Home / server / Questions / 756140
In Process
Nicolas Guérinet
Asked: 2016-02-15 09:16:51 +0800 CST

Can't firewalld replace iptables?

  • 772

I used Iptables on Centos 6.5 and tried to translate iptables rules into firewalld rules on centos 7. However, with firewalld, i have discovered i am unable to

  • drop packets in invalid states
  • create a set of rules to protect from portscan
  • create a rule against SYN attacks (meaning looking for packets with syn flags)
  • Use hash limit to limit number of connections per second per IP

Am i right to think that firewalld has way less possible features as compared to Iptables?

iptables

1 Answers

  1. FirewallD, mostly used by Red Hat variants, is a front end to iptables. FirewallD and Ubuntu's UFW are user friendly tools that interact with iptables in the background, which in turn interact with netfilter. FirewallD cannot provide all the whistles and bells that iptables does. Adding on to your statement, firewalld cannot filter outgoing traffic, but iptatbles can (by default).

    • 0