[SOLVED] Create 2 firewalld zones on 1 linode, 1 external, 1 internal. Centos 7
I have 2 linode servers with CentOS 7 installed with Network manager and Firewalld.
I have the external ip and internal ip. The external ip i would like to use for the webservers. The internal ip i would like to use for a Xtradb percona cluster.
I would like to have the external ip connected to the firewalld zone "DMZ" with device eth0 and the internal ip connected to the firewalld zone "INTERNAL" with a eth0:0 device.
Without the firewalld / network manager It seems possible. Is it also possible with the firewalld and network manager?
My problem so far is that i cannot setup an extra virtual device eth0:0 which i connect to the zone 'internal'
Because when i setup a second connection the field "DEVICE" is empty.
Perhaps you have a link to a website with explanation which i can follow-up?
Thank you very much
1 Reply
The problem was that I thought i needed a second interface (like eth0:0) to be able to create 2 zones in Firewalld.
But this is not the case.
The solution is that in Firewalld you just have to add an IP address to a zone with the "–add-source" parameter and then
the zone will be activated and can be configurated for this ip adress(es).
Example: sudo firewall-cmd --zone=internal --add-source=192.168.xxx.xxx/32 --permanent
sudo firewall-cmd --get-active-zones
sudo firewall-cmd --zone=internal --list-all
So create a local network zone internal by adding the source and use the eth0 interface for the external internet zone, like dmz.
Explaination what helped my solve my question:
> A zone can be bound to a network interface (see above) and/or to a network addressing (called here a source).
Any network packet entering in the network stack is associated with a zone.
The association is done according to the following pattern:
– is the packet coming from a source already bound to a zone? (if yes, it is associated with this zone),
– if not, is the packet coming from a network interface already bound to a zone? (if yes, it is associated with this zone),
– if not, the packet is associated with the default zone.
source:https://www.certdepot.net/rhel7-get-started-firewalld/
Have a good one