+ 

+ == firewalld now uses nftables as its default backend

+ 

+ With this release, the `nftables` filtering subsystem becomes the default firewall backend for the `firewalld` daemon.

+ To change the backend, use the `FirewallBackend` option in the `/etc/firewalld/firewalld.conf` file.

+ This change introduces the following differences in behavior when using `nftables`:

+ * `iptables` rule executions always occur _before_ `firewalld` rules

+ ** `DROP` in `iptables` means a packet is never seen by `firewalld`

+ ** `ACCEPT` in `iptables` means a packet is still subject to `firewalld` rules

+ * direct-rule execution occurs _before_ `firewalld` generic acceptance of established connections

+ 

+ For more information, see link:https://firewalld.org/2018/07/nftables-backend[] and link:https://fedoraproject.org/wiki/Changes/firewalld_default_to_nftables[].