action #45731

Bug: firewalld is blocking everything until it's restarted

Added by flacco 15 days ago. Updated 10 days ago.

Status:In ProgressStart date:04/01/2019
Priority:UrgentDue date:11/01/2019
Assignee:ingogoeppert% Done:

80%

Category:-
Target version:14.0
Duration: 6

Description

After a reboot of an invis server the new firwalld daemon is blocking everything until it is restarted.


Related issues

Related to invisAD-setup - action #36079: Modify sine2 / invisAD-setup to be compatible with leap 15 In Progress 10/05/2018

History

#1 Updated by flacco 15 days ago

  • Related to action #36079: Modify sine2 / invisAD-setup to be compatible with leap 15 added

#2 Updated by flacco 14 days ago

  • Status changed from New to In Progress
  • % Done changed from 0 to 80

It seems that firewalld starts to early. The original service-unit file defines to start firewalld before "network-pre.target":

"[Unit]
Description=firewalld - dynamic firewall daemon
Before=network-pre.target
Wants=network-pre.target
After=dbus.service
After=polkit.service
..."

Starting firewalld later brings the risk that the system runs for a few moments without the firewall. Sytemd knows three different network targets. "network-pre.target", "network.target" and "network-online.target". The last one means that all network interfaces are up and online. Starting the firewall before this target should be secure enough.

Changing the firewalld service-unit file to:

"[Unit]
Description=firewalld - dynamic firewall daemon
After=network-pre.target
Before=network-online.target
After=dbus.service
After=polkit.service
..."

did the job. This should be secure enough.

#3 Updated by flacco 14 days ago

... but I don't know if we should place a "Wants=network.online.target" in the service-unit file?

#4 Updated by ingogoeppert 10 days ago

firewalld does not start to early. It works on my system. I am unable to reproduce this issue.

Also available in: Atom PDF