Differences and Use Cases: firewalld vs iptables

A detailed guide on the characteristics, differences, and best use cases for the two major firewall management tools in Linux environments.

Key Points

• Appropriate Selection

  ---

  Choose the optimal tool based on your environment and requirements

• Migration Strategy

  ---

  Safe migration methods from existing environments

• Performance Comparison

  ---

  Understand performance characteristics by use case

• Unified Management

  ---

  Consistent management approaches across multiple environments

Architectural Differences

System Architecture Comparison

graph TB
    subgraph "firewalld Architecture"
        A1[firewalld Daemon]
        A2[firewall-cmd CLI]
        A3[GUI Tools]
        A4[D-Bus Interface]
        A5[XML Config Files]
        A6[netfilter/iptables]

        A2 --> A4
        A3 --> A4
        A4 --> A1
        A1 --> A5
        A1 --> A6
    end

    subgraph "iptables Architecture"
        B1[iptables Command]
        B2[Config Files]
        B3[netfilter/iptables]

        B1 --> B3
        B2 --> B3
    end

    style A1 fill:#4ecdc4
    style A6 fill:#ffeaa7
    style B1 fill:#ff6b6b
    style B3 fill:#ffeaa7

Management Layer Differences

Item	firewalld	iptables
Management Level	High-level (abstracted)	Low-level (direct control)
Configuration Method	Service/zone-based	Rule-based
Configuration Application	Dynamic (no restart needed)	Static (reload required)
Backend	iptables/nftables	Direct to kernel
GUI	Available	Command-line only

Concept Comparison

firewalld Zone-Based Management

graph LR
    subgraph "firewalld Zone Concept"
        A[Network<br/>Interface] --> B[Zone Assignment]
        B --> C{trusted}
        B --> D{public}
        B --> E{internal}
        B --> F{dmz}

        C --> G[All Services Allowed]
        D --> H[Basic Services Only]
        E --> I[For Internal Networks]
        F --> J[DMZ Restrictions]
    end

    style C fill:#4ecdc4
    style D fill:#ffeaa7
    style E fill:#a8e6cf
    style F fill:#ffaaa5

iptables Chain-Based Management

graph TD
    subgraph "iptables Chain Concept"
        A[Packet Received] --> B{Processing Direction}
        B --> C[INPUT<br/>To Local]
        B --> D[FORWARD<br/>Forwarding]
        B --> E[OUTPUT<br/>Outgoing]

        C --> F[filter Table]
        D --> F
        E --> F

        G[nat Table] --> H[PREROUTING]
        G --> I[POSTROUTING]

        F --> J[ACCEPT/DROP/REJECT]
    end

    style F fill:#4ecdc4
    style G fill:#ffeaa7

Configuration Method Comparison

Basic Web Server Configuration

firewalld Configuration

# Service-based configuration
sudo firewall-cmd --add-service=http --permanent
sudo firewall-cmd --add-service=https --permanent
sudo firewall-cmd --add-service=ssh --permanent

# Zone change
sudo firewall-cmd --set-default-zone=public

# Apply configuration
sudo firewall-cmd --reload

# Verify
sudo firewall-cmd --list-all

iptables Configuration

# Rule-based configuration
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Default policy
sudo iptables -P INPUT DROP
sudo iptables -P OUTPUT ACCEPT
sudo iptables -P FORWARD DROP

# Save configuration
sudo iptables-save > /etc/iptables/rules.v4

Advanced Configuration Examples Compared

IP Restriction Configuration

firewalld:

# Using Rich Rules
sudo firewall-cmd --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" service name="ssh" accept' --permanent
sudo firewall-cmd --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" reject' --permanent

iptables:

# Direct rule specification
sudo iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 22 -j ACCEPT
sudo iptables -A INPUT -s 10.0.0.0/8 -j REJECT

Operational Comparison

Impact of Configuration Changes

sequenceDiagram
    participant A as Administrator
    participant F as firewalld
    participant I as iptables
    participant K as Kernel

    Note over A,K: Changes with firewalld
    A->>F: firewall-cmd --add-service=http
    F->>K: Add rule (applied immediately)
    Note over F,K: Existing connections are maintained

    Note over A,K: Changes with iptables
    A->>I: iptables -A INPUT
    I->>K: Add rule (applied immediately)
    Note over I,K: Connections may drop depending on config

Management Cost Comparison

Item	firewalld	iptables
Learning Cost	Medium (concept understanding important)	High (detailed knowledge required)
Configuration Complexity	Low (leverage service definitions)	High (detailed rule specification)
Maintainability	High (structured configuration)	Medium (depends on number of rules)
Debugging	Medium (detailed logging)	High (easy rule tracing)
Automation	High (leverage API/D-Bus)	Medium (scripting)

Performance Comparison

Processing Performance Differences

graph LR
    subgraph "firewalld Performance"
        A1[Management Request] --> A2[firewalld daemon]
        A2 --> A3[iptables Execution]
        A3 --> A4[Kernel Processing]
        A4 --> A5[Packet Processing]
    end

    subgraph "iptables Performance"  
        B1[iptables Execution] --> B2[Kernel Processing]
        B2 --> B3[Packet Processing]
    end

    style A2 fill:#ffeaa7
    style A4 fill:#4ecdc4
    style B2 fill:#4ecdc4

Performance Characteristics

Item	firewalld	iptables
Startup Time	Slightly slow (daemon startup)	Fast (direct execution)
Configuration Application	Fast (differential update)	Medium (full reload)
Runtime Performance	Equivalent (same backend)	Equivalent (kernel processing)
Memory Usage	More (daemon resident)	Less (rules only)
Large Rule Sets	Good (structured management)	Potential performance degradation

