Is firewalld the same as iptables?

Question

I tried to close iptables on RHEL 7.2 using

chkconfig iptables off

error reading information on service iptables: No such file or directory

tried /etc/init.d/iptables stop too, got

-bash: /etc/init.d/iptables: No such file or directory

Then I googled it and got this : systemctl status firewalld

What is the difference between iptables and firewalld? And how do you close iptables?

How can I give maximum privilege to the machine?

Solution 1

With RHEL 7 / CentOS 7, firewalld was introduced to manage iptables. IMHO, firewalld is more suited for workstations than for server environments.

It is possible to go back to a more classic iptables setup. First, stop and mask the firewalld service:

systemctl stop firewalld
systemctl mask firewalld

Then, install the iptables-services package:

yum install iptables-services

Enable the service at boot-time:

systemctl enable iptables

Managing the service

systemctl [stop|start|restart] iptables

Saving your firewall rules can be done as follows:

service iptables save

or

/usr/libexec/iptables/iptables.init save

Solution 2

Firewalld is a new iptables frontend used as the default firewall interface in RHEL 7.
Use systemctl to turn firewalld off and disable it:

systemctl disable firewalld
systemctl stop firewalld

Comments

[Rahul]

try to run which iptables as root and make sure iptables is installed in your box.

[Dani_l]

You do realize redhat 7 is using systemd instead of sysv init? chkconfig and init.d are the wrong tools now

[cdhit]

I have executed this command, when I executed the iptables-save > filewall.rules, I still can see from file filewall.rules there are a lot of filewall rules exist in it including ** -A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable -A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable**. What I expect is all the restrict are gone and grant the maximum privilege to this machine.

[fpmurphy]

In that case, you need to flush the existing rules using either -F or --flush