I opened a question here, but as I found some new elements, I prefer to open a new one.
Here is my situation, that can be reproduced:
Fresh Centos7 OS. Configuration of two interfaces eth1 and eth2 with ip adresses X and Y
-----------------> @X CENTOS @Y -----------------> @Z -------
dst_IP = A dst_IP = A
src_IP = B dst_IP = B
edit /etc/firewalld/zones/TEST.xml, add the two interfaces, activate masquerade.
The firewalld target is set to "default" by default.
add a route as following :
Destination Gateway GenMask
A Z 255.255.255.255
Then activate ip forward an deactivate rp_filter :
sysctl net.ipv4.ip_forward=1
sysctl net.ipv4.conf.eth1.rp_filter=2
sysctl net.ipv4.conf.eth2.rp_filter=2
In this situation, if I route a packet (@dest=A) to CentOS, the paquet is routed to Z.
-> Why firewalld does not block it? as there is no rule to accept it
If I disable masquerade , the paquet is not routed anymore.
-> Why ?
With masquerade activated, if I change the target from default to DROP, the paquet is not routed anymore
-> So the "default" target is not strictly identiqual to "DROP" target. What are exactly the differences? I couldn't find any information about this
