TL;DR On new CentOS server installs should I be using firewalld or just disable that and go back to using /etc/sysconfig/iptables
?
firewalld and iptables serve similar purposes. Both do packet filtering - but if I understand it correctly firewalld does not flush the entire rule set each time a change is made.
I know a lot about iptables but very little about firewalld.
On Fedora and RHEL/CentOS - the traditional iptables configuration was done in /etc/sysconfig/iptables
. With firewalld, it's configuration lives in /etc/firewalld/
and is a set of XML files. Fedora seems to be moving toward firewalld as a replacement for this legacy configuration. I do understand that firewalld uses iptables under the hood, but it also has it's own command line interface and configuration file format as above - which is what I'm referring to in terms of using one vs the other.
Is there a particular configuration/scenario that each of these is best suited for? In the case of NetworkMangaer vs network, it appears that although NetworkManager may have been intended as a replacement for the network scripts, due to it's lack of network bridge support and a few other things, many people are just not using it on server setups at all. So there seems to be a general concept of "use NetworkManager if you are on a Linux desktop/gui
, and network if you are running a server". That's just what I pick up from reading various posts - but it at least gives a guide as to what is a workable use for those things - at least as they stand in their current state.
But I've been doing this same thing with firewalld and just turning it off and using iptables instead. (I am almost always installing linux on a server, not for desktop use). Is firewalld an effective replacement for iptables and should I just be using that on all new systems?
iptables
. It's just a front end tool, if it's flushing the tables that's because you told it to.