Need help understanding firewall configuration in Leap

English Network/Internet
1

So I’m trying to determine if my Leap 15.4 actually has a working firewall or not.

If I go graphical into YaST > Security and Users > Firewall, the Start-Up tab says the Service Configuration status is Active. Then if I look at the Zones, some will have service(s) listed under the Allowed box in the Services tab while others don’t. But for all Zones, the Ports tab fields are empty.

Via terminal, I learned this:

u@localhost:~> systemctl status *firewall*
● firewalld.service - firewalld - dynamic firewall daemon
     Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: disabled)
     Active: active (running) since Wed 2023-08-23 22:05:47 PST; 1h 7min ago
       Docs: man:firewalld(1)
   Main PID: 1343 (firewalld)
      Tasks: 2 (limit: 4915)
     CGroup: /system.slice/firewalld.service
             └─ 1343 /usr/bin/python3 /usr/sbin/firewalld --nofork --nopid

But when I check iptables and ip6tables, I don’t see any rules:

u@localhost:~> sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
u@localhost:~> sudo ip6tables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Now my questions are:

  1. Is the firewall in YaST different from firewalld and iptables?

  2. If they are different from each other, which one should I bother configuring?

  3. Looking back at my Windows background, is iptables/ip6tables synonymous to the base filtering engine in the sense that it’s simply the underlying engine used by front-end programs to perform network filtering?

  4. Based on the information I have shared above, do I have a firewall actually shielding me from unwanted traffic or is my Leap box almost like a brand new MacBook shipped with the firewall turned off be default?

2

firewalld is using nftables as default backend.

nft list ruleset
1 Like
3

Thanks for the insight @arvidjaar . Tried listing the rulesets and found that it is not empty (which is good), but most of the rules in the chains keep on saying “jump.” I have a lot of reading to do.

New set of questions though:

  1. If nftables is the backend for firewalld, why is iptables still included in Leap?

  2. So doing a little analogy: nftables is to iptables, firewalld is to ufw, and YaST firewall is to gufw. Is this correct?

4

The nftables packet filter implimentation is a successor to iptables (as part of the Netfilter Project). The latter is kept for compatibility/legacy reasons, but by default Firewalld is now using the nftables backend. Firewalld has a graphical front-end provided by the firewall-config package. YaST provides a simpler graphical front-end, albeit with less functionality, (and which I personally don’t tend to use at all).

Some reading:

1 Like