Firewalld fails to load IP sets with overlapping entries about firewalld HOT 2 OPEN

Overlapping entries is a minor issue that deserves a warning at most.

It's not that simple. firewalld supports multiple backends each with their own nuances and bugs around coalescing and breaking CIDR/range entries. Adding overlapping sets is usually okay. It becomes complicated when you start removing entries.

e.g.
add 10.10.10.0/24
add 10.10.0.0/16
add 10.0.0.0/8

then
remove 10.10.0.0/16

On the backend "10.10.10.0/24" would also be implicitly removed. That means firewalld has to also detect and handle this. But then "the config disappeared".

Maybe the user meant to "remove" everything in 10.10.0.0/16, EXCEPT those in 10.10.10.0/24. This is harder, firewalld would have to figure it out and only send the real removes to the backends. That gets complicated for multi dimensional sets.

In short, it's much less complicated to disallow overlapping sets.

It may be that the backends have better support for breaking and coalescing entries and this can be revisited. It's important to note that disallowing overlapping entries was done in response to bugs and reports.

from firewalld.

Thanks for the answer, I hope this can be implemented someday, otherwise it requires to find and eliminate possible overlapping entries from the list before trying to load it with Firewalld, which is not so trivial specifically when working with large IP sets utilizing GeoIP data.

from firewalld.