Usage Guidelines

When firewalld is Suitable

mindmap
    root((firewalld Use Cases))
        Desktop Environments
            GUI management needed
            Frequent configuration changes
            Network switching
        Server Management
            Multi-environment management
            Automation & API integration
            Team operations
        Learning & Testing
            Concept-focused learning
            Frequent trial and error
            Safe configuration changes

Recommended Cases: - Standard environments on CentOS/RHEL 7 or later - When GUI management tools are desired - Dynamic network environments - Consistent management needed in team development - Automation and orchestration environments

When iptables is Suitable

mindmap
    root((iptables Use Cases))
        High Performance Requirements
            Minimal overhead
            High traffic volumes
            Real-time control
        Fine-grained Control
            Special protocols
            Complex NAT configurations
            Performance tuning
        Legacy Environments
            Older distributions
            Existing script assets
            Migration cost reduction

Recommended Cases: - Optimal performance needed in high-traffic environments - Fine-grained packet control required - Leveraging existing iptables assets - Older Linux distributions - Minimal system resource usage required

Migration Strategy

iptables → firewalld Migration

# 1. Check and save current configuration
sudo iptables-save > /backup/iptables-backup.rules

# 2. Install and enable firewalld
sudo yum install firewalld  # CentOS/RHEL
sudo systemctl enable firewalld

# 3. Disable iptables
sudo systemctl disable iptables
sudo systemctl stop iptables

# 4. Migrate basic configuration
# iptables: -A INPUT -p tcp --dport 80 -j ACCEPT
# ↓
sudo firewall-cmd --add-service=http --permanent

# 5. Apply and verify configuration
sudo systemctl start firewalld
sudo firewall-cmd --reload
sudo firewall-cmd --list-all

firewalld → iptables Migration

# 1. Check firewalld configuration with iptables
sudo iptables -L -n

# 2. Manually build iptables configuration
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -P INPUT DROP

# 3. Save configuration
sudo iptables-save > /etc/iptables/rules.v4

# 4. Stop firewalld and enable iptables
sudo systemctl stop firewalld
sudo systemctl disable firewalld
sudo systemctl enable iptables

Troubleshooting

Common Issues and Solutions

1. Configuration Not Applied

firewalld:

# Check configuration
sudo firewall-cmd --list-all
sudo firewall-cmd --list-all --permanent

# Verify permanent configuration was not forgotten
sudo firewall-cmd --reload

iptables:

# Check rules
sudo iptables -L -n --line-numbers

# Verify save was not forgotten
sudo iptables-save

2. Both Running Simultaneously

# Check status
sudo systemctl status firewalld
sudo systemctl status iptables

# Stop one
sudo systemctl stop firewalld
sudo systemctl disable firewalld

3. Configuration Backup and Restore

firewalld:

# Backup
sudo tar -czf firewalld-backup.tar.gz /etc/firewalld/

# Restore
sudo tar -xzf firewalld-backup.tar.gz -C /
sudo firewall-cmd --reload

iptables:

# Backup
sudo iptables-save > iptables-backup.rules

# Restore
sudo iptables-restore < iptables-backup.rules

Selection Criteria for Real Environments

Recommendations by Environment Type

Environment Type	Recommended Tool	Reason
Enterprise Servers	firewalld	Manageability & automation support
High-performance Web Servers	iptables	Minimal overhead
Development/Testing	firewalld	Flexible configuration changes
Embedded/IoT	iptables	Resource efficiency
Container Environments	iptables	Simple & lightweight
Desktop	firewalld	GUI management & dynamic environments

Decision Flowchart

graph TD
    A[Firewall Selection] --> B{GUI Management Needed?}
    B -->|Yes| C[firewalld]
    B -->|No| D{Existing iptables Assets?}
    D -->|Yes| E[Continue iptables]
    D -->|No| F{High Performance Requirements?}
    F -->|Yes| G[iptables]
    F -->|No| H{Automation/API Needed?}
    H -->|Yes| I[firewalld]
    H -->|No| J{Team Management?}
    J -->|Yes| K[firewalld]
    J -->|No| L[Either is Fine]

    style C fill:#4ecdc4
    style E fill:#ff6b6b
    style G fill:#ff6b6b
    style I fill:#4ecdc4
    style K fill:#4ecdc4
    style L fill:#ffeaa7

Summary

firewalld and iptables are tools with different management philosophies and approaches.

Selection Points: - ✅ Management-focused → firewalld - ✅ Performance/efficiency-focused → iptables
- ✅ Leverage existing assets → Continue with current tool - ✅ Future-proofing → Appropriate choice based on environment

Both are powerful tools, and appropriate selection based on requirements and environment is important.

Related Articles

• firewalld Command Guide
• iptables Command Guide
• Network Diagnostic Commands
• SELinux Configuration