centos 7 and firewalld

tonj · 08-26-2016, 03:29 AM

I've been using centos 6 and iptables for ages but this new firewalld thing in centos 7 has got me completely flummoxed. I've been trawling google but can't find a converter, I need to ask if someone here can convert the following iptables rules to firewalld.

Quote:

iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -i <interface> -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p udp -m udp --dport <port> -j ACCEPT
iptables -A OUTPUT -s xx.xx.xx.xx -j DROP
iptables --table nat --append POSTROUTING --out-interface <interface> -j MASQUERADE
iptables --append FORWARD --in-interface <interface> -j ACCEPT
iptables -A INPUT -i <interface> -j ACCEPT
iptables -A OUTPUT -o <interface> -j ACCEPT
iptables -t nat -A PREROUTING -i enp0s25 -p tcp --dport 80 -j DNAT --to xx.xx.xx.xx:<port>
iptables -t nat -A PREROUTING -i enp4s0 -p tcp --dport 80 -j REDIRECT --to-port <port>
iptables -A INPUT -j LOG
iptables -A INPUT -j DROP

these rules are from a script I used on my centos 6 machine. In time I will have to get to grips with firewalld but for now I need to get a centos 7 machine running without first doings weeks of study. I know I could use iptables on centos 7 but that defeats the object of upgrading. Thanks for any help.

TenTenths · 08-26-2016, 07:39 AM

When I moved from CentOS 6 to 7 I just installed iptables and the iptables-services from repo, disable firewalld and enable iptables.

Personally I've not found any advantages of firewalld over iptables, certainly in a server situation.

jpollard · 08-26-2016, 07:51 AM

There are no advantages in firwalld. Both iptables and firwalld use the kernel iptables.

Firewalld is a thing added to "make things easier"... but it is really only useful to hide the details of what is actually happening. firewalld provides an interface to the GUI... Things that are preprogrammed for the GUI are easy (but you don't learn what it is doing), and makes it more difficult to use for anything else.

Maybe handy for a new user only familiar with GUI operations.

lazydog · 08-26-2016, 07:55 AM

I agree with TenTenths. I did the same thing. You can follow this TUTORIAL

tonj · 08-26-2016, 11:02 AM

thanks for the responses here, I had a feeling I'd have to use iptables but wanted to hang on until the last minute - which is now.

John VV · 08-26-2016, 10:50 PM

how about reading the manual
https://access.redhat.com/documentat...h_systemd.html

cent is using the redhat docs ( why post the same thing twice )