Manage policies

[zanna-37]

What would you like to be added:
I would like to add and modify policies in the same way services are modified.

    firewall:
      - policy: test
        priority: -15000
        target: CONTINUE
        ingress-zones: eth1
        egress-zones: eth2
        state: present
        permanent: true

See also: https://firewalld.org/2020/09/policy-objects-introduction

[zanna-37]

Any changes for this being implemented?

[richm]

Any changes for this being implemented?

No plans currently.

[Markus-]

So, what is about policies in general. In the readme they are mentioned in three or four places, but at a first glance they are not handled in any examples or code?

Is there any possiblity to use policies right now or do I have to use template-files and put them onto the system outside this role?

[richm]

So, what is about policies in general. In the readme they are mentioned in three or four places, but at a first glance they are not handled in any examples or code?

If you are referring to https://github.com/linux-system-roles/firewall#available-ansible-facts
They are only returned when you retrieve the firewall facts. The role does not allow you to manage them.

Is there any possiblity to use policies right now

No.

or do I have to use template-files and put them onto the system outside this role?

Yes.

[Markus-]

Ah, sorry - I missed the headline :(

Thanks for the hint.
Any tips for managing the firewall with a combination of manual templated files and this role?

[richm]

Ah, sorry - I missed the headline :(

Thanks for the hint. Any tips for managing the firewall with a combination of manual templated files and this role?

note that if you use previous: replaced - https://github.com/linux-system-roles/firewall#previous
it will erase all files under /etc/firewalld/**/*.xml - so if you manage policy files under /etc/firewalld/policies/*.xml, you should do that after using the firewall role if you plan to use previous: replaced.

[xpros]

Expressing my interest in this feature; especially given previous: replaced exists.

[rlenferink]

Also expressing my interest in this feature. This since policies seem to be the way for correctly restricting traffic (defining the correct ingress- and egress-zone).

See https://serverfault.com/a/1160406 for my starting point I tried to achieve with the role.

@richm we are a couple of years further now since the initial request, where security becomes more and more important (especially with all the AI agents finding security vulnerabilities), so correctly configuring a firewall IMO also becomes quite important (also to limit lateral movement within a network).

I had a quick look at the firewall_lib.py if the policy support could easily be added, but it seems that most of the code is written around zones, so it would probably take me more effort than I have in my spare time.

[richm]

Also expressing my interest in this feature. This since policies seem to be the way for correctly restricting traffic (defining the correct ingress- and egress-zone).

@erig0 is this true?

See https://serverfault.com/a/1160406 for my starting point I tried to achieve with the role.

@richm we are a couple of years further now since the initial request, where security becomes more and more important (especially with all the AI agents finding security vulnerabilities), so correctly configuring a firewall IMO also becomes quite important (also to limit lateral movement within a network).

Ok, good to know. This helps us to prioritize. Also, if you are a Red Hat customer, please escalate this through your channels.

I had a quick look at the firewall_lib.py if the policy support could easily be added, but it seems that most of the code is written around zones, so it would probably take me more effort than I have in my spare time.

Understood.

[richm]

Ah, sorry - I missed the headline :(
Thanks for the hint. Any tips for managing the firewall with a combination of manual templated files and this role?

note that if you use previous: replaced - https://github.com/linux-system-roles/firewall#previous it will erase all files under /etc/firewalld/**/*.xml - so if you manage policy files under /etc/firewalld/policies/*.xml, you should do that after using the firewall role if you plan to use previous: replaced.

This is no longer true. The current implementation will only touch the files if there is something that needs to change. So if you are using previous: replaced and nothing needs to change, those files will not be touched.

[rlenferink]

Also expressing my interest in this feature. This since policies seem to be the way for correctly restricting traffic (defining the correct ingress- and egress-zone).

@erig0 is this true?

Maybe my phrasing was not completely correct. What I tried to say was that policies seem to be the way forward when restricting traffic flows.

In my case, I am now using both zones with allowed services/ports and policies.

