Iptables – How to load iptables rules to firewalld

firewalldiptables

I've got centos 6 running server. It uses iptables. I want to migrate to centos 7. Centos 7 uses firewalld.
My aim is to download iptables configuration(rules) and apply to firewalld.
I can download iptables rules like this:

iptables-save

I don't know how to apply iptables-save's output to firewalld. I hope there is automated way.
Question: How can I apply current iptables rules to firewalld? I don't like to configure manually because there might be many server with big iptables rules/configs.

Best Answer

A good place to start is the RHEL 6 --> 7 migration planning guide but in short:

If you configured your RHEL/CentOS 6 firewall with system-config-firewall, you can use the firewall-offline-cmd tool to migrate the configuration from /etc/sysconfig/system-config-firewall into the default zone of firewalld.
If you used any other method to configure your current firewall there is, as far as I know, no practical migration to firewalld and your options are:
- either create a new configuration with firewall-cmd or firewall-config
- disable firewalld and continue to use the old iptables and ip6tables services. That allows you to keep the existing firewall rules. Copy the iptables-save export and load it with iptables-restore. See https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/sec-using_iptables

Related Solutions

Linux – Alternative to Firewalld on memory critical servers

Yes, you can use the old system. It's not less secure than firewalld (provided you write your firewall rules correctly). It also doesn't run a daemon, so it's not using a (relatively) large amount of your limited RAM.

Iptables – How to create advanced rules with firewall-cmd

You don't need to add or even have custom direct chains (though you can if you want to get really complicated. Just add to your existing chains directly.

After IP version, table, chain and priority, you simply specify the relevant iptables options:

firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 \
        -m owner --uid-owner $UID -j ACCEPT

Underneath, at iptables, this will actually be added to a firewalld-managed chain named OUTPUT_direct, which is called from the OUTPUT chain.

Best Answer

Related Solutions

Linux – Alternative to Firewalld on memory critical servers

Iptables – How to create advanced rules with firewall-cmd

Related Topic