3

Is there any advantage (other than usability) to using ufw, system-config-firewall-tui, or firewalld rather than just using iptables?

My understanding is that these other programs just simplify iptables.

2
  • 1
    These are very different programs. ufw is a tool for configuring an ip tables firewall, while firewalld is a complete replacement firewall with a different feature set to iptables. Nov 22, 2013 at 9:52
  • Well, that is just patently false. Firewalld is itself yet another wrapper over Netfilter--the same as UFW. What one could truthfully say is that firewalld has a different paradigm to configuring Netfilter (through the use of zones) than UFW. In the end, both tools end up using iptables or nftables to configure Netfilter, but how they do so is very different. To back up this claim further, it's possible to write "direct rules" in firewalld that are then passed to nftables to configure Nefilter. Oct 7, 2023 at 4:11

1 Answer 1

4

It has more to do with the management systems around iptables that each provides. Firewalld, specifically, was designed to make dynamic loading feasible. With the old shell-script based iptables tools, if you wanted to make a change you would have to 'restart' iptables which involved taking down all the firewall state and bringing it back up again. Depending on configuration, you could lose connections, tracking state, etc.

Firewalld lets you add entries on-the-fly and avoids these problems. It also allows applications to interface with the firewall with a defined protocol, which makes it more usable for many people and allows packagers to help out the user.

It's also a bit of a pain in the neck for an admin who is used to just editing a text file. The features are a trade-off for ease-of-use at this point. One expects future improvements here.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .