On 10/02/2012 03:04 PM, Chris Murphy wrote:
> On Oct 2, 2012, at 12:33 AM, Ed Greshko wrote:
>> If you run the firewall-config GUI there are no rules listed anywhere. "iptables -L" shows there are plenty defined.
> I'm not sure I follow. iptables and firewalld aren't at all related and shouldn't be used at the same time. firewall-config wouldn't list iptables rules.
I am not running iptables.service.
AFAIK, firewalld still uses the underlying iptables modules....
[egreshko@localhost ~]$ systemctl status iptables.service
iptables.service - IPv4 firewall with iptables
Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled)
[egreshko@localhost ~]$ lsmod | grep ip
ipt_MASQUERADE 12880 1
ip6table_mangle 12700 1
ip6t_REJECT 12939 2
nf_conntrack_ipv6 14569 23
nf_defrag_ipv6 18177 1 nf_conntrack_ipv6
ip6table_filter 12815 1
ip6_tables 26942 2 ip6table_filter,ip6table_mangle
iptable_nat 13383 1
nf_nat 25646 2 ipt_MASQUERADE,iptable_nat
iptable_mangle 12695 1
nf_conntrack_ipv4 19143 22 nf_nat,iptable_nat
nf_defrag_ipv4 12673 1 nf_conntrack_ipv4
nf_conntrack 107669 8 nf_conntrack_netbios_ns,ipt_MASQUERADE,nf_nat,xt_conntrack,nf_conntrack_broadcast,iptable_nat,nf_conntrack_ipv4,nf_conntrack_ipv6
>
>> I thought that maybe they were "invisible" but I soon found out that doing a "Reload firewalld" causes all services to be unavailable. A systemctl restart of firewalld is needed to restore a "working" system.
> Hmm. The point of firewalld is exactly that restarts of the daemon aren't needed for behavior changes to be applied, unlike iptables.
>
Yes, since it has a D-BUS interface to allow dynamic changes without a reload. However, if you do hit reload on the "firewall-config" GUI the system becomes inaccessible via ssh, for example....
[egreshko@meimei ~]$ ssh 192.168.0.187
egreshko@192.168.0.187's password:
Last login: Sun Sep 30 15:22:20 2012 from 192.168.0.18
[egreshko@localhost ~]$
Then hit "reload firewalld" on the GUI....and....
[egreshko@meimei ~]$ ssh 192.168.0.187
ssh: connect to host 192.168.0.187 port 22: No route to host
That's not right....
--
Programming today is a race between software engineers striving to build bigger and better idiot-proof programs, and the Universe trying to produce bigger and better idiots. So far, the Universe is winning. -- Rick Cook, The Wizardry Compiled
--
test mailing list
test@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe:
https://admin.fedoraproject.org/mailman/listinfo/test
