Persistence Problems with --permanent firewalld Rules?
I'm in the process of working through the (draft 2) STIG rules for RHEL 7. One rule (RHEL-07-040250) states that I need to verify that rate-limiting is in place for inbound connection attempts. That, if I execute
firewall-cmd --direct --get-rule ipv4 filter IN_public_allow--limit--limit-burstfirewall-cmd --direct --get-rule ipv4 filter IN_public_allowfirewall-cmd --direct --add-rule ipv4 filter IN_public_allow 0 -m tcp -p tcp -m limit --limit 25/minute --limit-burst 100 -j ACCEPTfirewall-cmd --direct --permanent --add-rule ipv4 filter IN_public_allow 0 -m tcp -p tcp -m limit --limit 25/minute --limit-burst 100 -j ACCEPTMaking this amendment, I end up with a
/etc/firewalld/direct.xml-m tcp -p tcp -m limit --limit 25/minute --limit-burst 100 -j ACCEPT
All seems good. However, if I reboot my system (or even just reload my firewalld configuration), it seems that the service is ignoring this file. When I rerun my rule presence-check (
firewall-cmd --direct --get-rule ipv4 filter IN_public_allow0 -m tcp -p tcp -m limit --limit 25/minute --limit-burst 100 -j ACCEPTIs this a bug or am I doing something "not quite right". I'll fully admit that I'm unfamiliar with firewalld. I know how I would do stuff in bare iptables, but the STIGs mandate the use of firewalld.
Responses