----- Original Message ----- | >> I don't really understand the intent behind firewalld. The RHEL7 Security | >> Guide states "A graphical configuration tool, *firewall-config*, is used | to | >> configure firewalld, which in turn uses *iptables tool* to communicate | with | >> *Netfilter* in the kernel which implements packet filtering". | | >Well, the order from Kernel inside outward is: | > | >1. Netfilter (inside Kernel), not directly accessible by userland | >2. iptables/iptables6, the userland cli tools to manipulate the Netfilter | > .... | >3. firewalld(RedHat/CentOS), or SuSEfirewall(Suse), or similar are the | > .... | >4. GUI tools, that allow to manipulate the config of firewalld (or | similar), | .... | >Does that answer your question about *value added* by GUI tools? | >Not every user that needs to change firewall settings is a certified UNIX | admin. | | I don't dispute the value of GUIs. I have a comment and a question, first | that in "the data center" my experience is that iptables rules are put into | place and only rarely changed thereafter, like the network configuration at | the server. | | But my question was partly this: What is the specific need for a | continuously running daemon firewalld if what we wanted was a GUI front-end | for iptables? | Thanks....Nick Geo firewalld is more than just a GUI configuration system. It is a far more capable system than static firewall rules and can be used to simplify ruleset creation. With support for DBUS for example only when applications are running are the rules made available. For servers it can be used to help compartmentalize your current rules and the use of zones to apply different rulesets to different interfaces is quite nice. I think the idea that rulesets are put into place and rarely change is becoming less and less true in cloud like environments. A well built firewalld system can deal with these types of environments a bit better IMHO. -- James A. Peltier IT Services - Research Computing Group Simon Fraser University - Burnaby Campus Phone : 604-365-6432 Fax : 778-782-3045 E-Mail : jpeltier at sfu.ca Website : http://www.sfu.ca/itservices Twitter : @sfu_rcg Powering Engagement Through Technology