Firewalld 1.3 Released With Easier Firewall Management For More Services

[phoronix]

Phoronix: Firewalld 1.3 Released With Easier Firewall Management For More Services

Firewalld 1.3 is out today as the newest version of this open-source firewall daemon used on Linux systems...

https://www.phoronix.com/news/Firewalld-1.3-Released

[waxhead]

I realize the risk of sparking off a flame war here, but what the heck....

Sometimes, in fact quite often - wish systemd-networkd could work as a simple firewall. In fact most of the basics seems to be there already with socket activation and for all I know , it might even be possible somehow already.

[JPFSanders]

I will never understand why Linux firewalls won't adopt a syntax more in line with the expectation of commercial firewalls. I can configure a decent degree of commercial firewalls using the cli, but when it comes to Linux firewalls they are just awkward to use and configure. It seems that everybody has to re-invent the wheel all the time and I have to check the documentation constantly to remind me of how to do even basic stuff.

[Britoid]

I realize the risk of sparking off a flame war here, but what the heck....

Sometimes, in fact quite often - wish systemd-networkd could work as a simple firewall. In fact most of the basics seems to be there already with socket activation and for all I know , it might even be possible somehow already.

I'd be very in favour of systemd coming with a firewall...

firewalld is written in python and it's very easy to mess up a python install, imho it's not sensible to have such an important piece of software written in it.

[elatllat]

Only nftables for me thanks.

[jacob]

I will never understand why Linux firewalls won't adopt a syntax more in line with the expectation of commercial firewalls. I can configure a decent degree of commercial firewalls using the cli, but when it comes to Linux firewalls they are just awkward to use and configure. It seems that everybody has to re-invent the wheel all the time and I have to check the documentation constantly to remind me of how to do even basic stuff.

I think that's a very different use case. For a static host I see little merit in firewalld. Where it shines is on laptops, with automatic zone management etc.

[timofonic]

I'd be very in favour of systemd coming with a firewall...

firewalld is written in python and it's very easy to mess up a python install, imho it's not sensible to have such an important piece of software written in it.

Any other firewalld alternative with very low dependency?

[johncall]

Only nftables for me thanks.

Do you configure raw nftables commands, or could firewalld help you do that? https://firewalld.org/2018/07/nftables-backend

I've been a fan of firewalld ever since I saw the simple syntax to configure NAT/masquerade versus iptables:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
-vs-
firewalld --add-masquerade

[kylew77]

Any clue while pf wasn't ported to Linux. pf is available as the only firewall or as a choice on: OpenBSD, FreeBSD, NetBSD, and Solaris, and if I remember correctly an implementation is available for Mac OS. Not to mention pfsense and opensense.

[partcyborg]

I will never understand why Linux firewalls won't adopt a syntax more in line with the expectation of commercial firewalls. I can configure a decent degree of commercial firewalls using the cli, but when it comes to Linux firewalls they are just awkward to use and configure. It seems that everybody has to re-invent the wheel all the time and I have to check the documentation constantly to remind me of how to do even basic stuff.

This is one area where the modern BSDs are way ahead of linux. OpenBSD's pf (FreeBSD uses it too now) is way better than iptables all around.