Introduction
CentOS 8 introduces nftables as its default firewall framework, replacing the legacy iptables system. This transition means that ConfigServer Security & Firewall (CSF) now operates through an nftables compatibility layer rather than directly on iptables.
Key Takeaways:
-
CentOS 8 does not support reverting to iptables-legacy.
-
CSF translates its firewall rules into nftables automatically.
-
Best practice: Let CSF manage firewall rules instead of modifying nftables manually.
1 The New Landscape: nftables on CentOS 8
What Changed
Default Framework: CentOS 8 has fully migrated from iptables-legacy to nftables. No iptables-legacy Package: Unlike other distributions, CentOS 8 does not provide a supported way to revert to iptables-legacy.
Why nftables
Performance & Efficiency:
-
Faster processing compared to iptables.
-
Supports stateful packet filtering.
-
Provides native support for sets and maps, reducing redundancy in rule management.
Modern Firewall Management:
-
Simplified syntax for rule management.
-
Enhanced security and scalability.
2 How CSF Operates with nftables
CSF and the Compatibility Layer
Originally designed for iptables, CSF now works through a nftables compatibility layer on CentOS 8.
Automatic Translation: When you execute:
csf -rCSF automatically translates iptables-style commands into nftables syntax.
Managed Tables: You may see warnings like:
# Warning: table ip filter is managed by iptables-nft, do not touch!What This Means: The system manages these tables automatically through CSF, and manual modifications are discouraged.
Best Practices: Let CSF Manage the Firewall
Avoid Manual Changes:
-
Do NOT modify the auto-generated tables using
nftor directiptablescommands. -
Instead, make all adjustments via CSF's configuration files.
Use CSF Commands:
csf -r # Reload firewall rules
csf -g <port> # Check rules for a specific port3 Managing CSF Configuration on CentOS 8
Making Adjustments via CSF
All modifications should be performed through CSF's configuration files:
-
Main Configuration:
/etc/csf/csf.conf -
Allow/Deny Lists:
/etc/csf/csf.allow&/etc/csf/csf.deny
Whitelisting or Blacklisting IPs/Ports
To allow/block IPs or ports, edit the relevant file and reload CSF:
nano /etc/csf/csf.allow # Whitelist IPs
nano /etc/csf/csf.deny # Blacklist IPs
csf -r # Apply changesCustom Rules in CSF
If you need to define custom firewall rules, always do so within CSF's configuration instead of modifying nftables directly.
4 Verifying Active Rules
Even though you shouldn't modify nftables manually, it's useful to review applied rules.
Run the following command to inspect the active ruleset:
nft list rulesetWhat You'll See:
-
Multiple tables like ip filter, ip raw, and ip mangle.
-
Rules that are maintained by the iptables-nft compatibility layer.
5 Advantages of Using nftables with CSF
Enhanced Security & Performance
Modern Syntax & Flexibility:
-
Supports sets, maps, and efficient rule processing.
-
Reduces the complexity of firewall configurations.
CSF Compatibility:
-
CSF seamlessly works with nftables.
-
Allows continued use of familiar CSF commands while leveraging nftables' modern capabilities.
Streamlined Management
Centralized Control:
-
Managing the firewall through CSF configuration files ensures that changes are consistent.
-
Reduces the risk of conflicts with system-managed tables.
Reduced Configuration Drift:
-
Prevents accidental overwrites or errors from manual nftables modifications.
-
Ensures that security policies remain correctly enforced.
Conclusion
Managing CSF firewall rules on CentOS 8 means embracing the nftables framework. Since reverting to iptables-legacy is not an option, administrators should:
Use CSF commands & configuration files for all changes. Avoid direct modifications to nftables-managed tables. Verify rule translations using nft list ruleset to ensure security policies are correctly enforced.
By following these best practices, you maintain a secure, high-performance firewall configuration on CentOS 8 while still using the familiar CSF interface.