I'm trying to set up a firewall on my own desktop (currently I'm tinkering with a Fedora 29 virtual machine). I would like to have it on the "deny-everything-by-default" basis. Almost immediately I decided to disable and mask the firewalld.service, since firewalld had no way to drop the outgoing packets, except by using the native iptables syntax. So I decided to resort to nftables, since it's the modern replacement for the former.

The problem is that after a system reboot iptables chains have some rules, which I didn't set (and I have no idea where they come from). On the other hand # nft list ruleset returns nothing. So I assume, that rules from iptables and nft will be enabled simultaneously and when I set up some nft rules, rules from iptables, which can appear from "nowhere", will be able to meddle.

I tried to remove iptables, but dnf refused to do so and warned that systemd depends on it.

So could anyone answer a couple of my questions here, please?

  • Do I understand the concepts here correctly (that iptables rules and chains are separate from nft ones, and that they both are in effect at the same time)?
  • How can I reliably use nft without iptables rules interference?
  • Or should I simply use iptables and remove nft?

I'm not sure this is the best way, but to stop iptables from reloading after boot what I did was

  rm /etc/sysconfig/iptables-config
  rm /etc/sysconfig/ip6tables-config
  systemctl disable firewalld

As for your questions at the bottom I haven't personally used nftables but to see if they are in effect at the same time you could set one to, for example drop everything and have the other wide open. Repeat on both sides and if a ping doesn't work either way that would mean they are both active.

The second question I believe is answered from the commands posted. The third question, is kind of opinion based. Do which ever you find is easier to learn and work with.

  • sorry, but removing the files (I renamed them) didn't work. Default rules reappeared anyway – user907860 Apr 11 at 16:49
  • Odd, it worked in my Fedora 29 Server VM. Do you have iptables-persistent installed? Try removing that if it exists as well as doing a iptables -F and iptables -X – notsoslimshady Apr 11 at 16:53
  • no, actually I tried to install iptables-persistent but dnf said that nothing matched the name. Then I tried dnf provides iptables-persistent and found nothing again – user907860 Apr 11 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.