what are the advantages of firewalld over iptables?

Patrick Hinkley patrickrhinkley at outlook.com
Fri Aug 21 18:50:33 UTC 2015


I believe I've found an explanation regarding the VM issue you mention:
http://www.atrixnet.com/red-hat-libvirt-kvm-iptables-what-to-do-when-your-kvm-network-stops-working/

If I understand correctly, the issue is that temporary rules inserted into iptables by other applications are lost when any of the following are called:
service iptables stop; service iptables start;
service iptables restart;
iptables-restore < /etc/sysconfig/iptables;

This issue would not apply when inserting your own temporary rules by such as:
iptables -A

The issue would also not apply when making your temporary rules permanent via:
service iptables save

Is my understanding correct?


From: patrickrhinkley at outlook.com
To: firewalld-users at lists.fedorahosted.org
Subject: RE: what are the advantages of firewalld over iptables?
Date: Thu, 20 Aug 2015 22:19:12 -0400




> Date: Wed, 19 Aug 2015 19:07:11 -0400
> From: mattdm at fedoraproject.org
> To: firewalld-users at lists.fedorahosted.org
> Subject: Re: what are the advantages of firewalld over iptables?
> 
> On Wed, Aug 19, 2015 at 11:54:54AM -0400, Patrick Hinkley wrote:
> > this is probably a silly question, but I haven't been able to find a
> > very good comparison outlining the advantages of firewalld over
> > iptables -- what are they?
> 
> There are two big ones:
> 
> - higher-level API programs can use
> - keeping track of state
> 
> The classic example for the last one is that with firewalld, you can
> restart iptables without breaking all of your virtual machines.

Do I understand correctly that the state issue (failure to maintain established connections) is only relevant when restarting iptables (service iptables restart), not when e.g. adding/deleting a rule (iptables -A / iptables -D) or restoring (iptables-restore < /etc/sysconfig/iptables)?

> 
> -- 
> Matthew Miller
> <mattdm at fedoraproject.org>
> Fedora Project Leader
> _______________________________________________
> firewalld-users mailing list
> firewalld-users at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/firewalld-users
 		 	   		  

_______________________________________________
firewalld-users mailing list
firewalld-users at lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/firewalld-users 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/firewalld-users/attachments/20150821/6a7ba1bd/attachment.html>


More information about the firewalld-users mailing list