On Fri, Apr 21, 2017 at 10:16 AM, Dusty Mabe <du...@dustymabe.com> wrote:
> NOTE: if you respond to this message please 'reply-all'. > > I'd like to discuss firewalld on atomic host. Recently I was trying to > figure out the best way to explain to other users how to set firewall rules > on atomic host. > > Usually I would say add your rules and then iptables-save, but on Atomic > Host docker has added it's firewall rules in there dynamically so if you > iptables-save > you'll get a bunch of stuff that you don't want in your static > configuration. > > There are ways around this; manually create your config file, or use > iptables-save > and then rip the docker stuff out. Either way it's a bit of a pain. I think > firewalld would make this easier on the user. Not sure of the pro/con > ratio though. > While I can see firewalld improving the situation wrt documenting how to add/persist firewall changes for Atomic Host (especially when using moby/docker), I think there is a bigger concern with firewalld being absent. If a user is running multiple applications that modify the host firewall (docker, Kubernetes, OpenShift, etc), firewalld provides a way to make firewall modifications in a consistent and repeatable manner, where iptables does not. There is the --wait flag for iptables, however any applications/users that are interacting with iptables will need to ensure they use it consistently. -- Jason DeTiberus
