This is a copy of my /etc/sysconfig/iptables.conf (w/o comments):
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

- Added the port 80/21 entries.
vsftpd does work.

"iptables-save | grep 80" returns nothing.

My web server works (internal and external).

"systemctl is-active iptables" shows "inactive"
I have "just" gotten firewalld up and running thanks to questions answered here.

iptables is truly a mystery to me.

Can someone explain why my web server/vsftpd are up and working w/o iptables being active? How can I get my network and security both up and working safely together?

If I enable/activate iptables, is this going to break my web server?

Is this the appropriate forum for this question?

As always, thank you for your time and patience,

Skip

List the rules with:

Iptables is a firewall program. Things would run even if iptables rules have not loaded. Unless you are doing NAT, etc.

1 members found this post helpful.

As veerain said "Things would run even if iptables rules have not loaded. Unless you are doing NAT, etc.". As long as you are not blocking external traffic at router or via iptables for internal things will work fine.

What you said is that iptables isn't running that means any traffic is allowed to your system whether it is web or ftp or ssh or samba doesn't matter system will reply to all (provided that the service is running). Basically security is not there as your system is open to reply on all ports.

You have already configured rules for web and ftp in your iptables config so that turning iptables shouldn't be an issue. From the output you shared I can see those web and ftp lines are above explicit deny so things should work even with iptables on.

1 members found this post helpful.

Appreciate the responses.

This confuses me. Is iptables supposed to run instead of firewalld or in conjunction with?

I google things that seem to imply that iptables is a replacement for firewalld?

"firewall-cmd --state" shows "running".

firewall-config does not show ftp, http(s) "trusted". But yet I can do both.

I need to learn something about computers.

Skip

This link will clarify your doubts: https://access.redhat.com/documentat...Firewalls.html

1 members found this post helpful.

Thanks for the reading suggestion. I'll close the thread.

Skip

You're welcome and thanks for marking the thread solved!

Enjoy Linux!!!