Need help on firewalld

swh · July 19, 2024, 12:20pm

I have adjusted my firewalld. After the last update, a pacnew file was added and I merged them. Now firewalld no longer works as desired.
Is someone able to help me to fix this?

➜  sudo systemctl status firewalld
[sudo] Passwort für swh: 
● firewalld.service - firewalld - dynamic firewall daemon
     Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; preset: disabled)
     Active: active (running) since Fri 2024-07-19 14:13:22 CEST; 2min 35s ago
 Invocation: 624f52867fac45ddb43356f76603a30f
       Docs: man:firewalld(1)
   Main PID: 792 (firewalld)
      Tasks: 2 (limit: 18940)
     Memory: 61.9M (peak: 61.9M)
        CPU: 267ms
     CGroup: /system.slice/firewalld.service
             └─792 /usr/bin/python /usr/bin/firewalld --nofork --nopid

Jul 19 14:13:22 ryzen systemd[1]: Starting firewalld - dynamic firewall daemon...
Jul 19 14:13:22 ryzen systemd[1]: Started firewalld - dynamic firewall daemon.
Jul 19 14:13:25 ryzen firewalld[792]: ERROR: 'python-nftables' failed: internal:0:0-0: Error: Could not process rule: Datei o>
                                      
                                      internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden
                                      
                                      internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden
                                      
                                      internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden
                                      
                                      
                                      JSON blob:
                                      {"nftables": [{"metainfo": {"json_schema_version": 1}}, {"add": {"rule": {"family": "in>
Jul 19 14:13:25 ryzen firewalld[792]: ERROR: COMMAND_FAILED: 'python-nftables' failed: internal:0:0-0: Error: Could not proce>
                                      
                                      internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden
                                      
                                      internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden
                                      
                                      internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden
                                      
                                      
                                      JSON blob:
                                      {"nftables": [{"metainfo": {"json_schema_version": 1}}, {"add": {"rule": {"family": "in>
lines 11-36/36 (END)

I don’t understand internal error. I don’t know what it means.
As soon as I check ‘activate shields’ in the applet in the systray, the entire internet access is blocked with an error message

Datei oder Verzeichnis nicht gefunden means = File or directory not found
Somehow I must have messed something up big

Cphusion · July 19, 2024, 12:31pm

Last time I merged a file some merge things were added like special characters, things like ^^^^^merge and other lines that were added during the merge. This was with my mirrorlist, after I removed those I had a working mirrorlist again. I’m guessing this could be the case for your firewall configuration file as well.

swh · July 19, 2024, 12:38pm

this is my firewalld.conf

# firewalld config file

# default zone
# The default zone used if an empty zone string is used.
# Default: public
DefaultZone=public

# Clean up on exit
# If set to no or false the firewall configuration will not get cleaned up
# on exit or stop of firewalld.
# Default: yes
CleanupOnExit=yes

# Clean up kernel modules on exit
# If set to yes or true the firewall related kernel modules will be
# unloaded on exit or stop of firewalld. This might attempt to unload
# modules not originally loaded by firewalld.
# Default: no
CleanupModulesOnExit=no

# Lockdown
# If set to enabled, firewall changes with the D-Bus interface will be limited
# to applications that are listed in the lockdown whitelist.
# The lockdown whitelist file is lockdown-whitelist.xml
# Default: no
Lockdown=no

# IPv6_rpfilter
# Performs a reverse path filter test on a packet for IPv6. If a reply to the
# packet would be sent via the same interface that the packet arrived on, the
# packet will match and be accepted, otherwise dropped.
# The rp_filter for IPv4 is controlled using sysctl.
# Note: This feature has a performance impact. See man page FIREWALLD.CONF(5)
# for details.
# Default: yes
IPv6_rpfilter=yes

# IndividualCalls
# Do not use combined -restore calls, but individual calls. This increases the
# time that is needed to apply changes and to start the daemon, but is good for
# debugging.
# Default: no
IndividualCalls=no

# LogDenied
# Add logging rules right before reject and drop rules in the INPUT, FORWARD
# and OUTPUT chains for the default rules and also final reject and drop rules
# in zones. Possible values are: all, unicast, broadcast, multicast and off.
# Default: off
LogDenied=off

