1

I inherited a system that has rules implemented with firewall-cmd, it has the below rules. Another system is trying to connect to snmp port (UDP/161) but is not able (my server is responding with ICMP Host administratively prohibited). if I remove the rule "reject-with icmp-host-prohibited" using iptables command from INPUT and FORWARD chains it works fine.

How can I remove this rule using firewall-cmd ? or better, how can I allow the traffic for UDP/161 ?

[root@host]# firewall-cmd --direct --get-all-rules
ipv4 filter INPUT_direct 2 -p tcp --dport 10000 -m limit --limit 50/second --limit-burst 1 -j ACCEPT
ipv4 filter INPUT_direct 2 -p tcp --dport 10020 -m limit --limit 50/second --limit-burst 1 -j ACCEPT
ipv4 filter INPUT_direct 2 -p tcp --dport 11000 -m limit --limit 50/second --limit-burst 1 -j ACCEPT
ipv4 filter INPUT_direct 2 -p tcp --dport 11020 -m limit --limit 50/second --limit-burst 1 -j ACCEPT
ipv4 filter INPUT_direct 2 -p udp --dport 161 -j ACCEPT
ipv4 filter OUTPUT 3 -j DROP
ipv4 filter OUTPUT 0 -p icmp -j ACCEPT
ipv4 filter OUTPUT 0 -p tcp -m multiport --dport=53,22,80,443 -j ACCEPT
ipv4 filter OUTPUT 1 -p tcp -m multiport --sport=53,22,80,443 -j ACCEPT
ipv4 filter OUTPUT 0 -p tcp -m multiport --dport=1024:65535 -j ACCEPT
ipv4 filter OUTPUT 1 -p tcp -m multiport --sport=1024:65535 -j ACCEPT
ipv4 filter OUTPUT 0 -p udp -m multiport --dport=1024:65535 -j ACCEPT
ipv4 filter OUTPUT 1 -p udp -m multiport --sport=1024:65535 -j ACCEPT
ipv4 filter OUTPUT 0 -p udp --dport=161 -j ACCEPT
ipv4 filter OUTPUT 1 -p udp --sport=161 -j ACCEPT
ipv4 filter OUTPUT 0 -p udp --dport=162 -j ACCEPT
ipv4 filter OUTPUT 1 -p udp --sport=162 -j ACCEPT
ipv4 filter OUTPUT 0 -p udp --dport=705 -j ACCEPT
ipv4 filter OUTPUT 1 -p udp --sport=705 -j ACCEPT
ipv4 filter INPUT 0 -m pkttype --pkt-type multicast -i ens224 -j ACCEPT
ipv4 filter INPUT 1 -p udp -m udp -i ens224 -j ACCEPT
ipv4 nat PREROUTING 0 -p tcp --destination 172.16.187.39 --dport 10700 -j DNAT --to 172.16.187.7:10700
ipv4 filter FORWARD_direct 2 -p udp --dport 161 -j ACCEPT

it is translated to the following iptables rules:

[root@host]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            
INPUT_direct  all  --  anywhere             anywhere            
INPUT_ZONES_SOURCE  all  --  anywhere             anywhere            
INPUT_ZONES  all  --  anywhere             anywhere            
DROP       all  --  anywhere             anywhere             ctstate INVALID
REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            
FORWARD_direct  all  --  anywhere             anywhere            
FORWARD_IN_ZONES_SOURCE  all  --  anywhere             anywhere            
FORWARD_IN_ZONES  all  --  anywhere             anywhere            
FORWARD_OUT_ZONES_SOURCE  all  --  anywhere             anywhere            
FORWARD_OUT_ZONES  all  --  anywhere             anywhere            
DROP       all  --  anywhere             anywhere             ctstate INVALID
REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
OUTPUT_direct  all  --  anywhere             anywhere            

Chain FORWARD_IN_ZONES (1 references)
target     prot opt source               destination         
FWDI_ledefaultzone  all  --  anywhere             anywhere            [goto] 
FWDI_ledefaultzone  all  --  anywhere             anywhere            [goto] 
FWDI_ledefaultzone  all  --  anywhere             anywhere            [goto] 

Chain FORWARD_IN_ZONES_SOURCE (1 references)
target     prot opt source               destination         

Chain FORWARD_OUT_ZONES (1 references)
target     prot opt source               destination         
FWDO_ledefaultzone  all  --  anywhere             anywhere            [goto] 
FWDO_ledefaultzone  all  --  anywhere             anywhere            [goto] 
FWDO_ledefaultzone  all  --  anywhere             anywhere            [goto] 

Chain FORWARD_OUT_ZONES_SOURCE (1 references)
target     prot opt source               destination         

Chain FORWARD_direct (1 references)
target     prot opt source               destination         
ACCEPT     udp  --  anywhere             anywhere             udp dpt:snmp

Chain FWDI_ledefaultzone (3 references)
target     prot opt source               destination         
FWDI_ledefaultzone_log  all  --  anywhere             anywhere            
FWDI_ledefaultzone_deny  all  --  anywhere             anywhere            
FWDI_ledefaultzone_allow  all  --  anywhere             anywhere            
ACCEPT     icmp --  anywhere             anywhere            

Chain FWDI_ledefaultzone_allow (1 references)
target     prot opt source               destination         

Chain FWDI_ledefaultzone_deny (1 references)
target     prot opt source               destination         

Chain FWDI_ledefaultzone_log (1 references)
target     prot opt source               destination         

Chain FWDO_ledefaultzone (3 references)
target     prot opt source               destination         
FWDO_ledefaultzone_log  all  --  anywhere             anywhere            
FWDO_ledefaultzone_deny  all  --  anywhere             anywhere            
FWDO_ledefaultzone_allow  all  --  anywhere             anywhere            

