Carlos was right, it is ancient news - the script is dated 2016. I guess it is well off-topic too, but at least it is SUSE related :-) I needed a bit of a distraction, I've been working on a website, so after dinner I installed the migration script on my tw64 test box, along with firewalld. If need be, I can wipe the whole slate clean. After starting firewalld (with an empty config I presume), I tried the first run of susefirewall2-to-firewalld. It took 5m49s - seemed to spend much of it with a whole slew of icmps. Two initial comments - after looking at the output - the conversion script isn't quite ipv6 aware: INFO: RICH: Adding rich rule="rule family=ipv4 source address=fe80::/64 port port=5353 protocol=udp accept" to zone="ext" INFO: RICH: Adding rich rule="rule family=ipv4 source address=fc00::/64 port port=5353 protocol=udp accept" to zone="ext" INFO: RICH: Adding rich rule="rule family=ipv4 source address=fe80::/64 port port=5353 protocol=udp accept" to zone="int" It does however seem to understand your "from:to": port-range syntax: INFO: Adding port(s)="30000-30010/tcp" to zone="external" INFO: Adding port(s)="4664/tcp" to zone="external" INFO: Adding port(s)="427/tcp" to zone="external" INFO: Adding port(s)="5060-5100/udp" to zone="external" -- Per Jessen, Zürich (14.6°C) Member, openSUSE Heroes (2016 - present) We're hiring - https://en.opensuse.org/openSUSE:Heroes