Firewalld Changes Coming to Your OS
summary
Project moves to an nftables backend (landed in 0.6) that unifies IPv4/IPv6 rules, uses built‑in sets and table namespaces so firewallD coexists with other tools; runtime features added include a global flush_all_on_reload, a check-config CLI for XML/semantic validation, and a 64‑address IPv6 filter. Development shows concrete scale: 165 pull requests, ~40 contributors and 89+ issues closed. Rich rules gain explicit priorities so ordering is controllable. Tests expand from 6 to 120+ groups with CI; planned work includes live nftables library, policy objects and rate limiting.
AI-written summary · about
chapters (8)
- 0:00Intro
- 0:42Firewalld
- 1:33A busy 18 months
- 6:08nftables backend
- 11:25rich rule priorities (examples)
- 12:37New features for developers
- 14:24Possible Future features
- 18:07Community and Contributing
related talks
31mBuilding a Hypervisor Firewall with nftables and Rust
05mHow Configuring a Firewall has Changed Over the Last 15 Years- 31mBuilding a Hypervisor Firewall with nftables and Rust
52mFirewalls, and where to put them
22mRewriting the Rules: Why Kubernetes Is Moving To NFTables
41mLinkedIn's Distributed Firewall
24mLocality-Aware, Self-Adjusting Data Structures: A Case Study in Linux Firewalls
04mFirewalls for the Gaming Industry