firewalld support #166

nahil1 · 2021-06-20T08:17:18Z

The following commands are needed to allow traffic when firewalld is being used.

sudo firewall-cmd --add-service=dhcp
sudo firewall-cmd --add-service=dns
sudo firewall-cmd  --add-masquerade

sudo firewall-cmd -q --direct --add-rule ipv4 nat POSTROUTING 0 -o <ap_iface> -j MASQUERADE
sudo firewall-cmd -q --direct --add-rule ipv4 filter FORWARD 0 -i <internet_iface> -o <ap_iface> -j ACCEPT
sudo firewall-cmd -q --direct --add-rule ipv4 filter FORWARD 0 -i <ap_iface> -o <internet_iface> -m state --state RELATED,ESTABLISHED -j ACCEPT

The text was updated successfully, but these errors were encountered:

tubbadu · 2022-03-28T22:14:32Z

what should <ap_iface> and <internet_iface> be substitute with?

lakinduakash · 2022-03-29T03:59:52Z

@tubbadu check the ui dropdowns

Luciogi · 2022-04-08T14:39:47Z

Edit : This solution is NOT working, GOTO

Just add adapter name in variables(wifi_iface and internet_iface[In my case export wifi_iface=wlan0 export internet_iface=wlan0 ]) then execute commands

export wifi_iface=
export internet_iface=

sudo firewall-cmd --add-service=dhcp
sudo firewall-cmd --add-service=dns
sudo firewall-cmd  --add-masquerade

sudo firewall-cmd -q --direct --add-rule ipv4 nat POSTROUTING 0 -o $wifi_iface -j MASQUERADE
sudo firewall-cmd -q --direct --add-rule ipv4 filter FORWARD 0 -i $internet_iface -o $wifi_iface -j ACCEPT
sudo firewall-cmd -q --direct --add-rule ipv4 filter FORWARD 0 -i $wifi_iface -o $internet_iface -m state --state RELATED,ESTABLISHED -j ACCEPT

lakinduakash · 2022-04-11T06:57:15Z

@Luciogi Thanks I'll add those and test them soon.

Luciogi · 2022-04-19T17:56:51Z

@lakinduakash this solution is not working

Luciogi · 2022-04-21T15:34:34Z

Working Solution:

I am using Fedora 35 for testing, firewalld has default zone FedoraWorkstation. My approach is enable masquerade in zone trusted and FedoraWorkstation, and add interface ap0 to trusted zone
executing following command block will allow internet access and ip allocation via hotspot

sudo firewall-cmd --zone=FedoraWorkstation --add-masquerade
sudo firewall-cmd --zone=trusted --add-masquerade
sudo firewall-cmd --zone=trusted --add-interface=ap0

Edit: Please test it and give feedback

fwd firewall works without any problem

lakinduakash · 2022-04-22T02:38:12Z

Thanks @Luciogi for testing it. Please test someone, currently I don't have a Fedora environment.

NHellFire · 2022-08-23T16:51:35Z

This will allow clients to connect and have internet access (tested on Ubuntu 22.04 with firewalld 1.1.1) without allowing them access to other services on the host:

firewall-cmd --permanent --new-zone=hotspot
firewall-cmd --permanent --zone=hotspot --add-service=dhcp
firewall-cmd --permanent --zone=hotspot --add-service=dns
firewall-cmd --permanent --zone=hotspot --add-interface=ap0

# Ensure the DNS ports are forwarded
firewall-cmd --permanent --zone=hotspot --add-rich-rule='rule family="ipv4" forward-port port="53" protocol="tcp" to-port="5353" destination address="192.168.12.1"'
firewall-cmd --permanent --zone=hotspot --add-rich-rule='rule family="ipv4" forward-port port="53" protocol="udp" to-port="5353" destination address="192.168.12.1"'

# Change public to whatever zone you've assigned the internet connection to
firewall-cmd --permanent --zone=public --add-masquerade

firewall-cmd --permanent --new-policy hotspot-forwarding
firewall-cmd --permanent --policy hotspot-forwarding --add-ingress-zone hotspot
# Change public to whatever zone you've assigned the internet connection to
firewall-cmd --permanent --policy hotspot-forwarding --add-egress-zone public
# If you want to restrict what ports clients can access on the internet, you can remove this
firewall-cmd --permanent --policy hotspot-forwarding --set-target ACCEPT
# And add specific services instead
#firewall-cmd --permanent --policy hotspot-forwarding --add-service http


firewall-cmd --reload

These rules will persist after a reboot, so you shouldn't need to touch them again unless you want to allow more zones to be used for internet.

lxwulf · 2023-02-01T08:44:44Z

Working Solution:

I am using Fedora 35 for testing, firewalld has default zone FedoraWorkstation. My approach is enable masquerade in zone trusted and FedoraWorkstation, and add interface ap0 to trusted zone executing following command block will allow internet access and ip allocation via hotspot
sudo firewall-cmd --zone=FedoraWorkstation --add-masquerade
sudo firewall-cmd --zone=trusted --add-masquerade
sudo firewall-cmd --zone=trusted --add-interface=ap0
Edit: Please test it and give feedback

fwd firewall works without any problem

Sadly, this doesn't work somehow…

Are there some special settings which I missed? I got an IP address with my phone, but no internet connection.

