firewalld and nftables backend

English Network/Internet
1

With the latest tumbleweed snapshot (20201209) I see that the default backend for firewalld is now set as nftables.

On my system I use iptables backend and I added some rules for vlan managing and a ppp internet connection.
In firewalld I see that my rules rules are present in the tab direct config and subtabs rules and passtrough.
These rules are saved in/etc/firewalld/direct.xml

Should I migrate to nftables?
If yes should it be automatically done by changing the backend or do I need to translate the rules?
I see that I can translate iptables to nftables via iptables-translate.
The example given in the man is

root@machine:~# iptables-save > save.txt
root@machine:~# iptables-restore-translate -f save.txt
root@machine:~# iptables-restore-translate -f save.txt > ruleset.nft
root@machine:~# nft -f ruleset.nft

but the first command save all firewalld settings + the specific rules that I added.
Is this needed or can I just change the backend from itptables to nftables and add my rules translated?

Many thanks in advance
Philippe

2

https://firewalld.org/2018/07/nftables-backend

3

Thank you for this usefull link.

I’ll try to change the backend and see if all internal and external connections work.
I’ll report the result.
I see that there is a file firewalld.conf.rpmnew with the nftables backend as change.
So I suppose that for some complex settings the change cannot be done automatically but I have only 10 direct rules and 1 passtrough.:slight_smile:

Regards
Philippe