9 thoughts on - Firewalld And Iptables

• What’s the rest of the command?

  That’s probably from package iptables-services, which isn’t installed by default on purpose. It’s the legacy service from before firewalld was made the default. Use one or the other, not both.

  I strongly recommend that you use firewalld instead of the old iptables service. While firewalld is based on the kernel’s iptables facility, it gives many additional capabilities that you don’t get with raw iptables commands. The old service was little more than a macro system for raw iptables commands.

  Contrast firewalld, which:

  1. Integrates with systemd.

  2. Understands “services” as opposed to just raw port numbers and such. This is especially valuable with complex services like NFS. With iptables…well, you forgot to allow rpc.portmap again, didn’t you? :)

  3. Updates the firewall in real time, live. You can do this by hand with raw iptables commands, but the syntax for inserting new rules at the right place in the tables is awkward. Firewalld automates all of that for you.

  4. Add –permanent to a new rule to save it securely to the rule set loaded on startup. Contrast iptables, where you’re often running across blog articles and such that talk about saving such rules separately to /etc/rc.local and such, or editing /etc/sysconfig/iptables directly.

  5. If you prefer the “update global config and reload” pattern of the old system-config-firewall scheme from CentOS 6, you can do that with firewalld, too:

  alias fcp=”sudo firewall-cmd –permanent”
  fcp –add-service foo
  fcp –add-port somename/tcp
  …more fcp commands here…
  sudo firewall-cmd –reload

• These commands are top-of-mind for me at the moment because I just configured a Raspberry Pi based network appliance at home, and installed firewalld on it for the purpose because I like it so much better than raw iptables commands.

  The default OS for the Raspberry Pi is derived from Debian, which has firewalld in its package repository but doesn’t use it by default. I found it well worth going out of my way to get firewalld on that Pi.

  Good stuff!

• Well, there are about 20 of them and several screen widths long. However they all end with one of two reasons:

  : No chain/target/match by that name.
  : Bad rule (does a matching rule exist in that chain?).

  After the update I got email from “ckservices” that firewalld was down. I saw the above mentioned iptable errors and checked the iptables.service to find it masked. I shutdown firewalld, unmasked, enabled, and started iptables.service and then firewalld. Same errors. So I shutdown iptables service, masked it, and restarted firewalld.

  Never planned to do otherwise. Just was uncertain if iptables.service had to run also.

  Thanks, Jon
  —
  Jon H. LaBadie jon@jgcomp.com
  11226 South Shore Rd. (703) 787-0688 (H)
  Reston, VA 20190 (703) 935-6720 (C)

• That makes sense: the old iptables service installed several default chains, and firewalld does as well, but they’re not named the same, and I doubt there’s a 1:1 mapping between them.

  That’s part of why I advised you to use one or the other, not both. Another reason is that their persistent rule stores use entirely different file formats, in different locations.

• –Put them on a pastebin so we can see them at full width. The chain names should tell us what’s responsible for them.

  Note that the iptables utilities and the iptables service are distinct. I
  install the utilities so that I can inspect the kernel chains that filterd creates. But I don’t install the iptables service.

• If you don’t include the errors, all we can do is guess.  The name of the chain that doesn’t exist is probably key to explaining the error.

  Docker is one possible reason for such errors:

  https://support.plesk.com/hc/en-us/articles/360007029113-Docker-startup-on-firewalld-Warning-COMMAND-FAILED-No-chain-target-match-by-that-name

• https://pastebin.com/njaqR87f

  I don’t play with iptables, so I assume it is a legacy continued from CentOS 6.x. I’ll gladly remove the iptables service package.

  Jon

• –The rule names all look like standard builtins. Are the iptables modules loading into the kernel? Run lsmod and post that to pastebin. (I don’t know what loads the firewall modules in CentOS 7.)

• –firewalld is a user-space layer on top of the kernel’s iptables machinery. It provides for dynamic changes to the underlying iptables firewall. The old firewall configuration (iptables.service, previously implemented as an initscript in older CentOS versions) assumed a static firewall that was loaded once at boot time. Changes required flushing the entire set of rules and starting again, but that would disrupt running network applications. Firewalld is a higher level description that is able to and and remove rules on a running machine without disrupting applications. It still uses the iptables machinery under the hood. It’s good for dynamic systems like mobile devices where interfaces come and go and the device changes networks frequently.