# FirewallBackend
# Selects the firewall backend implementation.
# Choices are:
#	- nftables (default)
#	- iptables (iptables, ip6tables, ebtables and ipset)
# Note: The iptables backend is deprecated. It will be removed in a future
# release.
FirewallBackend=nftables

# FlushAllOnReload
# Flush all runtime rules on a reload. In previous releases some runtime
# configuration was retained during a reload, namely; interface to zone
# assignment, and direct rules. This was confusing to users. To get the old
# behavior set this to "no".
# Default: yes
FlushAllOnReload=yes

# ReloadPolicy
# Policy during reload. By default all traffic except for established
# connections is dropped while the rules are updated. Set to "DROP", "REJECT"
# or "ACCEPT". Alternatively, specify it per table, like
# "OUTPUT:ACCEPT,INPUT:DROP,FORWARD:REJECT".
# Default: ReloadPolicy=INPUT:DROP,FORWARD:DROP,OUTPUT:DROP
ReloadPolicy=INPUT:DROP,FORWARD:DROP,OUTPUT:DROP

# RFC3964_IPv4
# As per RFC 3964, filter IPv6 traffic with 6to4 destination addresses that
# correspond to IPv4 addresses that should not be routed over the public
# internet.
# Defaults to "yes".
RFC3964_IPv4=yes

# NftablesFlowtable
# This may improve forwarded traffic throughput by enabling nftables flowtable.
# It is a software fastpath and avoids calling nftables rule evaluation for
# data packets. This only works for TCP and UDP traffic.
# The value is a space separated list of interfaces.
# Example value "eth0 eth1".
# Defaults to "off".
NftablesFlowtable=off

# NftablesCounters
# If set to yes, add a counter to every nftables rule. This is useful for
# debugging and comes with a small performance cost.
# Defaults to "no".
NftablesCounters=no

It seems OK

swh · July 19, 2024, 12:40pm

This is the error when i am activate firewalld via firewalld applet in systray

COMMAND_FAILED: 'python-nftables' failed: internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden

internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden

internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden

internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden

internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden

internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden

internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden

internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden

internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden

internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden

internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden

internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden

internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden

internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden

internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden

internal:0:0-0: Error: Could not process rule: Datei oder

As soon i activate it, my standard-zone is setting to block

Cphusion · July 19, 2024, 12:44pm

Here’s mine as a comparison.

# firewalld config file

# default zone
# The default zone used if an empty zone string is used.
# Default: public
DefaultZone=public

# Clean up on exit
# If set to no or false the firewall configuration will not get cleaned up
# on exit or stop of firewalld.
# Default: yes
CleanupOnExit=yes

# Clean up kernel modules on exit
# If set to yes or true the firewall related kernel modules will be
# unloaded on exit or stop of firewalld. This might attempt to unload
# modules not originally loaded by firewalld.
# Default: no
CleanupModulesOnExit=no

# IPv6_rpfilter
# Performs reverse path filtering (RPF) on IPv6 packets as per RFC 3704.
# Possible values:
#   - strict: Performs "strict" filtering as per RFC 3704. This check
#             verifies that the in ingress interface is the same interface
#             that would be used to send a packet reply to the source. That
#             is, ingress == egress.      
#   - loose: Performs "loose" filtering as per RFC 3704. This check only
#            verifies that there is a route back to the source through any
#            interface; even if it's not the same one on which the packet
#            arrived.
#   - strict-forward: This is almost identical to "strict", but does not perform
#                     RPF for packets targeted to the host (INPUT).
#   - loose-forward: This is almost identical to "loose", but does not perform
#                    RPF for packets targeted to the host (INPUT).
#   - no: RPF is completely disabled.
#
# The rp_filter for IPv4 is controlled using sysctl.
# Note: This feature has a performance impact. See man page FIREWALLD.CONF(5)
# for details.
# Default: strict
IPv6_rpfilter=strict

# IndividualCalls
# Do not use combined -restore calls, but individual calls. This increases the
# time that is needed to apply changes and to start the daemon, but is good for
# debugging.
# Default: no
IndividualCalls=no

# LogDenied
# Add logging rules right before reject and drop rules in the INPUT, FORWARD
# and OUTPUT chains for the default rules and also final reject and drop rules
# in zones. Possible values are: all, unicast, broadcast, multicast and off.
# Default: off
LogDenied=off