IP of Phone: 192.168.12.13
Gateway of Phone: 192.168.12.1
Gateway of ap0: 192.168.12.1

I have a virtual interface as LAN device, but this shouldn't generate any problems, right?

Ethernet port enp1s0:
IP: 192.168.12.103
Gateway: 192.168.12.1

Normally this would be 192.168.3.3 with Gateway 192.168.3.1
I have internet in my VM, but not on the hotspot. When I missed something to mention just ask, I try to deliver.

Greets LxWulf

Edit: Yes, I use Fedora 37 with the newest updates.

Luciogi · 2023-02-02T12:15:42Z

@lxwulf Are you using Fedora 37 on VM?

lxwulf · 2023-02-02T18:01:48Z

@Luciogi Yes, exactly!

It does work with a LAN PCI pass through, but not with virtual devices, at least on my side.

Luciogi · 2023-02-03T07:36:32Z

@lxwulf I guess, VM can't directly access all wifi card capabilites , It uses bridge or NAT connection coming from Host OS
May be usb wifi adapter might work

lxwulf · 2023-02-04T09:40:50Z

@Luciogi Yes, worth trying, but at moment have no USB dongle, but I'll keep this in mind for later.

tubbadu · 2023-02-05T09:47:06Z

This will allow clients to connect and have internet access (tested on Ubuntu 22.04 with firewalld 1.1.1) without allowing them access to other services on the host:

firewall-cmd --permanent --new-zone=hotspot
firewall-cmd --permanent --zone=hotspot --add-service=dhcp
firewall-cmd --permanent --zone=hotspot --add-service=dns
firewall-cmd --permanent --zone=hotspot --add-interface=ap0

# Ensure the DNS ports are forwarded
firewall-cmd --permanent --zone=hotspot --add-rich-rule='rule family="ipv4" forward-port port="53" protocol="tcp" to-port="5353" destination address="192.168.12.1"'
firewall-cmd --permanent --zone=hotspot --add-rich-rule='rule family="ipv4" forward-port port="53" protocol="udp" to-port="5353" destination address="192.168.12.1"'

# Change public to whatever zone you've assigned the internet connection to
firewall-cmd --permanent --zone=public --add-masquerade

firewall-cmd --permanent --new-policy hotspot-forwarding
firewall-cmd --permanent --policy hotspot-forwarding --add-ingress-zone hotspot
# Change public to whatever zone you've assigned the internet connection to
firewall-cmd --permanent --policy hotspot-forwarding --add-egress-zone public
# If you want to restrict what ports clients can access on the internet, you can remove this
firewall-cmd --permanent --policy hotspot-forwarding --set-target ACCEPT
# And add specific services instead
#firewall-cmd --permanent --policy hotspot-forwarding --add-service http


firewall-cmd --reload

These rules will persist after a reboot, so you shouldn't need to touch them again unless you want to allow more zones to be used for internet.

I'm on Fedora37, and with these settings my android device is "connected without internet access"

Luciogi · 2023-02-05T10:43:54Z

@tubbadu Please test this #166 (comment)

mxvin · 2023-07-14T18:26:41Z

We need proper support for firewalld. Something nice like @NHellFire script translating existing regular iptables rules. For fast and easy way already discussed here, that is masquerade+add ap0 to zones

KronosTheLate · 2023-11-20T08:27:17Z

On Debian 12 with firewalld enabled, the problem was fixed by only the first three lines. Namely:

sudo firewall-cmd --add-service=dhcp
sudo firewall-cmd --add-service=dns
sudo firewall-cmd  --add-masquerade

But yes, given that firewalld is enabled by default on deveral distros (Including Debian), this should probably be done automatically.

If nothing else, just check if sudo firewall-cmd --state returns running, and if it does, print something during installation along the lines of "You have firewalld running. This may require explicitly adding some rules for allowing network traffic. Please visit if you face issues.

EDIT: Even though I could not connect to the network, I could not use mDNS to resolve the hostname. I ended up disabling firewalld, and expect to be using something that is not as obstructive in the future.

poopsicles · 2024-01-08T14:31:09Z

Edit : This solution is NOT working, GOTO

Just add adapter name in variables(wifi_iface and internet_iface[In my case export wifi_iface=wlan0 export internet_iface=wlan0 ]) then execute commands

export wifi_iface=
export internet_iface=

sudo firewall-cmd --add-service=dhcp
sudo firewall-cmd --add-service=dns
sudo firewall-cmd  --add-masquerade

sudo firewall-cmd -q --direct --add-rule ipv4 nat POSTROUTING 0 -o $wifi_iface -j MASQUERADE
sudo firewall-cmd -q --direct --add-rule ipv4 filter FORWARD 0 -i $internet_iface -o $wifi_iface -j ACCEPT
sudo firewall-cmd -q --direct --add-rule ipv4 filter FORWARD 0 -i $wifi_iface -o $internet_iface -m state --state RELATED,ESTABLISHED -j ACCEPT

this works for me on fedora 39

poopsicles · 2024-01-10T09:39:35Z

Working Solution:

I am using Fedora 35 for testing, firewalld has default zone FedoraWorkstation. My approach is enable masquerade in zone trusted and FedoraWorkstation, and add interface ap0 to trusted zone executing following command block will allow internet access and ip allocation via hotspot
sudo firewall-cmd --zone=FedoraWorkstation --add-masquerade
sudo firewall-cmd --zone=trusted --add-masquerade
sudo firewall-cmd --zone=trusted --add-interface=ap0
Edit: Please test it and give feedback
* **fwd** firewall works without any problem

is there a way to make this permanent?
would adding --permanent work?

