----- Original Message -----
| >> I don't really understand the intent behind firewalld. The RHEL7 Security
| >> Guide states "A graphical configuration tool, *firewall-config*, is used
| to
| >> configure firewalld, which in turn uses *iptables tool* to communicate
| with
| >> *Netfilter* in the kernel which implements packet filtering".
|
| >Well, the order from Kernel inside outward is:
| >
| >1. Netfilter (inside Kernel), not directly accessible by userland
| >2. iptables/iptables6, the userland cli tools to manipulate the Netfilter
| > ....
| >3. firewalld(RedHat/CentOS), or SuSEfirewall(Suse), or similar are the
| > ....
| >4. GUI tools, that allow to manipulate the config of firewalld (or
| similar),
| ....
| >Does that answer your question about *value added* by GUI tools?
| >Not every user that needs to change firewall settings is a certified UNIX
| admin.
|
| I don't dispute the value of GUIs. I have a comment and a question, first
| that in "the data center" my experience is that iptables rules are put into
| place and only rarely changed thereafter, like the network configuration at
| the server.
|
| But my question was partly this: What is the specific need for a
| continuously running daemon firewalld if what we wanted was a GUI front-end
| for iptables?
| Thanks....Nick Geo
firewalld is more than just a GUI configuration system. It is a far more capable system than static firewall rules and can be used to simplify ruleset creation. With support for DBUS for example only when applications are running are the rules made available. For servers it can be used to help compartmentalize your current rules and the use of zones to apply different rulesets to different interfaces is quite nice.
I think the idea that rulesets are put into place and rarely change is becoming less and less true in cloud like environments. A well built firewalld system can deal with these types of environments a bit better IMHO.
--
James A. Peltier
IT Services - Research Computing Group
Simon Fraser University - Burnaby Campus
Phone : 604-365-6432
Fax : 778-782-3045
E-Mail : jpeltier@xxxxxx
Website : http://www.sfu.ca/itservices
Twitter : @sfu_rcg
Powering Engagement Through Technology
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
https://lists.centos.org/mailman/listinfo/centos
