how to use firewalld in stateful mode

Solution 1:

thanks to setenforce 1 and his excellent answer here.

Firewalld configures iptables or nftables, and the resulting configuration is stateful (based on connstate status: established, related, untrack, invalid, new).

You can check the actual configuration with iptables -L -n -v and nft list ruleset.

You can choose which backend you want to use in /etc/firewalld/firewalld.conf with the option FirewallBackend. If you want Firewalld to use iptables, you have to set: FirewallBackend=iptables

If you want to disable Firewalld to use you standard iptables configurations, you can use:

systemctl disable firewalld --now
systemctl mask firewalld