Firewalld 2.0 Released With Faster Forwarding Performance Via NFTables Flowtable

Written by Michael Larabel in Free Software on 23 June 2023 at 02:26 PM EDT. 15 Comments
The Firewalld open-source firewall daemon has been in development since 2011 while only two years ago did it reach the Firewalld 1.0 milestone. Thus it was a bit surprising to find Firewalld 2.0 being released today.

The Firewalld 2.0 release is motivated by a change to disallow zone drifting. The fix is around addressing an issue where firewall policies could end up violating the rule of "packets ingress one and only one zone." The change is explained in this commit.

Firewalld 2.0 also adds support for NFTables flowtable, which is a software fast-path that can significantly improve forwarding performance. Firewalld with NftablesFlowtable enabled has increased iperf performance with network forwarding by around 59%. More details on this feature via the blog. Firewalld 2.0 also adds a new zone priorities feature.

Firewalld 2.0 also does away with the TFTP client service. Firewalld's TFTP client service was for accessing Trivial File Transfer Protocol servers but it turned out to not actually work in practice. The service "never actually worked" when being added to a zone. Instead TFTP users are recommended to setup a policy instead such as:
# firewall-cmd --permanent --new-policy hostTftpTraffic
# firewall-cmd --permanent --policy hostTftpTraffic --add-ingress-zone HOST
# firewall-cmd --permanent --policy hostTftpTraffic --add-egress-zone ANY
# firewall-cmd --permanent --policy hostTftpTraffic --add-service tftp

Firewalld 2.0 also adds support for service files to handle firewall configurations for many games ranging from Anno 1800 to 0 A.D. to Minecraft, Stellaris, SuperTuxKart, and many others. There are also service files added for the Zabbix Java Gateway, Zabbix Web Service, OpenTelemetry, and others.

Downloads and more details on Firewalld 2.0 via GitHub.
Related News
About The Author
Michael Larabel

Michael Larabel is the principal author of and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and automated benchmarking software. He can be followed via Twitter, LinkedIn, or contacted via

Popular News This Week