I'm trying to set up a firewall on my own desktop (currently I'm tinkering with a Fedora 29 virtual machine). I would like to have it on the "deny-everything-by-default" basis. Almost immediately I decided to disable and mask the
firewalld had no way to drop the outgoing packets, except by using the native
iptables syntax. So I decided to resort to
nftables, since it's the modern replacement for the former.
The problem is that after a system reboot
iptables chains have some rules, which I didn't set (and I have no idea where they come from). On the other hand
# nft list ruleset returns nothing. So I assume, that rules from
nft will be enabled simultaneously and when I set up some
nft rules, rules from
iptables, which can appear from "nowhere", will be able to meddle.
I tried to remove
dnf refused to do so and warned that
systemd depends on it.
So could anyone answer a couple of my questions here, please?
- Do I understand the concepts here correctly (that
iptablesrules and chains are separate from
nftones, and that they both are in effect at the same time)?
- How can I reliably use
- Or should I simply use