{"action":"created","issue":{"url":"https://api.github.com/repos/t-woerner/firewalld/issues/35","labels_url":"https://api.github.com/repos/t-woerner/firewalld/issues/35/labels{/name}","comments_url":"https://api.github.com/repos/t-woerner/firewalld/issues/35/comments","events_url":"https://api.github.com/repos/t-woerner/firewalld/issues/35/events","html_url":"https://github.com/t-woerner/firewalld/issues/35","id":97752746,"number":35,"title":"Default rules conflict with DHCP","user":{"login":"eliasp","id":48491,"avatar_url":"https://avatars.githubusercontent.com/u/48491?v=3","gravatar_id":"","url":"https://api.github.com/users/eliasp","html_url":"https://github.com/eliasp","followers_url":"https://api.github.com/users/eliasp/followers","following_url":"https://api.github.com/users/eliasp/following{/other_user}","gists_url":"https://api.github.com/users/eliasp/gists{/gist_id}","starred_url":"https://api.github.com/users/eliasp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eliasp/subscriptions","organizations_url":"https://api.github.com/users/eliasp/orgs","repos_url":"https://api.github.com/users/eliasp/repos","events_url":"https://api.github.com/users/eliasp/events{/privacy}","received_events_url":"https://api.github.com/users/eliasp/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-07-28T16:54:36Z","updated_at":"2015-07-30T15:42:46Z","closed_at":null,"body":"It looks like the default rules conflict with `systemd-networkd`'s builtin DHCP server.\r\n\r\n*How to reproduce:*\r\n* Run a system with:\r\n  * firewalld (e.g. Fedora 22)\r\n  * systemd 219 (or newer)\r\n* Launch a new `systemd-nspawn` container with `veth` networking:\r\n  \r\n  `systemd-nspawn --network-veth -bxD /var/lib/machines/centos7.1-base` \r\n\r\n*What should happen:*\r\n* `systemd-nspawn` creates the network interface `ve-centos71-b`\r\n* `systemd-networkd` running on the host picks up the network interface and configures it according to the configuration below (including running a minimal DHCP server to hand out IP configurations to containers):\r\n\r\n  ```INI\r\n[Match]\r\nName=ve-*\r\nDriver=veth\r\n\r\n[Network]\r\n# Default to using a /28 prefix, giving up to 13 addresses per container.\r\nAddress=0.0.0.0/28\r\nLinkLocalAddressing=yes\r\nDHCPServer=yes\r\nIPMasquerade=yes\r\n``` \r\n* `systemd-networkd` running in the container configures the interface `host0` inside the container based on the configuration below:\r\n\r\n  ```INI\r\n[Match]\r\nVirtualization=container\r\nName=host0\r\n\r\n[Network]\r\nDHCP=yes\r\nLinkLocalAddressing=yes\r\n```\r\n\r\n*What happens instead:*\r\n* The `host0` interface in the container never receives a DHCP configuration from the DHCP server running on the host because the requests/responses are blocked by `firewalld` on the host\r\n\r\nStopping `firewalld` temporarily \"fixes\" the issue and shows that `firewalld` is the \"culprit\" in this case.\r\n\r\nAlthough I'm not quite sure yet, how the policy would have to look like exactly, I think this should be probably covered by `firewalld`'s default configuration."},"comment":{"url":"https://api.github.com/repos/t-woerner/firewalld/issues/comments/126374170","html_url":"https://github.com/t-woerner/firewalld/issues/35#issuecomment-126374170","issue_url":"https://api.github.com/repos/t-woerner/firewalld/issues/35","id":126374170,"user":{"login":"t-woerner","id":6049493,"avatar_url":"https://avatars.githubusercontent.com/u/6049493?v=3","gravatar_id":"","url":"https://api.github.com/users/t-woerner","html_url":"https://github.com/t-woerner","followers_url":"https://api.github.com/users/t-woerner/followers","following_url":"https://api.github.com/users/t-woerner/following{/other_user}","gists_url":"https://api.github.com/users/t-woerner/gists{/gist_id}","starred_url":"https://api.github.com/users/t-woerner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/t-woerner/subscriptions","organizations_url":"https://api.github.com/users/t-woerner/orgs","repos_url":"https://api.github.com/users/t-woerner/repos","events_url":"https://api.github.com/users/t-woerner/events{/privacy}","received_events_url":"https://api.github.com/users/t-woerner/received_events","type":"User","site_admin":false},"created_at":"2015-07-30T15:42:46Z","updated_at":"2015-07-30T15:42:46Z","body":"Only dhcpdv6-client is enabled by default in the firewall, as this is essential for mostly all clients using IPv6.\r\nYou can simply enable the dhcp service in your configuration to allow access to the dhcp server provided by systemd-networkd. If systemd-networkd is also providing a dhcpv6 server, then also enable dhcpv6."}}