Re: [CentOS] Firewalld and iptables

2018-12-15 Thread Kenneth Porter
--On Friday, December 14, 2018 11:48 PM -0500 Jon LaBadie wrote: I don't play with iptables, so I assume it is a legacy continued from CentOS 6.x. I'll gladly remove the iptables service package. firewalld is a user-space layer on top of the kernel's iptables machinery. It provides for dyn

Re: [CentOS] Firewalld and iptables

2018-12-15 Thread Kenneth Porter
--On Friday, December 14, 2018 11:48 PM -0500 Jon LaBadie wrote: https://pastebin.com/njaqR87f The rule names all look like standard builtins. Are the iptables modules loading into the kernel? Run lsmod and post that to pastebin. (I don't know what loads the firewall modules in CentOS 7

Re: [CentOS] Firewalld and iptables

2018-12-14 Thread Jon LaBadie
On Fri, Dec 14, 2018 at 04:55:33PM -0800, Kenneth Porter wrote: > --On Friday, December 14, 2018 5:57 PM -0500 Jon LaBadie > wrote: > > > Well, there are about 20 of them and several screen widths > > long. However they all end with one of two reasons: > > > > : No chain/target/match by that

Re: [CentOS] Firewalld and iptables

2018-12-14 Thread Gordon Messmer
On 12/14/18 2:57 PM, Jon LaBadie wrote: Well, there are about 20 of them and several screen widths long. However they all end with one of two reasons: : No chain/target/match by that name. : Bad rule (does a matching rule exist in that chain?). If you don't include the errors, all we c

Re: [CentOS] Firewalld and iptables

2018-12-14 Thread Kenneth Porter
--On Friday, December 14, 2018 5:57 PM -0500 Jon LaBadie wrote: Well, there are about 20 of them and several screen widths long. However they all end with one of two reasons: : No chain/target/match by that name. : Bad rule (does a matching rule exist in that chain?). Put them on a pas

Re: [CentOS] Firewalld and iptables

2018-12-14 Thread Warren Young
On Dec 14, 2018, at 3:57 PM, Jon LaBadie wrote: > > : Bad rule (does a matching rule exist in that chain?). That makes sense: the old iptables service installed several default chains, and firewalld does as well, but they’re not named the same, and I doubt there’s a 1:1 mapping between them.

Re: [CentOS] Firewalld and iptables

2018-12-14 Thread Jon LaBadie
On Fri, Dec 14, 2018 at 03:14:12PM -0700, Warren Young wrote: > On Dec 14, 2018, at 2:30 PM, Jon LaBadie wrote: > > > > After a recent large update, firewalld's status contains > > many lines of the form: > > > > WARNING: COMMAND_FAILED: '/usr/sbin/iptables… > > What’s the rest of the command?

Re: [CentOS] Firewalld and iptables

2018-12-14 Thread Warren Young
On Dec 14, 2018, at 3:14 PM, Warren Young wrote: > >alias fcp="sudo firewall-cmd —permanent" These commands are top-of-mind for me at the moment because I just configured a Raspberry Pi based network appliance at home, and installed firewalld on it for the purpose because I like it so much

Re: [CentOS] Firewalld and iptables

2018-12-14 Thread Warren Young
On Dec 14, 2018, at 2:30 PM, Jon LaBadie wrote: > > After a recent large update, firewalld's status contains > many lines of the form: > > WARNING: COMMAND_FAILED: '/usr/sbin/iptables… What’s the rest of the command? > Checking iptables.service status shows it to be masked. That’s probably f

[CentOS] Firewalld and iptables

2018-12-14 Thread Jon LaBadie
After a recent large update, firewalld's status contains many lines of the form: WARNING: COMMAND_FAILED: '/usr/sbin/iptables... Checking iptables.service status shows it to be masked. I realize that firewalld uses iptables, but should it be enabled and started as a service? Jon -- Jon H. La