448407 2022-01-13 22:51:16 +0000 Contradictory firewall status information with nftables / firewalld and Plasma System Settings Firewall 2022-02-21 19:07:33 +0000 1 1 2 Applications systemsettings kcm_firewall 5.23.5 Arch Linux Linux RESOLVED FIXED NOR normal --- 1 liubomirwm lucas.biaggi lucas.biaggi nate tcanabrava https://invent.kde.org/plasma/plasma-firewall/-/commit/5f24d46d815fc982dcc0d67425447d6dad34120b 5.25 0 oldest_to_newest 2093344 0 liubomirwm 2022-01-13 22:51:16 +0000 SUMMARY I've got both iptables, nftables and firewalld installed. Cannot remove iptables because it is a dependency of systemd. The issue is that the Plasma Firewall inside the System Settings shows that the "Default Incoming Policy" and "Default Outgoing Policy" are "Allow", when this is not true in practice. The currently used connection is using the wlp3s0 interface. ------------------------------------------------------------------------------------------------------------------------------------------------------------ Output of iptables --list Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination ------------------------------------------------------------------------------------------------------------------------------------------------------------ Output of firewall-cmd --get-active-zones public interfaces: wlp3s0 trusted interfaces: lo ------------------------------------------------------------------------------------------------------------------------------------------------------------ Output of firewall-cmd --info-zone=public public (active) target: DROP icmp-block-inversion: no interfaces: wlp3s0 sources: services: dhcpv6-client ports: protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: OBSERVED RESULT Plasma Firewall shows that the "Default Incoming Policy" and "Default Outgoing Policy" are "Allow". EXPECTED RESULT Plasma Firewall should show that the "Default Incoming Policy" is "Drop" and "Default Outgoing Policy" is "Allow". SOFTWARE/OS VERSIONS firewalld 1.0.2-2 iptables 1:1.8.7-1 nftables 1:1.0.1-3 Operating System: Arch Linux KDE Plasma Version: 5.23.5 KDE Frameworks Version: 5.90.0 Qt Version: 5.15.2 Kernel Version: 5.15.13-zen1-1-zen (64-bit) Graphics Platform: Wayland Processors: 8 × Intel® Core™ i5-8250U CPU @ 1.60GHz Memory: 7,6 GiB of RAM Graphics Processor: Mesa Intel® UHD Graphics 620 2093350 1 liubomirwm 2022-01-13 23:00:58 +0000 nft list tables gives only: table inet firewalld 2095420 2 lucas.biaggi 2022-01-19 15:46:59 +0000 Today the default policies are hardcoded, I will fix it on weekend. 2106945 3 nate 2022-02-21 19:07:33 +0000 Fixed by Lucas Biaggi with https://invent.kde.org/plasma/plasma-firewall/-/commit/5f24d46d815fc982dcc0d67425447d6dad34120b in Plasma 5.25!