Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[bug]: Firewall - Interfaces #94

Closed
Andsup opened this issue Apr 15, 2024 · 22 comments
Closed

[bug]: Firewall - Interfaces #94

Andsup opened this issue Apr 15, 2024 · 22 comments
Assignees
@prashobkarimbil
Labels
bug Something isn't working

Comments

@Andsup
Copy link

Andsup commented Apr 15, 2024 •
edited

FreePBX Version

FreePBX 17

Issue Description

On a fresh freepbx 17 beta install, I added some trusted IP and networks in the firewall configuration.
Responsive Firewall is active.
No way to move the only one interface (ns3) to “Internet (default firewall)”

After “update interfaces”, status is back to “trusted”.

Another issue with the firewall: the wireguard ‘wg0’ interface is not listed on the interfaces screen.
Visible on the dashboard but not in the firewall.

Operating Environment

Debian 12.5
freepbx 17 - edge mode fully updated
FreePBX 17.0.15.13
System Firewall 17.0.1.14

Relevant log output

No response
@Andsup Andsup added bug Something isn't working triage Triage labels Apr 15, 2024
@nobe80
Copy link

nobe80 commented Apr 18, 2024

can agree

@kguptasangoma
Copy link
Member

firewall v17.0.1.16
sysadmin v17.0.1.57

@kguptasangoma kguptasangoma removed the triage Triage label Apr 19, 2024
@kguptasangoma kguptasangoma mentioned this issue Apr 19, 2024
Closed
@Andsup
Copy link
Author

Andsup commented Apr 19, 2024 •
edited

Just run:

  • fwconsole ma upgradeall
  • firewall ==> 17.0.1.16
  • sysadmin ==> 17.0.1.57
  • fwconsole restart

FreePBX 17.0.15.14

but still same the issue on the interfaces screen.

freepbx2
freepbx1

@kguptasangoma kguptasangoma reopened this Apr 19, 2024
@kguptasangoma
Copy link
Member

thanks a lot @Andsup for the quick response, will check this early next week.

@prashobkarimbil
Copy link

HI @Andsup

Can you share the structure of /etc/network/interfaces.d/ directory? Also, if there is a file named ens3 within this directory, please share it's content.

@Andsup
Copy link
Author

Andsup commented Apr 22, 2024 via email •
edited

@kguptasangoma
Copy link
Member

kguptasangoma commented Apr 22, 2024 •
edited

Hi @Andsup How did you configured your network interfaces? Is it via systemd network utility?

We are using /etc/network/interfaces.d/ but looks like you might be using systemd due to which interfaces are not working properly.

could you please quickly try to disable systemd network and let us know the behavior -
systemctl stop systemd-networkd systemctl disable systemd-networkd systemctl stop systemd-networkd.socket systemctl disable systemd-networkd.socket

Ref - https://forums.debian.net/viewtopic.php?t=155463

@Andsup
Copy link
Author

Andsup commented Apr 22, 2024 •
edited

This is a VPS with the standard Debian 12 image from the provider (OVH).

So no physical access, only via the network : quite risky to modify the IP setup...

Currently I activated firewalld, doing correctly the job, except that sometimes your code disable it.
Avoiding that service stop, could be a workaround.

Moving away from a full home distro, is quite challenging.
Thanks for your effort on it.

@kguptasangoma
Copy link
Member

thanks @Andsup I can understand playing with network settings might not be good for you.
Can you please confirm if you are using systemd.networkd to configure your networks and config files are present in as explained in https://wiki.archlinux.org/title/systemd-networkd#Configuration_files path ?

@Andsup
Copy link
Author

Andsup commented Apr 22, 2024 via email •
edited

@kguptasangoma
Copy link
Member

Thanks @Andsup for the prompt reply so this explains why you are seeing different behavior.

currently Freepbx is depending on /etc/network/interfaces.d/ , so we need to see how we can optimize to use either networkd or stop networkd and force users to use "/etc/network/interfaces.d/".

