4

I cannot find docs on how to enable multicast for firewalld which is the default firewall in RHEL / CentOS 7. Can some enlighten me? FYI: I know how to do it using iptables.

1

5 Answers 5

4

At first I tried this command:

firewall-cmd --direct --add-rule ipv4 filter IN_public_allow 1 -d 224.0.0.18 -j ACCEPT

but it seems that CentOS7 cannot reload direct rules after reboot.

[root@test01-galera02 firewalld]# firewall-cmd --direct --get-all-rules
[root@test01-galera02 firewalld]# firewall-cmd --direct --get-all-rules --permanent
ipv4 filter IN_public_allow 1 -d 224.0.0.18 -j ACCEPT
[root@test01-galera02 firewalld]# 
[root@test01-galera02 firewalld]# cat direct.xml 
<?xml version="1.0" encoding="utf-8"?>
<direct>
  <rule priority="1" table="filter" ipv="ipv4" chain="IN_public_allow">-d 224.0.0.18 -j ACCEPT</rule>
</direct>
[root@test01-galera02 firewalld]# pwd
/etc/firewalld
[root@test01-galera02 firewalld]#

Second, I successfully used this command. firewalld runs fine now on my galera cluster with keepalived on it.

 firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" destination address="224.0.0.18" protocol value="ip" accept' --permanent
 firewall-cmd --reload
2
  • +1, but I had to change protocol value from ip to 2. Otherwise I was getting ERROR: INVALID_PROTOCOL: ip, because /etc/protocol has no such name. I used the 2 because the REJECT logs stated PROTO=2.
    – Hi-Angel
    Sep 14, 2019 at 0:08
  • Ah, btw: I did not use anything but the last command firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" destination address="224.0.0.18" protocol value="ip" accept' --permanent. I did not even do the --reload. I guess modern versions of firewalld handle that themselves. 0.7.1 version is here (note also, nowadays it's not using iptables by default).
    – Hi-Angel
    Sep 14, 2019 at 0:18
1

IPv6

firewall-cmd --permanent --direct --add-rule ipv6 filter PREROUTING 0 -t raw -m rpfilter --invert -j ACCEPT
firewall-cmd --permanent --direct --add-rule ipv6 filter INPUT 0 -d ff00::/8 -j ACCEPT
firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 0 -d ff00::/8 -j ACCEPT

IPv4

firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -m udp -p udp -m pkttype --pkt-type multicast -j ACCEPT
0

you open file: /etc/firewalld/direct.xml write:

<?xml version="1.0" encoding="utf-8"?>
<direct>
<rule priority="1" table="filter" ipv="ipv4" chain="IN_public_allow">-d 
224.0.0.18 -j ACCEPT</rule>
</direct>

replace ens33 to your server's port then: firewall-cmd --reload

0

You open this file: /etc/firewalld/direct.xml.
Write:

<?xml version="1.0" encoding="utf-8"?>
<direct>
<rule priority="0" table="filter" ipv="ipv4" chain="OUTPUT">' --out-interface' [ens33] --destination 224.0.0.18 --protocol vrrp -j ACCEPT</rule>
<rule priority="1" table="filter" ipv="ipv4" chain="IN_public_allow">-d 224.0.0.18 -j ACCEPT</rule>
</direct>

Replace [ens33] with your server's port.
Then: firewall-cmd --reload.

0

Variant for Firewalld using rich-rules:

ALLOW_MULTICAST_RICH_RULE='
  rule family=ipv4
  destination address=224.0.0.0/4
  protocol value=udp
  accept'
ALLOW_IGMP_RICH_RULE='
  rule family=ipv4
  protocol value=igmp
  accept'
firewall-cmd --permanent --add-rich-rule="$ALLOW_MULTICAST_RICH_RULE"
firewall-cmd --permanent --add-rich-rule="$ALLOW_IGMP_RICH_RULE"
firewall-cmd --reload

In addition to CentOS 7, this also works in CentOS 8, in which direct rules are not supported by default:

Note that firewalld with nftables backend does not support passing custom nftables rules to firewalld, using the --direct option.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.