diff --git a/plinth/modules/firewall/__init__.py b/plinth/modules/firewall/__init__.py
index 46a0b3f8b..36b50925c 100644
--- a/plinth/modules/firewall/__init__.py
+++ b/plinth/modules/firewall/__init__.py
@@ -98,7 +98,9 @@ class FirewallApp(app_module.App):
     def diagnose(self):
         """Run diagnostics and return the results."""
         results = super().diagnose()
-        results.append(_diagnose_default_zone())
+        config = privileged.get_config()
+        results.append(_diagnose_default_zone(config))
+        results.append(_diagnose_firewall_backend(config))
         return results
 
 
@@ -261,9 +263,15 @@ def remove_passthrough(ipv, *args):
         config_direct.removePassthrough('(sas)', ipv, args)
 
 
-def _diagnose_default_zone():
+def _diagnose_default_zone(config):
     """Diagnose whether the default zone is external."""
-    default_zone = privileged.get_default_zone()
     testname = gettext('Default zone is external')
-    result = 'passed' if default_zone == 'external' else 'failed'
+    result = 'passed' if config['default_zone'] == 'external' else 'failed'
+    return [testname, result]
+
+
+def _diagnose_firewall_backend(config):
+    """Diagnose whether the firewall backend is nftables."""
+    testname = gettext('Firewall backend is nftables')
+    result = 'passed' if config['backend'] == 'nftables' else 'failed'
     return [testname, result]
diff --git a/plinth/modules/firewall/privileged.py b/plinth/modules/firewall/privileged.py
index 398f68464..8d86d3800 100644
--- a/plinth/modules/firewall/privileged.py
+++ b/plinth/modules/firewall/privileged.py
@@ -132,7 +132,20 @@ def setup():
 
 
 @privileged
-def get_default_zone():
-    """Return the firewalld default zone."""
+def get_config():
+    """Return firewalld configuration for diagnostics."""
+    config = {}
+
     output = subprocess.check_output(['firewall-cmd', '--get-default-zone'])
-    return output.decode().strip()
+    config['default_zone'] = output.decode().strip()
+
+    conf_file = '/etc/firewalld/firewalld.conf'
+    aug = augeas.Augeas(flags=augeas.Augeas.NO_LOAD +
+                        augeas.Augeas.NO_MODL_AUTOLOAD)
+    aug.transform('Shellvars', conf_file)
+    aug.set('/augeas/context', '/files' + conf_file)
+    aug.load()
+
+    config['backend'] = aug.get('FirewallBackend')
+
+    return config