Environment:
test_vm (192.168.0.123)
astaro (192.168.0.1)
Goal: Block incoming traffic from a specific internet IP. For this example, I'm using HTTP traffic to keep it simple, but it could be anything)
If I setup a rule as follows:
source - test_vm
services - http (src_port 1:65535; dest_port: 80)
destination - internet
action - reject
Web browsing is blocked and I can see the page requests being blocked in the firewall log (this is expected).
If I reverse the rule (to block the responses, not the requests)
source - internet
services - http response (src_port 80; dest_port: 1:65535)
destination - test_vm
action - reject
Web browsing is fully functional and the firewall doesn't stop the traffic. This same behavior occurs with other traffic such as DNS reponses as well. Can someone explain to me why this is? As far as I can tell, that rule should block all traffic originating from port 80 to my test_vm.
This thread was automatically locked due to age.
