this default in openSUSE?

It is default in firewalld.

Did you try to read firewalld documentation before asking the basic questions?

[markLopez9]

thanks @marel

[markLopez9]

thanks @deano_ferrari