Iptables and firewalld

[shamal]

hi

I am running fedora on RPI and i have configured it to a small web server. I have everything running besides the IPtables, each time I start my RPI my Iptables wont start automatically and says its inactive (dead) so i would have go back and get enabling and starting the iptables. but the thing is when i start it my firewalld would go down and be inactive.

how do i fix this?
thx

[FLYFISH TECHNOLOGIES]

Hi,

but the thing is when i start it my firewalld would go down and be inactive.

I believe that iptables and firewalld cannot coexist and you have to make a decision which one to use.

I'm using iptables for both static and dynamic rules. The static rules are defined with standard iptables rule lines (well, obviously ).
I handle dynamic records indirectly - rules are static, but they don't apply for IP but for ipset members instead. These members are added dynamically according to various traps (eg. analyzing mail greylisting - "connect from unknown" record is one of strong indices that you're dealing with spammer and you can block this IP. You can equally block also spamming attempts from some domains, like "WAYN.com". Another example is to monitor http error log and when you catch "admin" substring present in URL, then this is spider knocking&searching for potential doors, so you can also block this IP.)

To successfully implement this, you need to understand well what is going on to be able to configure this properly. Additionally, some scripting is needed to extract IP addresses for dynamic handling... but on the other hand, you're able to customize the firewall 100% according to your needs.


Best wishes, Ivan Zilic.