{"action":"created","issue":{"url":"https://api.github.com/repos/firewalld/firewalld/issues/177","repository_url":"https://api.github.com/repos/firewalld/firewalld","labels_url":"https://api.github.com/repos/firewalld/firewalld/issues/177/labels{/name}","comments_url":"https://api.github.com/repos/firewalld/firewalld/issues/177/comments","events_url":"https://api.github.com/repos/firewalld/firewalld/issues/177/events","html_url":"https://github.com/firewalld/firewalld/issues/177","id":193280585,"node_id":"MDU6SXNzdWUxOTMyODA1ODU=","number":177,"title":"trusted zone is publicly accessible","user":{"login":"pavels","id":244128,"node_id":"MDQ6VXNlcjI0NDEyOA==","avatar_url":"https://avatars2.githubusercontent.com/u/244128?v=4","gravatar_id":"","url":"https://api.github.com/users/pavels","html_url":"https://github.com/pavels","followers_url":"https://api.github.com/users/pavels/followers","following_url":"https://api.github.com/users/pavels/following{/other_user}","gists_url":"https://api.github.com/users/pavels/gists{/gist_id}","starred_url":"https://api.github.com/users/pavels/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pavels/subscriptions","organizations_url":"https://api.github.com/users/pavels/orgs","repos_url":"https://api.github.com/users/pavels/repos","events_url":"https://api.github.com/users/pavels/events{/privacy}","received_events_url":"https://api.github.com/users/pavels/received_events","type":"User","site_admin":false},"labels":[{"id":185678898,"node_id":"MDU6TGFiZWwxODU2Nzg4OTg=","url":"https://api.github.com/repos/firewalld/firewalld/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2016-12-03T11:00:53Z","updated_at":"2018-06-01T19:44:21Z","closed_at":null,"author_association":"NONE","body":"When interface is placed in trusted zone, 2 rules are created in forward chain\r\n\r\n-A FWDI_trusted -j ACCEPT\r\nand\r\n-A FWDO_trusted -j ACCEPT\r\n\r\nthe first rule is understandable, \"everything from trusted zone is free to be forwarded anywhere\" - i trust the computers in \"trusted\", so they can do whatever they want.\r\n\r\nThe second rule is very strange - \"anybody can talk to trusted zone from outside\"\r\n\r\nIf i have 2 interfaces, one is in \"public\" zone (which is very untrusted, anything can be there) and one in \"trusted\" zone, this second rule will allow any connections from the public zone be forwarded into trusted zone. That seem kind of strange.\r\n\r\nAlso if i want to implement the same behavior as \"trusted\" but without that rule, which allows anybody to talk to to trusted zone computers, it is impossible, because all FORWARD rules is hard coded in firewalld and cant be influenced from configuration (except port forwarding).  "},"comment":{"url":"https://api.github.com/repos/firewalld/firewalld/issues/comments/393989609","html_url":"https://github.com/firewalld/firewalld/issues/177#issuecomment-393989609","issue_url":"https://api.github.com/repos/firewalld/firewalld/issues/177","id":393989609,"node_id":"MDEyOklzc3VlQ29tbWVudDM5Mzk4OTYwOQ==","user":{"login":"erig0","id":313253,"node_id":"MDQ6VXNlcjMxMzI1Mw==","avatar_url":"https://avatars2.githubusercontent.com/u/313253?v=4","gravatar_id":"","url":"https://api.github.com/users/erig0","html_url":"https://github.com/erig0","followers_url":"https://api.github.com/users/erig0/followers","following_url":"https://api.github.com/users/erig0/following{/other_user}","gists_url":"https://api.github.com/users/erig0/gists{/gist_id}","starred_url":"https://api.github.com/users/erig0/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erig0/subscriptions","organizations_url":"https://api.github.com/users/erig0/orgs","repos_url":"https://api.github.com/users/erig0/repos","events_url":"https://api.github.com/users/erig0/events{/privacy}","received_events_url":"https://api.github.com/users/erig0/received_events","type":"User","site_admin":false},"created_at":"2018-06-01T19:44:21Z","updated_at":"2018-06-01T19:44:21Z","author_association":"COLLABORATOR","body":"@pavels, firewalld zones are applied at ingress. But after ingress packets may be forwarded by the host freely between zones. I realize this may be different than zones in other firewalls, but firewalld has functioned this way since day one. Changing the behavior would require a lot of thought.\r\n\r\nI'm marking this issue as an enhancement."}}
{"actor":{"display_login":"erig0"}}