Firewall Backend Transition in CentOS 8: Preserving Custom iptables Rulesets During firewalld Upgrade

Firewall Backend Transition in CentOS 8: Preserving Custom iptables Rulesets During firewalld Upgrade

Problem Context

CentOS 8 and CentOS Stream ship firewalld configured to use nftables as the default backend instead of the legacy iptables service. This creates a configuration transition boundary where existing packet-filter rulesets written for iptables are not automatically converted into firewalld zones or nftables rules during upgrade.

Affected Feature

The firewalld service management and rule persistence mechanism. When upgrading from CentOS 7 or earlier systems that relied on iptables service, administrators must determine whether their custom iptables rules will be preserved or require manual rewrite into firewalld rich rules.

Constraints and Uncertainty

firewalld manages its own nftables ruleset independently, and enabling the legacy iptables service alongside firewalld can produce duplicate or conflicting filter rules. Direct iptables rules in firewalld are deprecated in favor of rich rules and may be removed in future releases. Testing rule changes in a non-production VM is essential before applying to production systems, as an incorrect ruleset can drop SSH access.

Specific Questions

• Does the upgrade process provide any automated mechanism to preserve custom iptables rulesets, or is manual conversion to firewalld rich rules always required?
• How can administrators verify which backend (nftables or iptables) currently owns specific chains before and after upgrade?
• What is the recommended approach for testing rule compatibility in a staging environment while ensuring SSH connectivity remains available?