Home / server / Questions / 1054749
In Process
eri
Asked: 2021-02-24 07:53:38 +0800 CST

Firewalld insert rule before ESTABLISHED

  • 772

I want to ban already established connections.

Default iptables rules generated by firewalld

-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -j INPUT_direct

How to insert rule before -j ACCEPT ?

Or how to move INPUT_direct to top?

Or how to remove conntrack rule?

firewall iptables firewalld firewall-cmd

2 Answers

  1. You can insert an iptables rule with iptables -I parameter So if you specify iptables -I INPUT -j INPUT_direct this rule will be inserted to to top.

    If you specify it with a row numer: iptables -I INPUT 2 -j INPUT_direct it will be inserted as rule in line 2.

    In order to move the rule:

    1. Delete it first: iptables -D INPUT -j INPUT_direct
    2. Insert it to the top iptables -I INPUT -j INPUT_direct
    • 1

  2. As workaround I inserted rule in raw (or mangle) table:

    firewall-cmd --direct --add-rule ipv4 mangle PREROUTING_direct 0 \
  -m set --match-set ipsetname src -j DROP

    This chain is before INPUT and as i have no FORWARD on this machine - it solves my problem.

    • 0