The Ansible firewall role input:

firewall:
  # Wipe existing config and replace with the config defined below.
  - previous: replaced

  # For some reason the cockpit and dhcpv6-client are always enabled by default.
  # Explicitly disable them.
  - service:
      - cockpit
      - dhcpv6-client
    state: disabled
    permanent: true

  # Only allow the ports below.
  - zone: public
    state: enabled
    permanent: true
    interface: ens18
    service:
      - ssh
    port:
      - '6100/tcp'
      - '6110/tcp'
      - '6120/tcp'
      - '6130/tcp'
      - '6140/tcp'
      - '6150/tcp'
      - '6160/tcp'
      - '6170/tcp'
      - '6171/tcp'
      - '6180/tcp'
      - '6181/tcp'

This ensures that the appropriate ports of the machine are exposed.

Then, using the following policy input, I try to further limit the host from trying to reach non-allowed services.

# Create policy
firewall-cmd --permanent --new-policy strict-output
firewall-cmd --permanent --policy strict-output --add-ingress-zone HOST
firewall-cmd --permanent --policy strict-output --add-egress-zone ANY

# Accept all output traffic (default)
firewall-cmd --permanent --policy strict-output --set-target ACCEPT

# Allow DHCP responses to gateway
firewall-cmd --permanent --policy=strict-output --add-rich-rule='rule priority="-10" family="ipv4" destination address="10.0.0.1" service name="dhcp" accept'

# Allow DNS queries (including DoH) to floating IP
firewall-cmd --permanent --policy=strict-output --add-rich-rule='rule priority="-10" family="ipv4" destination address="10.0.0.10" service name="dns" accept'
firewall-cmd --permanent --policy=strict-output --add-rich-rule='rule priority="-10" family="ipv4" destination address="10.0.0.10" service name="https" accept'

# Allow HTTP/HTTPS traffic to reverse proxy
firewall-cmd --permanent --policy=strict-output --add-rich-rule='rule priority="-10" family="ipv4" destination address="10.0.0.20" service name="http" accept'
firewall-cmd --permanent --policy=strict-output --add-rich-rule='rule priority="-10" family="ipv4" destination address="10.0.0.20" service name="https" accept'

# Block access to the rest
firewall-cmd --permanent --policy=strict-output --add-rich-rule='rule family="ipv4" destination address="10.0.0.0/16" log prefix="NETWORK_ACCESS_BLOCKED: " limit value="1/s" reject type="icmp-host-prohibited"'

# Apply changes
firewall-cmd --reload

I first tried to see whether the rich-rules option on a zone would be sufficient, but the policy did seem like the path forward, because e.g.: inbound SSH traffic would still be desired, but to allow that, the 10.0.0.0/16 range also needed to be allowed, because the response packet needs to be send. The same for the other TCP services running on different ports. This quickly becomes complicated. It seems that that policy ingress-zones and egress-zones prevent this complication (I also tested this).

To achieve this with the current role the only way I see is:

• Define the zone configuration as above (input for this role)
• Create some kind of post role to create the policy (this can be done using a template)

But: ideally this will be part of this role to prevent e.g. a short window where the policies are replaced (if the zone config changes, the replaced will happen), and the policies are created.

See https://serverfault.com/a/1160406 for my starting point I tried to achieve with the role.
@richm we are a couple of years further now since the initial request, where security becomes more and more important (especially with all the AI agents finding security vulnerabilities), so correctly configuring a firewall IMO also becomes quite important (also to limit lateral movement within a network).

Ok, good to know. This helps us to prioritize. Also, if you are a Red Hat customer, please escalate this through your channels.

Will also do that!

[rlenferink]

@richm I just tried to extend the interface to handle - policy: <name> objects differently, for which I have created #383

[erig0]

Also expressing my interest in this feature. This since policies seem to be the way for correctly restricting traffic (defining the correct ingress- and egress-zone).

@erig0 is this true?

Yes. For forward and output traffic it's the only way to filter traffic.