# Replacing iptables (CentOS 7) with firewalld (Rocky 9) **URL:** \ **Category:** Rocky Linux Help & Support\ **Created:** [June 25, 2024, 12:04am UTC](https://forums.rockylinux.org/t/replacing-iptables-centos-7-with-firewalld-rocky-9/14790 "2024-06-25T00:04:10Z")\ **Posts on this page:** 6\ **Page:** 2
**Author:** ![DaveAtFraud](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/daveatfraud/32/2824_2.png) [@DaveAtFraud](https://forums.rockylinux.org/u/DaveAtFraud)\ **Post date:** [June 30, 2024, 10:26pm UTC](https://forums.rockylinux.org/t/replacing-iptables-centos-7-with-firewalld-rocky-9/14790/21 "2024-06-30T22:26:21Z")
firewalld configuration is NOT harder; its just different. I’m currently running Rocky 9 as my firewall/router after moving to R9 from CentOS 7. The only somewhat obscure part is to use policies to set up your ingress and egress rules with something like: firewall-cmd --policy internal-external --add-egress-zone=external --permanent firewall-cmd --policy internal-external --add-ingress-zone=public --permanent firewall-cmd --policy internal-external --set-target=ACCEPT --permanent You then configure zone public for whatever access you need from internal systems to your router/firewall and configure zone external to allow access to any services you expose to the outside world. NAT is already configured/allowed. You may need to do something like: firewall-cmd --permanent --zone=external --change-interface=eno2 to get the right NIC into the right zone. I’ve found firewalld and using firewall-cmd to configure the firewall to be much easier than doing hand edits of iptables. YMMV. ---
**Author:** ![sweh](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/sweh/32/1287_2.png) [@sweh](https://forums.rockylinux.org/u/sweh)\ **Post date:** [June 30, 2024, 10:48pm UTC](https://forums.rockylinux.org/t/replacing-iptables-centos-7-with-firewalld-rocky-9/14790/22 "2024-06-30T22:48:14Z")
My challenge is that every example of firewalld I’ve seen has been far too simplistic. A simple NAT gateway is easy. But my network is a little more complicated 🙂 In my scenario I have 4 zones (some needing NAT, others that don’t), with a bunch of specialised rules that define the communication between zones, a number of exposed services that need to be DNAT’d so people in the external zone can reach internal resources (some with logging, some without) and finally that pesky “reflection” problem. Oh, and different rules for IPv6 All in all this takes 88 `nft` rules to define; 64 for IPv4 and 24 for IPv6. I have no idea how I’d implement all that with firewalld! ---
**Author:** ![DaveAtFraud](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/daveatfraud/32/2824_2.png) [@DaveAtFraud](https://forums.rockylinux.org/u/DaveAtFraud)\ **Post date:** [June 30, 2024, 11:15pm UTC](https://forums.rockylinux.org/t/replacing-iptables-centos-7-with-firewalld-rocky-9/14790/23 "2024-06-30T23:15:10Z")
Suggestion: try setting up your current four zones as custom zones in firewalld and build as much of the rule set you can. You’ll probably find that the translation to firewall-cmd instead of nmcli and nft rules is easier than you might expect. I had good luck by setting up some VMs to mimic as much of my network as I needed (use some other subnet than your production network) and played around with firewalld/firewall-cmd there. I ended up with a 10.0.0./24 net that NATed to my 192.168.0.0/24 net and then got to the outside world. If you go this route, broadcast services like DHCP are a pain. I didn’t try setting up port forwarding from the 192-net to a system on the 10-net but that should be possible. May give it a shot. ---
**Author:** ![sweh](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/sweh/32/1287_2.png) [@sweh](https://forums.rockylinux.org/u/sweh)\ **Post date:** [June 30, 2024, 11:49pm UTC](https://forums.rockylinux.org/t/replacing-iptables-centos-7-with-firewalld-rocky-9/14790/24 "2024-06-30T23:49:10Z")
Well, I’ve done it all in `nft` now; apparently RH say this is a viable approach ( Message #5 ), so I’ve no need to redo it now! Maybe in 8 years time when RL9 is EOL and I’ll have to work out how RL11 does things 🤣 ---
**Author:** ![sweh](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/sweh/32/1287_2.png) [@sweh](https://forums.rockylinux.org/u/sweh)\ **Post date:** [July 18, 2024, 9:29pm UTC](https://forums.rockylinux.org/t/replacing-iptables-centos-7-with-firewalld-rocky-9/14790/25 "2024-07-18T21:29:53Z")
If anyone is interested, I’ve written up my learnings here; `nmcli` and `nft` rules and more > **[Building a home router · Ramblings of a Unix Geek](https://www.sweharris.org/post/2024-07-18-home-router-redux/)** > > 2024 edition ---
**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/rockylinux/original/1X/91b7219eec10e30013422e4df76c1d898711a5d5.svg) [@system](https://forums.rockylinux.org/u/system)\ **Post date:** [September 16, 2024, 9:30pm UTC](https://forums.rockylinux.org/t/replacing-iptables-centos-7-with-firewalld-rocky-9/14790/26 "2024-09-16T21:30:42Z")
Closed on September 16, 2024, 9:30pm UTC This topic was automatically closed 60 days after the last reply. New replies are no longer allowed. [Previous page](https://forums.rockylinux.org/t/replacing-iptables-centos-7-with-firewalld-rocky-9/14790.md?page=1)