# FirewallBackend
# Selects the firewall backend implementation.
# Choices are:
#	- nftables (default)
#	- iptables (iptables, ip6tables, ebtables and ipset)
# Note: The iptables backend is deprecated. It will be removed in a future
# release.
FirewallBackend=nftables

# FlushAllOnReload
# Flush all runtime rules on a reload. In previous releases some runtime
# configuration was retained during a reload, namely; interface to zone
# assignment, and direct rules. This was confusing to users. To get the old
# behavior set this to "no".
# Default: yes
FlushAllOnReload=yes

# ReloadPolicy
# Policy during reload. By default all traffic except for established
# connections is dropped while the rules are updated. Set to "DROP", "REJECT"
# or "ACCEPT". Alternatively, specify it per table, like
# "OUTPUT:ACCEPT,INPUT:DROP,FORWARD:REJECT".
# Default: ReloadPolicy=INPUT:DROP,FORWARD:DROP,OUTPUT:DROP
ReloadPolicy=INPUT:DROP,FORWARD:DROP,OUTPUT:DROP

# RFC3964_IPv4
# As per RFC 3964, filter IPv6 traffic with 6to4 destination addresses that
# correspond to IPv4 addresses that should not be routed over the public
# internet.
# Defaults to "yes".
RFC3964_IPv4=yes

# NftablesFlowtable
# This may improve forwarded traffic throughput by enabling nftables flowtable.
# It is a software fastpath and avoids calling nftables rule evaluation for
# data packets. This only works for TCP and UDP traffic.
# The value is a space separated list of interfaces.
# Example value "eth0 eth1".
# Defaults to "off".
NftablesFlowtable=off

# NftablesCounters
# If set to yes, add a counter to every nftables rule. This is useful for
# debugging and comes with a small performance cost.
# Defaults to "no".
NftablesCounters=no

# NftablesTableOwner
# If set to yes, the generated nftables rule set will be owned exclusively by
# firewalld. This prevents other entities from mistakenly (or maliciously)
# modifying firewalld's rule set. If you intentionally modify firewalld's
# rules, then you will have to set this to "no".
# Defaults to "yes".
NftablesTableOwner=yes

I see some lines are different, try backing up your current firewalld.conf file and replacing it with mine to see what happens?

Cphusion · July 19, 2024, 12:45pm

When I check in the repos python-nftables doesn’t seem to exist?

swh · July 19, 2024, 12:57pm

You are right. Just cecked. How to remove that?

The same behavior as mine. Except that firewalld does not set itself to block. As soon as I set ‘activate shields’, I only have a limited connection. So I have to restart my computer every time I switch it on or off

A catastrophe. Something is completely messed up

Cphusion · July 19, 2024, 12:59pm

Is that package installed on your system?

swh · July 19, 2024, 1:00pm

No

➜  pactree python-nftables     
error: package 'python-nftables' not found

✗  pacman -Qs python-nftables

r0ckhopper · July 19, 2024, 1:06pm

Could it be this problem?

github.com/firewalld/firewalld

Incompatibilities with nftables 1.1.0 (ERROR: COMMAND_FAILED: 'python-nftables' failed)

