I have for a school project a simple architecture composed of 3 virtual machines which all run Fedora 24: one server, one client, and one router. I decided to use iptables over firewalld for the extensive use of DNAT/SNAT that I only knew how to manage well with iptables; therefore, I disabled firewalld, and enable iptables:
# dnf install iptables-services # systemctl stop firewalld # systemctl disable firewalld # systemctl start iptables && systemctl start ip6tables # systemctl enable iptables && systemctl enable ip6tables
I had a set of rules I saved through
# service iptables save and it worked perfectly on my router.
I used the same method on my two other machines, server, and client, but the rules were not saved. After a bit of research, I realized that iptables.service does not start on boot; and I further noticed that firewalld did even though it was disabled as presented above.
Is there a particular reason why firewalld would start even though it is disabled? Here's what the status shows right after boot:
firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset : enabled) Active: active (running) since Sun 2017-01-22 23:52:34 PST; 15s ago Docs: man:firewalld(1) Main PID: 619 (firewalld) Tasks: 2 (list:512) CGroup: /system.slice/firewalld.service └─619 /usr/bin/python3 -Es /usr/sbin/firewalld --nofork --nopid Jan 22 23:52:33 public systemd: Starting firewalld - dynamic firewall daemon Jan 22 23:52:34 public systemd: Started firewalld - dynamic firewall daemon.
On the other hand, here is iptables's:
iptables.service - IPv4 firewall with iptables Loaded: loaded (/usr/lib/systemd/systemd/system/iptables.service; enabled; vendor preset: disabled) Active: inactive (dead)