Configuring FirewallD Forwarding for an Entire Subnet

Configuring FirewallD Forwarding for an Entire Subnet

In this article, we will discuss how to configure FirewallD to forward traffic for an entire subnet on a Linux machine running a web server. We will cover the key concepts and provide detailed instructions to help you understand and implement this configuration.

FirewallD Zones

FirewallD is a firewall management tool for Linux systems that uses the concept of zones to define different levels of trust for network connections. Each zone has a set of rules that determine how traffic is handled for connections in that zone. The default zones that come with FirewallD include:

• block: This zone blocks all incoming traffic.
• drop: This zone drops all incoming traffic without responding.
• public: This zone allows incoming traffic from any interface, but only established and related connections are allowed.
• external: This zone is similar to the public zone, but it is intended for use with external networks, such as the Internet.
• internal: This zone is similar to the public zone, but it is intended for use with internal networks.
• trusted: This zone allows all incoming traffic, including traffic that is not part of an established or related connection.
• home: This zone is similar to the trusted zone, but it is intended for use in a home network.
• work: This zone is similar to the trusted zone, but it is intended for use in a work network.
• dmz: This zone is intended for use with demilitarized zones (DMZs), which are isolated network segments that are used to host publicly accessible services.

Configuring FirewallD Forwarding

To configure FirewallD to forward traffic for an entire subnet, you will need to perform the following steps:

1. First, you will need to add a new zone to FirewallD that allows traffic from the subnet you want to forward. You can do this using the firewall-cmd command as follows:

   sudo firewall-cmd --permanent --new-zone subnet
   sudo firewall-cmd --permanent --zone subnet --add-source 10.208.65.0/18
   

   This will create a new zone called "subnet" and add a source address range of 10.208.65.0/18 to it. This means that any traffic coming from an IP address in this range will be treated as if it is coming from the "subnet" zone.

2. Next, you will need to enable forwarding on the machine. You can do this by editing the /etc/sysctl.conf file and setting the net.ipv4.ip_forward parameter to 1, as follows:

   net.ipv4.ip_forward = 1
   

   Then, you will need to restart the networking service for the changes to take effect:

   sudo systemctl restart networking
   

3. Once forwarding is enabled, you will need to add a rule to FirewallD that allows traffic to be forwarded from the "subnet" zone to the web server. You can do this using the firewall-cmd command as follows:

   sudo firewall-cmd --permanent --zone subnet --add-forward-port=port=80,proto=tcp,toport=80,toaddr=10.208.65.101
   

   This will allow traffic that is destined for port 80 (HTTP) on the "subnet" zone to be forwarded to the web server at IP address 10.208.65.101.

4. Finally, you will need to reload the FirewallD configuration for the changes to take effect:

   sudo firewall-cmd --reload
   

In this article, we have discussed how to configure FirewallD to forward traffic for an entire subnet on a Linux machine running a web server. We have covered the key concepts of FirewallD zones and forwarding, and provided detailed instructions for configuring FirewallD to forward traffic from a subnet to a web server. By following these steps, you can ensure that traffic from an entire subnet is properly forwarded to your web server.

References

• FirewallD Zones
• FirewallD Forwarding
• sysctl.conf