opened 09:06PM - 18 Jul 24 UTC

Cherkah

triage

### What happened at the system start i have log issue: juil. 18 22:50:25 Leg…itux firewalld[869]: ERROR: UNKNOWN_INTERFACE: 'pvpnksintrf0' is not in any zone juil. 18 22:50:27 Legitux firewalld[869]: ERROR: 'handle' juil. 18 22:50:27 Legitux firewalld[869]: ERROR: COMMAND_FAILED: 'handle' i have 4 rules in the table which all of them have the same style: ` rule priority="2" family="ipv4" source address="0.0.0.0" destination address="X.X.X.X/32" port port="443" protocol="tcp" log prefix="Title" level="alert" drop` moreover firewalld doesn't filter the traffic as it should ### What you expected to happen know what happens and got some info ### How to reproduce it (as minimally and precisely as possible) i don't know ### Anything else we need to know? ``` juil. 18 22:50:24 Legitux firewalld[869]: ERROR: COMMAND_FAILED: 'python-nftables' failed: internal:0:0-0: Error: Could not process rule: Aucun fichier ou dossier de ce nom internal:0:0-0: Error: Could not process rule: Aucun fichier ou dossier de ce nom internal:0:0-0: Error: Could not process rule: Aucun fichier ou dossier de ce nom internal:0:0-0: Error: Could not process rule: Aucun fichier ou dossier de ce nom internal:0:0-0: Error: Could not process rule: Aucun fichier ou dossier de ce nom JSON blob: {"nftables": [{"metainfo": {"json_schema_version": 1}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter_FWD_block_allow", "expr": [{"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"accept": null}]}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter_INPUT_POLICIES", "expr": [{"match": {"left": {"meta":{"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"match": {"left": {"meta": {"key": "pkttype"}}, "op":"==", "right": "unicast"}}, {"counter": null}, {"log": {"prefix": "filter_IN_block_REJECT: "}}]}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter_INPUT_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"reject": {"type": "icmpx", "expr":"admin-prohibited"}}], "index": 0}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter_OUTPUT_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"return": null}]}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "nat_OUTPUT_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"return": null}]}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter_FORWARD_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnrouteintrf0"}}, {"match": {"left": {"meta": {"key": "pkttype"}}, "op": "==", "right": "unicast"}}, {"counter": null}, {"log": {"prefix": "filter_FWD_block_REJECT: "}}]}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter_FORWARD_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnrouteintrf0"}}, {"counter": null}, {"reject": {"type":"icmpx", "expr": "admin-prohibited"}}], "index": 0}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "nat_PREROUTING_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"return": null}]}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "mangle_PREROUTING_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==","right": "pvpnksintrf0"}}, {"counter": null}, {"return": null}]}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "nat_POSTROUTING_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op":"==", "right": "pvpnrouteintrf0"}}, {"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"return": null}]}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter_FORWARD_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnrouteintrf0"}}, {"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"match": {"left": {"meta": {"key": "pkttype"}}, "op": "==", "right": "unicast"}}, {"counter": null}, {"log": {"prefix": "filter_FWD_block_REJECT: "}}], "index": 1}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter_FORWARD_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnrouteintrf0"}}, {"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"reject": {"type": "icmpx", "expr": "admin-prohibited"}}], "index": 2}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "nat_POSTROUTING_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op":"==", "right": "pvpnksintrf0"}}, {"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnrouteintrf0"}}, {"counter": null}, {"return": null}], "index": 0}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter_FORWARD_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"match": {"left": {"meta": {"key": "pkttype"}}, "op": "==", "right": "unicast"}}, {"counter": null}, {"log": {"prefix": "filter_FWD_block_REJECT: "}}]}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter_FORWARD_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"reject": {"type": "icmpx", "expr": "admin-prohibited"}}], "index": 0}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "nat_POSTROUTING_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op":"==", "right": "pvpnksintrf0"}}, {"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"return": null}]}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter_FORWARD_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"match": {"left": {"meta": {"key": "pkttype"}}, "op": "==", "right": "unicast"}}, {"counter": null}, {"log": {"prefix": "filter_FWD_block_REJECT: "}}], "index": 3}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter_FORWARD_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"reject": {"type": "icmpx", "expr": "admin-prohibited"}}], "index": 4}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "nat_POSTROUTING_POLICIES", "expr": [{"match":{"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"return": null}], "index": 1}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter_FORWARD_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"match": {"left": {"meta": {"key": "pkttype"}}, "op": "==", "right": "unicast"}}, {"counter": null}, {"log": {"prefix": "filter_FWD_block_REJECT: "}}], "index": 25}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter_FORWARD_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"reject": {"type": "icmpx", "expr": "admin-prohibited"}}], "index": 26}}}, {"add": {"rule": {"family":"inet", "table": "firewalld", "chain": "nat_POSTROUTING_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"return": null}], "index": 15}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter_INPUT_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"jump": {"target": "filter_IN_block"}}]}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter_OUTPUT_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"jump": {"target": "filter_OUT_block"}}]}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "nat_OUTPUT_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"jump": {"target": "nat_OUT_block"}}]}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter_FORWARD_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnrouteintrf0"}}, {"counter": null}, {"jump": {"target": "filter_FWD_block"}}], "index": 1}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "nat_PREROUTING_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"jump": {"target": "nat_PRE_block"}}]}}}, {"insert":{"rule": {"family": "inet", "table": "firewalld", "chain": "mangle_PREROUTING_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"jump": {"target": "mangle_PRE_block"}}]}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "nat_POSTROUTING_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnrouteintrf0"}}, {"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"jump": {"target": "nat_POST_block"}}], "index": 0}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter_FORWARD_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnrouteintrf0"}}, {"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"jump": {"target": "filter_FWD_block"}}], "index": 6}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain":"nat_POSTROUTING_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnrouteintrf0"}}, {"counter": null}, {"jump": {"target": "nat_POST_block"}}], "index": 3}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter_FORWARD_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"jump": {"target": "filter_FWD_block"}}]}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "nat_POSTROUTING_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"jump": {"target": "nat_POST_block"}}]}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter_FORWARD_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"jump": {"target": "filter_FWD_block"}}], "index": 5}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "nat_POSTROUTING_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"jump": {"target": "nat_POST_block"}}], "index": 3}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter_FORWARD_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"jump": {"target": "filter_FWD_block"}}], "index": 29}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "nat_POSTROUTING_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"jump": {"target": "nat_POST_block"}}], "index": 19}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter_INPUT_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"jump": {"target": "filter_IN_policy_allow-host-ipv6"}}]}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "nat_PREROUTING_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"jump": {"target": "nat_PRE_policy_allow-host-ipv6"}}]}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "mangle_PREROUTING_POLICIES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}},"op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"jump": {"target": "mangle_PRE_policy_allow-host-ipv6"}}]}}}]} juil. 18 22:50:25 Legitux firewalld[869]: ERROR: UNKNOWN_INTERFACE: 'pvpnksintrf0' is not in any zone juil. 18 22:50:27 Legitux firewalld[869]: ERROR: 'handle' juil. 18 22:50:27 Legitux firewalld[869]: ERROR: COMMAND_FAILED: 'handle' ``` ### Firewalld Version 2.2.0-1 ### Firewalld Backend nftables ### Linux distribution endeavouros ### Linux kernel version 6.9.9-arch1-1 ### Other information _No response_

