Home / server / Questions / 673053
Accepted
ToBeReplaced
Asked: 2015-03-05 10:09:04 +0800 CST

How can I enable protocol traffic with firewalld?

  • 772

I need to allow Protocol 50 (esp) traffic for ipsec.

I can do:

iptables -A INPUT -p esp
iptables -A OUTPUT -p esp

How could I do this with firewalld instead?

Same question closed on StackOverflow because it was off-topic.

iptables

2 Answers

  1. Best Answer

    You'll need to use a (fairly simple) rich rule for this.

    For example:

    firewall-cmd --zone=vpnendpoint --add-rich-rule="rule protocol value=esp accept"
    • 3

  2. I'm by no means an iptables or firewalld expert, but it seems to me something like this would work:

    firewall-cmd --permanent --direct --add-rule filter INPUT -p esp -j ACCEPT
firewall-cmd --permanent --direct --add-rule filter OUTPUT -p esp -j ACCEPT

    If you have zones and such all setup, you could also do it with the --zone and --add-rich-rule options instead of --direct.

    • 1