Chain FWDO_ledefaultzone_allow (1 references)
target     prot opt source               destination         

Chain FWDO_ledefaultzone_deny (1 references)
target     prot opt source               destination         

Chain FWDO_ledefaultzone_log (1 references)
target     prot opt source               destination         

Chain INPUT_ZONES (1 references)
target     prot opt source               destination         
IN_ledefaultzone  all  --  anywhere             anywhere            [goto] 
IN_ledefaultzone  all  --  anywhere             anywhere            [goto] 
IN_ledefaultzone  all  --  anywhere             anywhere            [goto] 

Chain INPUT_ZONES_SOURCE (1 references)
target     prot opt source               destination         

Chain INPUT_direct (1 references)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ndmp limit: avg 50/sec burst 1
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:10020 limit: avg 50/sec burst 1
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:irisa limit: avg 50/sec burst 1
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:11020 limit: avg 50/sec burst 1
ACCEPT     udp  --  anywhere             anywhere             udp dpt:snmp
ACCEPT     all  --  anywhere             anywhere             PKTTYPE = multicast
ACCEPT     udp  --  anywhere             anywhere             udp

Chain IN_ledefaultzone (3 references)
target     prot opt source               destination         
IN_ledefaultzone_log  all  --  anywhere             anywhere            
IN_ledefaultzone_deny  all  --  anywhere             anywhere            
IN_ledefaultzone_allow  all  --  anywhere             anywhere            
ACCEPT     icmp --  anywhere             anywhere            

Chain IN_ledefaultzone_allow (1 references)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:20701 ctstate NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:33000 ctstate NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:7199 ctstate NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:yo-main ctstate NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:33003 ctstate NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:10742 ctstate NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:33005 ctstate NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:rmiregistry ctstate NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:10701 ctstate NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:33002 ctstate NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:11443 ctstate NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh ctstate NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:20601 ctstate NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:33004 ctstate NEW
ACCEPT     udp  --  anywhere             anywhere             udp dpt:ntp ctstate NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:10700 ctstate NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:33006 ctstate NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:10760 ctstate NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:blocks ctstate NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:20700 ctstate NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:33001 ctstate NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:amanda ctstate NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:23232 ctstate NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:10388 ctstate NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:20600 ctstate NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:10181 ctstate NEW

Chain IN_ledefaultzone_deny (1 references)
target     prot opt source               destination         

Chain IN_ledefaultzone_log (1 references)
target     prot opt source               destination         

Chain OUTPUT_direct (1 references)
target     prot opt source               destination         
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere             multiport dports domain,ssh,http,https
ACCEPT     tcp  --  anywhere             anywhere             multiport dports 1024:65535
ACCEPT     udp  --  anywhere             anywhere             multiport dports 1024:65535
ACCEPT     udp  --  anywhere             anywhere             udp dpt:snmp
ACCEPT     udp  --  anywhere             anywhere             udp dpt:snmptrap
ACCEPT     udp  --  anywhere             anywhere             udp dpt:agentx
ACCEPT     tcp  --  anywhere             anywhere             multiport sports domain,ssh,http,https
ACCEPT     tcp  --  anywhere             anywhere             multiport sports 1024:65535
ACCEPT     udp  --  anywhere             anywhere             multiport sports 1024:65535
ACCEPT     udp  --  anywhere             anywhere             udp spt:snmp
ACCEPT     udp  --  anywhere             anywhere             udp spt:snmptrap
ACCEPT     udp  --  anywhere             anywhere             udp spt:agentx
DROP       all  --  anywhere             anywhere            
  • Try this.... firewall-cmd --permanent --zone=public --add-port=161/udp, then firewall-cmd --reload, and then firewall-cmd --list-ports.... You should also be able to use netstat -ano to confirm the port is listening perhaps. – Pimp Juice IT Jul 11 '18 at 15:08
  • thanks the command solved the my problem, just had to replace zone 'public' with the active zone. please put your comment as an answer and I'll accept it – Rima Jul 14 '18 at 0:25
  • As requested, I've added as an answer with more thorough detail though as I normally do. I'm glad to help you get this fixed. – Pimp Juice IT Jul 14 '18 at 0:57
2

You can use the firewall-cmd CLI client tool to add a permanent rule and allow the specific UDP port through the firewalld daemon for the applicable zone.

1. Get the Active Interface Zone(s)

--get-active-zones

2. Allowing the UDP Port Traffic Through

firewall-cmd --permanent --zone=<zone> --add-port=161/udp
firewall-cmd --reload

Note: The <zone> value will be the value needed per the command #1.


3. Confirming

firewall-cmd --list-ports

Further Resources

  • firewall-cmd

    --get-active-zones
    

    Print currently active zones altogether with interfaces and sources used in these zones. Active zones are zones, that have a binding to an interface or source. The output format is:


    --permanent
    

    The permanent option --permanent can be used to set options permanently. These changes are not effective immediately, only after service restart/reload or system reboot. Without the --permanent option, a change will only be part of the runtime configuration.

    If you want to make a change in runtime and permanent configuration, use the same call with and without the --permanent option.

    The --permanent option can be optionally added to all options further down where it is supported.


    [--permanent] [--zone=zone] --add-port=portid[-portid]/protocol [--timeout=timeval]
    

    Add the port for zone. If zone is omitted, default zone will be used. This option can be specified multiple times. If a timeout is supplied, the rule will be active for the specified amount of time and will be removed automatically afterwards. timeval is either a number (of seconds) or number followed by one of characters s (seconds), m (minutes), h (hours), for example 20m or 1h.

    The port can either be a single port number or a port range portid-portid. The protocol can either be tcp, udp, sctp or dccp.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.