1 Feb
2019
1 Feb
'19
2:28 p.m.
On Thu, Jan 31, 2019 at 10:10:43PM -0500, Laine Stump wrote:
On 1/31/19 8:24 PM, Laine Stump wrote:
Changes from V1: [...]
* make the <reject/> rule's priority 32767 instead of 127. [...]
+ +<rule priority='32767'> + <reject/> +</rule>
I found out after sending this that when I make the priority of the reject rule 32767 instead of 127, it's apparently ignored (in my example, I was able to ssh to port 222 of the host even though the zone doesn't allow that).
Eric, any idea why this might be happening?
What build are you testing against? At one point the limit was 127, but I increased it before pushing it upstream. You can check the firewalld logs - there may be an error reporting the above priority is out of range.