iptables and firewalld

CoyoteKG · 09-23-2016, 07:50 AM

Hello,
I know there is bunch of themes about comparing iptables and firewalld, but this time I just have one question.

I'm following some guide for installing spamassasion plugin, and there is

Quote:

Add these rules to /etc/sysconfig/iptables in the INPUT chain and reload iptables:

### razor DCC pyzor ###
-A INPUT -p tcp --dport 2703 -j ACCEPT
-A INPUT -p udp --dport 24441 -j ACCEPT
-A INPUT -p udp -m udp --dport 1024:65535 --sport 6277 -j ACCEPT
###End of razor DCC pyzor ###

But I have installed Firewalld in Centos 7.

How to add those rules to firewalld?

First two I will add with

Code:

firewall-cmd --permanent --add-port=2703/tcp
firewall-cmd --permanent --add-port=24441/udp

But third I don't know how to "translate" it to firewalld command.

If I understand correctly

-A = append
INPUT is chain
-p is protocol
--dport is destination port
--sport is source port

And this rule is

Allow everyone who is coming from port 6277 to access to every port at range 1024:65535?

sag47 · 10-02-2016, 11:37 PM

It took me a while to find. I couldn't cobble together a service or rich rule but you can make use of direct rules in firewalld. See man firewall-cmd.

For example,

Code:

firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -p udp -m udp --dport 1024:65535 --sport 6277 -j ACCEPT
firewall-cmd --reload
firewall-cmd --permanent --direct --get-all-rules

You can also verify the rule did the right thing by viewing the current firewall state with iptables-save.

CoyoteKG · 10-07-2016, 12:43 PM

Hello and thanks,

good to know, but before few days, I migrated all rules from Firewalld to iptables

So for now I will continue to use iptables.

Thank you!

sag47 · 10-07-2016, 10:03 PM

Quote:

Originally Posted by CoyoteKG

Hello and thanks,

good to know, but before few days, I migrated all rules from Firewalld to iptables

So for now I will continue to use iptables.

Thank you!

I can't judge. I took some concepts from firewalld for iptables as well

. https://github.com/samrocketman/home...iptables.rules and https://github.com/samrocketman/home...iptables.rules