Re: NetworkManager and FirewallD

On Fri, 2019-02-15 at 12:15 +0200, Berend De Schouwer via
networkmanager-list wrote:

I've got a connection setup with NetworkManager on Fedora 29, and
sometimes on reboot the firewall rules are re-ordered.

The firewall is managed by firewalld.  It creates a few zones, and
sometimes the rules in the zones are re-ordered.  For example, a diff
between startups:

 Chain POSTROUTING_ZONES (1 references)
 target     prot opt source               destination         
-POST_public  all  
--             [goto] 
 POST_home  all  --             [goto] 
+POST_public  all  
--             [goto] 
 POST_FedoraServer  all  
--             [goto] 

This can prevent some traffic from flowing, especially if it re-

Note, in this case it actually broke some traffic swapping public &
home in both POST and PRE.

I can fix it by either re-starting NetworkManager, or by dropping the
connection and bringing it up again.  I can also break it that way.

I'm assuming it's triggered by a race condition.  It happens on a
Raspberry Pi, which is a little slower.

Is there some way to prevent this?


TL;DR: this does not sound like a NetworkManager issue to me. Why do
you think it is. I would ask firewalld [1].


NetworkManager almost never directly configures iptables. The only
place is for enabling MASQUERADING, with "ipv4.method=shared". nftables
is not supported here, and optimally this could would be improved to
let firewalld handle this. It's ugly that NetworkManager does this, but
you are not using "ipv4.method=shared", are you?

That aside, all that NetworkManager does regrading iptables/firewalld,
is to call "addInterface", "changeZone", and "removeInterface" on the
firewalld D-Bus API -- depending on "" parameter in
NetworkManager's connection profile.

Note that firewalld may also feed back into NetworkManager, when you
modify a zone in Firewalld persistently, then firewalld may update
"" in NetworkManager's profile. This interaction between
the two is rather hairy, because they both might call to each other.


Attachment: signature.asc
Description: This is a digitally signed message part

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]