Am 23.04.2012 17:32, schrieb Miloslav Trmač:
On Tue, Apr 17, 2012 at 10:40 PM, Reindl Harald
<h.reindl(a)thelounge.net> wrote:
>
http://fedoraproject.org/wiki/Features/firewalld-default
>
>> An explicit transition is planned after Fedora 18 with dropping support for the
>> static firewall with system-config-firewal/lokkit. A migration from the static
>> firewall model will be needed then.
>
> are there only the ui-interfaces meant or do someone
> consider drop "iptbales.service" at all? if so please
> re-consider this!
I was pushing for the deprecation to avoid a NetworkManager-like
duplication for the long term.
i really, really like the idea of "firewalld" for many setups!
it is a really nice improvement for desktops over the long
but please consider that network-manager and desktop is not
all and on servers with vpn-gateways, routings and such
things you do not really like it
please do not start seeing linux as desktop-only OS, it is not
cool that it works for desktops and servers and this should
be considered in big changes
AFAICS you can s/iptables/firewall-cmd --direct --passthrough ipv4/,
and things should continue to work (perhaps with minor modifications
to avoid collisions with firewalld's default rule chains).
i simply do not need want any default chains
the first in a iptables-script is reset them
the iptables.sh for the environment where i work is currently
50 KB large, distributed and for all machines in the network
the same
Or, if you insist, disable firewalld (... which might break some
applications), and turn your shell script into a systemd service; but
--direct --passthrough should be the preferred route.
how to replace such things?
cat /etc/sysconfig/iptables-config
IPTABLES_MODULES="ip_nat_sip ip_nat_ftp nf_conntrack_ftp nf_nat_ftp"
________________________________
cat /etc/sysconfig/iptables-config
IPTABLES_MODULES="nf_conntrack_ftp nf_nat_ftp"
cat /etc/modprobe.d/local.conf
options nf_conntrack_ftp ports=21,4559
options ipt_recent ip_list_tot=5000 ip_pkt_list_tot=200