what is 'target: default' of a zone's configuration in firewalld?

Alakananda S

4/10/24, 4:47 PM

I am currently using ubuntu 20.04 machine and installed firewalld as the firewall manager service. While looking at the configuration of 'public zone' , i can see as below,

public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources: 
  services: dhcpv6-client dns http https mysql squid ssh
  ports: 
  protocols: 
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules:

why the target is default here? How it affect firewalld's incoming connection request handling?

782

1 + 0

server

firewall

firewalld

Score:2

Ubuntu

Raffa

4/10/24, 8:06 PM

From man firewalld.zone:

target="ACCEPT|%%REJECT%%|DROP"
   Can be used to accept, reject or drop every packet. The ACCEPT target is used in the
   trusted zone, every packet will be accepted. The %%REJECT%% target is used in the
   block zone, every packet will be rejected with the default firewalld reject type. The
   DROP target is used in the drop zone, every packet will be dropped. The default target
   is {chain}_ZONE_{zone} and will be used if the target is not specified. If other than
   the default target is used, all settings except interface and source are ignored,
   because the first rule created in firewall for this zone is 'jump to target'.

Which is really not very specific as to how default works.

However, this is clarified by a proposed change/addition to the man page:

 --permanent [--zone=zone] --set-target=target
    Set the target of a permanent zone.  target is one of: default,
    ACCEPT, DROP, REJECT

    default is similar to REJECT, but has special meaning in the
    following scenarios:

     1. ICMP explicitly allowed

        At the end of the zone's ruleset ICMP packets are explicitly
        allowed.

     2. forwarded packets follow the target of the egress zone

        In the case of forwarded packets, if the ingress zone uses
        default then whether or not the packet will be allowed is
        determined by the egress zone.

        For a forwarded packet that ingresses zoneA and egresses zoneB:

        ·   if zoneA's target is ACCEPT, DROP, or REJECT then the
            packet is accepted, dropped, or rejected respectively.

        ·   if zoneA's target is default, then the packet is accepted,
            dropped, or rejected based on zoneB's target. If zoneB's
            target is also default, then the packet will be rejected by
            firewalld's catchall reject.

     3. Zone drifting from source-based zone to interface-based zone

        This only applies if AllowZoneDrifting is enabled. See
        firewalld.conf(5).

        If a packet ingresses a source-based zone with a target of
        default, it may still enter an interface-based zone (including
        the default zone).

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: what is 'target: default' of a zone's configuration in firewalld?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.