My firewalld configuration has ipsets. I have switched to nftables backend by setting FirewallBackend=nftables in /etc/firewalld/firewalld.conf and restarting firewalld.
nft command shows empty sets (no elements) while ipsets still exist (an example is below).
Is firewalld with nftables can be used at all if it has ipsets? Is nftables compatible with ipsets? Does nftables read IP list from ipsets?
Searching on the Internet suggests using nftables sets but it seems that firewalld does not support them.
---------------------------------------------------
# nft list sets
table inet firewalld {
set gluster_v4 { <---- nftables set exists but empty
type ipv4_addr
flags interval
}
}
# ipset list
Name: gluster_v4
Type: hash:ip
Revision: 4
Header: family inet hashsize 1024 maxelem 65536
Size in memory: 328
References: 0
Number of entries: 5
Members: <---- IP list is part of the ipset
172.16.x.a
172.16.x.b
....
I am using Fedora 29 and firewalld-0.6.3-1.fc29.noarch.