If so, the nftables package in Arch Linux has been fixed, and should be reaching the mirrors.

swh · July 19, 2024, 1:11pm

Thank you @r0ckhopper . It seems the same issue like mine. I have to wait until the update reached extra.

I report later if its fixed on my side

Cphusion · July 19, 2024, 1:17pm

I would be curios to know what causes the issues because I have nftables 1:1.1.0-1 and firewalld 2.2.0-1 on my system and I’m not experiencing issues with firewalld. Did I miss something in that issue?

swh · July 19, 2024, 1:23pm

It seems good.
But how do i set my standardzone to public instead of block?

block

Cphusion · July 19, 2024, 1:24pm

I think you have to run this.
sudo firewall-cmd --set-default-zone=public

swh · July 19, 2024, 1:26pm

Thanks. I used your firewalld.conf and there is standardzone defined as public. I try the command

swh · July 19, 2024, 1:28pm

I think I have misunderstood the principle. As soon as firewalld is active, it is set to public. But when I set ‘activate shields’ it automatically sets to block. I hope my english gave it as I wanted to express it

Cphusion · July 19, 2024, 1:30pm

What is “activate shields”? Why do you need to set your default zone to block? Is your system directly accessible from the internet, by which I mean do you have port forwarding enabled on your isp router forwarding to ports on your pc’s ports? Public zone for home use should be just fine because only the ssh port is open by default on the public zone?

r0ckhopper · July 19, 2024, 1:31pm

I use ufw so wouldn’t know!

I was searching for a python-nftables Arch package (had it been renamed or dropped to the AUR), when I found the nftables package and the very recent commit.

swh · July 19, 2024, 1:34pm

In the systray is the display of the fireall applet where I can select whether I want to ‘activate shields’ or not
As soon as I activate this, firewalld automatically sets the default zone to block.

I must have misunderstood this

Cphusion · July 19, 2024, 1:36pm

I don’t use the firewall-gui, I just use firewall-cmd when I do need to configure something. But setting the default zone to “block” seem unnecessary for a home computer which isn’t directly accessible from the internet. Someone will probably disagree with me but it’s up to you what you want to do.