<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Thank you both for your very informative replies. I just wish there was a clear outline of these issues somewhere to make it easier to understand what differentiates firewalld from iptables....<br><br>In my case, since I control the firewalls on my computers and servers directly, without interference from other applications, there is not currently a compelling reason I can see to make the switch from iptables to firewalld. I'd make the switch for the sake of "future-proofing", but for firewalld's inability to control outbound connections.<br><br><br><div>> Subject: Re: what are the advantages of firewalld over iptables?<br>> To: firewalld-users@lists.fedorahosted.org<br>> From: laine@redhat.com<br>> Date: Fri, 21 Aug 2015 14:57:26 -0700<br>> <br>> On 08/21/2015 11:50 AM, Patrick Hinkley wrote:<br>> > I believe I've found an explanation regarding the VM issue you mention:<br>> > http://www.atrixnet.com/red-hat-libvirt-kvm-iptables-what-to-do-when-your-kvm-network-stops-working/<br>> > <br>> > If I understand correctly, the issue is that temporary rules inserted<br>> > into iptables by other applications are lost when any of the following<br>> > are called:<br>> <br>> It's more than that. new rules inserted with iptables -I will override<br>> the rules aded by libvirt, often causing trafic to miss libvirt's rules.<br>> <br>> > service iptables stop; service iptables start;<br>> > service iptables restart;<br>> > iptables-restore < /etc/sysconfig/iptables;<br>> > <br>> > This issue would not apply when inserting your own temporary rules by<br>> > such as:<br>> > iptables -A<br>> > <br>> > The issue would also not apply when making your temporary rules<br>> > permanent via:<br>> > service iptables save<br>> <br>> "service iptables save" has its own problems. For starters, it will save<br>> *everything* that is currently in the in-memory rules, not just "what<br>> was previously saved + the rules you want saved". This could mean that<br>> some of the previous rules would be removed from the configuration (it<br>> something had for some reason temporarily removed them) or it could mean<br>> some extra rules that were intended to only be there temporarily would<br>> be permanently added (for example, if a libvirt virtual network is taken<br>> down, libvirt removes the iptables rules that it had previously added,<br>> but if you have saved those rules as you suggest above, then the next<br>> time your iptables service i restarted, all of those rules would be<br>> re-added, even though they are no longer applicable.<br>> <br>> What it all comes down to is that without firewalld, there is no central<br>> controlling authority, so everybody steps all over everybody else. If<br>> all applications that need to modify the iptables rules go through<br>> firewalld, it is in a good position to assure that the various<br>> applications don't interfere with each others' rules.<br>> <br>> (BTW, libvirt looks for the firewalld service, and always uses it if it<br>> is active).<br>> <br>> _______________________________________________<br>> firewalld-users mailing list<br>> firewalld-users@lists.fedorahosted.org<br>> https://lists.fedorahosted.org/mailman/listinfo/firewalld-users<br></div>                                            </div></body>
</html>