1

Ok, this is a brand new install of CentOs 7 (minimal).

This is the iptables -L

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD_IN_ZONES (0 references)
target     prot opt source               destination         

Chain FORWARD_IN_ZONES_SOURCE (0 references)
target     prot opt source               destination         

Chain FORWARD_OUT_ZONES (0 references)
target     prot opt source               destination         

Chain FORWARD_OUT_ZONES_SOURCE (0 references)
target     prot opt source               destination         

Chain FORWARD_direct (0 references)
target     prot opt source               destination         

Chain FWDI_public (0 references)
target     prot opt source               destination         

Chain FWDI_public_allow (0 references)
target     prot opt source               destination         

Chain FWDI_public_deny (0 references)
target     prot opt source               destination         

Chain FWDI_public_log (0 references)
target     prot opt source               destination         

Chain FWDO_public (0 references)
target     prot opt source               destination         

Chain FWDO_public_allow (0 references)
target     prot opt source               destination         

Chain FWDO_public_deny (0 references)
target     prot opt source               destination         

Chain FWDO_public_log (0 references)
target     prot opt source               destination         

Chain INPUT_ZONES (0 references)
target     prot opt source               destination         

Chain INPUT_ZONES_SOURCE (0 references)
target     prot opt source               destination         

Chain INPUT_direct (0 references)
target     prot opt source               destination         

Chain IN_public (0 references)
target     prot opt source               destination         

Chain IN_public_allow (0 references)
target     prot opt source               destination         

Chain IN_public_deny (0 references)
target     prot opt source               destination         

Chain IN_public_log (0 references)
target     prot opt source               destination         

Chain OUTPUT_direct (0 references)
target     prot opt source               destination  

I was under the impression that there should only be an INPUT, FORWARD, and OUTPUT chain (at least that's what I have on my CentOs 6 box).

How can I remove everything else?

6

There is small number of default chains that are part of the netfilter core: INPUT, FORWARD and OUTPUT but you or typically your tooling is free to create additional chains to bring structure your firewall configuration.

What you see is new, not wrong and the result of the firewall configuration tool firewalld (other tools such as Shorewall are also likely to create any number of additional chains).

Removing those additional chains without understanding what created them might be futile or could break things now or in the future. With RHEL/CentOS 7 you're supposed to manage your firewall with firewall-cmd and no longer by manually editing /etc/sysconfig/iptables.

You're discouraged but can still revert to the Enterprise Linux 6 and older style of managing your firewall configuration and use the iptables and ip6tables services instead of firewalld.

First disable firewalld by running the following command as root:

systemctl disable firewalld
systemctl stop firewalld

Then install the iptables-services package by entering the following command as root:

yum install iptables-services

But to answer your immediate question: Managing chains is well documented:

Creating a new chain: Use the -N or --new-chain options:

iptables -N test

Deleting a chain: Deleting a chain is simple as well, using the -X or --delete-chain options. Why -X? Well, all the good letters were taken.

iptables -X test

There are a couple of restrictions to deleting chains: they must be empty (see Flushing a Chain below) and they must not be the target of any rule. You can't delete any of the three built-in chains.

Flushing a chain: There is a simple way of emptying all rules out of a chain, using the -F (or --flush) commands.

iptables -F test
1
  • Yes, this is firewalld, the default in EL7. Feb 3 '15 at 15:33
1

You have here already chains INPUT/OUTPUT/FORWARD :-)

Rest - is used by default in RHEL7/CentOS7 firewalld.

You have generally two possibilities:

  1. you can disable/mask firewalld, and create iptables rules manually, like in other distributions/older RHEL versions
  2. you can befriend with firewalld and instead of using iptables rules - use firewalld. For control firewall - you have firewall-cmd command. List of current rules you have when you invoke

    firewall-cmd --list-all-zones

More info - you have on webpage http://fedoraproject.org/wiki/FirewallD

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.