[CentOS] CentOS 7 - Firewall always allows outgoing packets?

Jonathan Billings billings at negate.org
Mon Aug 11 18:36:51 UTC 2014


On Aug 11, 2014, at 1:16 PM, Always Learning <centos at u62.u22.net> wrote:
> Stating one's dread of having imposed as a standard, a firewall that can
> not control outgoing packets and has dumbed-down Micro$oft-like 'zones'
> and the possible future removal of IP Tables from the very much admired
> Centos version of RHEL, is probably a desperate call for sanity to
> prevail at Red Hat.

'FirewallD' doesn't replace 'iptables' except in the sense of activated system services, not the core firewall functionality.  FirewallD just builds and modifies iptables rules.  If anything, FirewallD might make it easier to migrate to nftables (a potential replacement for iptables) when that becomes mature[1].  But that's nowhere on the radar right now.

If you don't like FirewallD, don't use it.  It's just a tool to make managing your firewall easier, and allowing the OS and user to dynamically load rules depending on certain logic.  It replaces the monolithic /etc/sysconfig/iptables file and the 'iptables' systemd unit.  No one is talking about removing the core netfilter technology behind 'iptables'.

Just reading this thread makes me wonder if people criticizing FirewallD actually even tried it or even read the documentation!


1.) http://netfilter.org/projects/nftables/

--
Jonathan Billings <billings at negate.org>


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 235 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://lists.centos.org/pipermail/centos/attachments/20140811/1f55ab98/attachment.sig>


More information about the CentOS mailing list