docs/release-notes
19
0
Fork 7
Code Issues 41 Pull requests Projects Activity Actions

Issue 396 - firewalld now uses nftables as its default backend

Browse source
This commit is contained in:
Petr Bokoč 2020-04-14 16:16:42 +02:00
commit 272bf29f97
1 changed files with 12 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

12
modules/release-notes/pages/sysadmin/Security.adoc
View file

@ -3,3 +3,15 @@ include::{partialsdir}/entities.adoc[]
[[sect-security]]
= Security
== firewalld now uses nftables as its default backend
With this release, the `nftables` filtering subsystem becomes the default firewall backend for the `firewalld` daemon.
To change the backend, use the `FirewallBackend` option in the `/etc/firewalld/firewalld.conf` file.
This change introduces the following differences in behavior when using `nftables`:
* `iptables` rule executions always occur _before_ `firewalld` rules
** `DROP` in `iptables` means a packet is never seen by `firewalld`
** `ACCEPT` in `iptables` means a packet is still subject to `firewalld` rules
* direct-rule execution occurs _before_ `firewalld` generic acceptance of established connections
For more information, see link:https://firewalld.org/2018/07/nftables-backend[] and link:https://fedoraproject.org/wiki/Changes/firewalld_default_to_nftables[].