Luciogi · 2024-01-11T10:28:53Z

is there a way to make this permanent? would adding --permanent work?

No idea, I am not using firewalld and fedora anymore, I forgot whether these commands make permanent rules

lxwulf · 2024-01-15T18:54:38Z

I use Fedora Linux since version 30, and now I'm on version 39. I can confirm that the firewall-cmd command with option --permanent does work to have permanent settings. After this, you can reload the firewall to take the new settings in => firewall-cmd --reload.

All changes without the --permanent option are temporary and are lost when firewall gets reloaded firewall-cmd --reload or system rebooted.

nahil1 changed the title ~~firewalld blocks dhcp request by default in fedora 34~~ firewalld support Jun 23, 2021

Evan-aja mentioned this issue Sep 26, 2021

Stuck on Obtaining IP address (firewalld) garywill/linux-router#19

Open

lakinduakash added enhancement New feature or request help wanted Extra attention is needed investigation-required labels Dec 27, 2021

lakinduakash pinned this issue Dec 27, 2021

Luciogi mentioned this issue Mar 27, 2022

No IP Allocated Error #209

Closed

ShrirajHegde mentioned this issue Apr 7, 2022

AppImage or Flatpak Distribution #231

Open

Kirarya-Hotaru mentioned this issue Nov 29, 2022

[Bug] IP Configuration Failure from Connecting Device #282

Open

somesi mentioned this issue Apr 5, 2024

apply firewalld rules at install time somesi/linux-wifi-hotspot#2

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

firewalld support #166

firewalld support #166

nahil1 commented Jun 20, 2021 •

edited

tubbadu commented Mar 28, 2022

lakinduakash commented Mar 29, 2022

Luciogi commented Apr 8, 2022 •

edited

lakinduakash commented Apr 11, 2022 •

edited

Luciogi commented Apr 19, 2022

Luciogi commented Apr 21, 2022 •

edited

lakinduakash commented Apr 22, 2022

NHellFire commented Aug 23, 2022 •

edited

lxwulf commented Feb 1, 2023 •

edited

Working Solution:

Luciogi commented Feb 2, 2023

lxwulf commented Feb 2, 2023 •

edited

Luciogi commented Feb 3, 2023 •

edited

lxwulf commented Feb 4, 2023 •

edited

tubbadu commented Feb 5, 2023

Luciogi commented Feb 5, 2023

mxvin commented Jul 14, 2023

KronosTheLate commented Nov 20, 2023 •

edited

poopsicles commented Jan 8, 2024

Edit : This solution is NOT working, GOTO

poopsicles commented Jan 10, 2024

Working Solution:

Luciogi commented Jan 11, 2024

lxwulf commented Jan 15, 2024

firewalld support #166

firewalld support #166

Comments

nahil1 commented Jun 20, 2021 • edited

tubbadu commented Mar 28, 2022

lakinduakash commented Mar 29, 2022

Luciogi commented Apr 8, 2022 • edited

Edit : This solution is NOT working, GOTO

lakinduakash commented Apr 11, 2022 • edited

Luciogi commented Apr 19, 2022

Luciogi commented Apr 21, 2022 • edited

Working Solution:

lakinduakash commented Apr 22, 2022

NHellFire commented Aug 23, 2022 • edited

lxwulf commented Feb 1, 2023 • edited

Working Solution:

Luciogi commented Feb 2, 2023

lxwulf commented Feb 2, 2023 • edited

Luciogi commented Feb 3, 2023 • edited

lxwulf commented Feb 4, 2023 • edited

tubbadu commented Feb 5, 2023

Luciogi commented Feb 5, 2023

mxvin commented Jul 14, 2023

KronosTheLate commented Nov 20, 2023 • edited

poopsicles commented Jan 8, 2024

Edit : This solution is NOT working, GOTO

poopsicles commented Jan 10, 2024

Working Solution:

Luciogi commented Jan 11, 2024

lxwulf commented Jan 15, 2024

nahil1 commented Jun 20, 2021 •

edited

Luciogi commented Apr 8, 2022 •

edited

lakinduakash commented Apr 11, 2022 •

edited

Luciogi commented Apr 21, 2022 •

edited

NHellFire commented Aug 23, 2022 •

edited

lxwulf commented Feb 1, 2023 •

edited

lxwulf commented Feb 2, 2023 •

edited

Luciogi commented Feb 3, 2023 •

edited

lxwulf commented Feb 4, 2023 •

edited

KronosTheLate commented Nov 20, 2023 •

edited