I'm aware there is a /etc/sysconfig/iptables file, with rules for iptables (and what's the effective difference with /etc/sysconfig/iptables-config?).
I installed CSF & LFD. You can configure ports within /etc/csf/csf.conf, but the /etc/sysconfig/iptables file is non-existent. The iptables and csf daemon are running.
What does this mean? That the firewall doesn't do anything?
In fact, how does CSF and iptables work together??
If memory serves, /etc/sysconfig/iptables-config is the file that describes what options are used when the rhel iptables init script is brought up. It does not have explicit rules in it. the /etc/sysconfig/iptables file on the other hand does have these rules in it. It is formatted per the output of the iptables-save command; in fact, when you run service iptables save that's exactly how it creates the file.
The short version to your other question is "whichever one is started last has priority".
For the purpose of clarity, I'm going to make a language abstraction in the context of this answer which is not "industry accepted" as follows:
Both the rhel-iptables and CSF scripts utilize the netfilter framework and commands to put firewall rules in kernel space. Both of them(*) reset the kernel rules tables to empty when started. Thus if CSF is started or restarted after rhel-iptables, its rules and configuration will take precedence. The reverse is true for rhel-iptables started or restarted after CSF; the CSF rules will be wiped clean and rhel-iptables rules take over.
As silly as that seems, this is probably OK, so long as you only work on the rule set you want running and you've verified that the one you want running (probably CSF, since you took the time to install it) runs last and you make sure you restart it if you accidentally restart the iptables service. You can check the order they are started by looking at ls -1 /etc/rc.d/rc3.d assuming your default runlevel is 3, which on rhel/centos without graphical, is usually the case (graphical is 5). If the number after the S is higher, it starts later.
Why would you want to run both? Well, if your /etc/sysconfig/iptables rules are functional, it's pretty much guaranteed to come up before any networked services, which means firewall protection begins before the network is up and any services are exposed. Rules listed in that file are very resilient to system changes that CSF might respond poorly to, for example, your script interpreter or kernel version gets updated marginally, breaking the script syntax or module names or, more likely, you try to update CSF from its home website and it breaks itself. If CSF fails before flushing your rules out, your rhel-iptables rules are still in place, protecting your potentially vulnerable services as a fallback ruleset.
If you wish to disable the rhel-iptables script, you can do so by running this command:
chkconfig iptables off
(*) flushing the kernel rules tables is the default for both scripts; I believe both can be configured to not do this and append only.
