我在设置firewalld与docker和fail2ban完美连接时遇到问题。
首先，我想要实现的是以下流量路由设置：
[PUBLIC] ->
[FIREWALLD] -> (
[143/tcp FORWARD PORT] -----> [DOCKER/143/tcp]
[ 22/tcp] -----> [openssh locally running]
)
失败2ban
我设置了 fail2ban 来监听我的 docker 容器，检查身份验证错误并使用 设置禁令firewall-cmd。到目前为止，这很有效。只要我 3 次身份验证错误，它就会向防火墙发送命令。
端口转发
我还为 docker 设置了端口转发。我明确地设置了它，因为我不想让 docker 破坏我的网络。也许这是我将来不需要的东西，但它是通过StrictForwardPorts=yes配置配置的。https ://firewalld.org/2024/11/strict-forward-ports
目标
目标是每当触发 fail2ban 时，IP都不应再访问端口 143（转发端口），并且（可能）其他端口也不应再访问。但首先，我想逐个端口禁止。
问题
当前的问题是，如果创建了拒绝富规则，它将阻止该 IP 的端口 22，但不会阻止端口 143。
尝试
我还尝试将 IP 放入drop区域，并赋予其优先级-10。同样的错误结果。端口 22 被丢弃，但 143 仍然有效。
我做错了什么？这是我上次尝试的区域配置：
docker (active)
target: ACCEPT
ingress-priority: 0
egress-priority: 0
icmp-block-inversion: no
interfaces: br-0aa8d4b5dde7 docker0
sources:
services:
ports:
protocols:
forward: yes
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule priority="-999" family="ipv4" source address="192.168.178.44" reject
drop (active)
target: DROP
ingress-priority: -10
egress-priority: -10
icmp-block-inversion: no
interfaces:
sources: 192.168.178.44
services:
ports:
protocols:
forward: yes
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
public (default, active)
target: default
ingress-priority: 0
egress-priority: 0
icmp-block-inversion: no
interfaces:
sources:
services: dhcpv6-client ssh
ports:
protocols:
forward: yes
masquerade: no
forward-ports:
port=143:proto=tcp:toport=143:toaddr=172.18.0.2
source-ports:
icmp-blocks:
rich rules:
rule priority="-999" family="ipv4" source address="192.168.178.44" reject
如图所示：实际上，地址 192.168.178.44 应该完全阻止进入公共区域。但事实并非如此。此外，我还将 IP 添加到了丢弃区。丢弃区优先级似乎正在发挥作用，因为我的 SSH 连接被丢弃而不是被拒绝，但端口 143 仍然可以访问
更新 1：一些调试信息
$ sudo firewall-cmd --get-policies
allow-host-ipv6 docker-forwarding
更新 2：--info-policy=docker-forwarding
docker-forwarding (active)
priority: -1
target: ACCEPT
ingress-zones: ANY
egress-zones: docker
services:
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules: `
更新 3：
我想到另一个想法是创建另一个优先级为 -10 的策略，其中包含丰富的规则：
sudo firewall-cmd --permanent --new-policy ban-pre-routing
sudo firewall-cmd --permanent --policy ban-pre-routing --add-ingress-zone ANY
sudo firewall-cmd --permanent --policy ban-pre-routing --add-egress-zone HOST
sudo firewall-cmd --permanent --policy ban-pre-routing --set-priority -10
sudo firewall-cmd --permanent --policy ban-pre-routing --add-rich-rule="rule family=ipv4 source address=192.168.178.44 port port=143 protocol=tcp reject"
仍然没有效果。我的 *.44 主机仍然可以连接到机器。如果我省略该port port=143 protocol=tcp部分，它会阻止机器使用 ssh - 但仍然能够访问端口 143。
更新 4： 使用更新 3 并将策略配置为出口区域 docker，不会产生差异。我的配置现在如下所示：
$ sudo firewall-cmd --list-all-policies
allow-host-ipv6 (active)
priority: -15000
target: CONTINUE
ingress-zones: ANY
egress-zones: HOST
services:
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family="ipv6" icmp-type name="neighbour-advertisement" accept
rule family="ipv6" icmp-type name="neighbour-solicitation" accept
rule family="ipv6" icmp-type name="redirect" accept
rule family="ipv6" icmp-type name="router-advertisement" accept
ban-pre-routing (active)
priority: -10
target: CONTINUE
ingress-zones: ANY
egress-zones: docker
services:
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family="ipv4" source address="192.168.178.44" port port="143" protocol="tcp" reject
docker-forwarding (active)
priority: -1
target: ACCEPT
ingress-zones: ANY
egress-zones: docker
services:
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
对于区域：
$ sudo firewall-cmd --list-all --zone=public
public (default, active)
target: default
ingress-priority: 0
egress-priority: 0
icmp-block-inversion: no
interfaces:
sources:
services: dhcpv6-client ssh
ports:
protocols:
forward: yes
masquerade: no
forward-ports:
port=143:proto=tcp:toport=143:toaddr=172.18.0.2
source-ports:
icmp-blocks:
rich rules:
$ sudo firewall-cmd --list-all --zone=drop
drop
target: DROP
ingress-priority: 0
egress-priority: 0
icmp-block-inversion: no
interfaces:
sources:
services:
ports:
protocols:
forward: yes
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
$ sudo firewall-cmd --list-all --zone=docker
docker (active)
target: ACCEPT
ingress-priority: 0
egress-priority: 0
icmp-block-inversion: no
interfaces: br-c5f172e4effe docker0
sources:
services:
ports:
protocols:
forward: yes
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