@nobe80
Copy link

nobe80 commented Apr 22, 2024

@kguptasangoma dont know if that helps. We also use a debian 12 vm from a provider. systemd is also inactive:

root@bitpbx:~# systemctl status systemd-networkd.service
○ systemd-networkd.service - Network Configuration
Loaded: loaded (/lib/systemd/system/systemd-networkd.service; disabled; preset: enabled)
Active: inactive (dead)
TriggeredBy: ○ systemd-networkd.socket
Docs: man:systemd-networkd.service(8)
man:org.freedesktop.network1(5)

@kguptasangoma
Copy link
Member

hi @nobe80 Are you also facing the same issue?

@nobe80
Copy link

nobe80 commented Apr 22, 2024

hi @kguptasangoma

yes we faced also with the same issue but we dont want to use the freepbx firewall. For us it is enough to rely on fail2ban.
To use the firewall is in our case unsuitable because the client ip change every day. Freepbx runs remotely.

@dolesec
Copy link

dolesec commented Apr 22, 2024

@nobe80 wrt to that IP changing everyday you could always add the fqdn as name in the networks and it will resolve to whatever the active IP address is on that day and allow access... combined with responsive firewall features and fail2ban sync it may get you where you want to be

@nobe80
Copy link

nobe80 commented Apr 22, 2024 •
edited

@dolesec no that is to complicate because you have to set a DNS too for every customer. We dont need the firewall, fail2ban is enough for us. With fail2ban and good passwords bruteforce attacks becomes useless.

@dolesec
Copy link

dolesec commented Apr 22, 2024

understood , just wanted to be sure you knew that was available... many firewalls such as Meraki assign a DDNS address to the active wan interface for the firewall - I use this name in my network definitions as a trusted network... its worked well thus far

@nobe80
Copy link

nobe80 commented Apr 22, 2024 •
edited

thanks @dolesec :)
We mostly have freepbx remotly in our datacenter and the customers all at another location. All phones connect via https and with fail2ban + good passwords it is more than enough.
Unfortunately we cannot create Lets encrypt certificate at current.

@chopsywa
Copy link

I loaded up the beta on a fresh Debian 12 today (Azure canned instance) and I have the same issue. There is no /etc/network/interfaces.d directory.

The system is running systemd-networkd

I masked and disabled systemd-networkd and systemd-networkd.socket services and created an interfaces file in /etc/network.
The server now boots on its config files. That is several hours of my life I will never get back, but hopefully it is useful feedback. I think it is safe to say that on Debian 12 stock installs, the firewall is not going to work properly in its current format.

@BrandonAtACOM
Copy link

Same issue here. Installed FreePBX17 via install script on Debian 12 using DigitalOcean. I moved the config for the internet facing interface/subinterface to a config file in interface.d to resolve:

  1. Copied eth0 (and eth0:1) config lines from /etc/network/interfaces, then commented them
  2. Created /etc/network/interfaces.d/eth0 and pasted those config lines
  3. Rebooted

@RadicalLinux
Copy link

This issue also exists on AWS Debian 12 AMI. We are unable to modify the network settings also, due to it being in the cloud.

● systemd-networkd.service - Network Configuration
Loaded: loaded (/lib/systemd/system/systemd-networkd.service; enabled; pre>
Active: active (running) since Tue 2024-04-30 20:51:32 CDT; 40min ago
TriggeredBy: ● systemd-networkd.socket
Docs: man:systemd-networkd.service(8)
man:org.freedesktop.network1(5)
Main PID: 418 (systemd-network)
Status: "Processing requests..."
Tasks: 1 (limit: 4687)
Memory: 3.1M
CPU: 47ms
CGroup: /system.slice/systemd-networkd.service
└─418 /lib/systemd/systemd-networkd

@kguptasangoma kguptasangoma mentioned this issue May 3, 2024
Open
@kguptasangoma
Copy link
Member

Please refer to #127 where if the system is NOT using "networkd" then Freepbx can be used to configure the networks otherwise let user to manage the network configurations via networkd utility.

Thanks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@prashobkarimbil prashobkarimbil

Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
8 participants
@RadicalLinux @dolesec @Andsup @nobe80 @chopsywa @kguptasangoma @prashobkarimbil @BrandonAtACOM