Application port blocked by firewalld

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Service is running locally but unreachable from remote clients due to firewall filtering.

Environment & Reproduction

RHEL 8 with `firewalld` enabled; test remote connection to app TCP port.

Root Cause Analysis

Required port or service not allowed in the correct zone, or runtime changes were not made permanent.

Quick Triage

Confirm daemon listens with `ss -lntp` and inspect active zone configuration with `firewall-cmd`.

Step-by-Step Diagnosis

Check `firewall-cmd –get-active-zones`, list rules with `–list-all`, and verify interface-to-zone mapping.

Solution – Primary Fix

Add needed rule using `firewall-cmd –add-port` or `–add-service` with `–permanent`, then reload firewalld.

Solution – Alternative Approaches

Create rich rules for source-limited access or use dedicated zone policy for application subnets.

Verification & Acceptance Criteria

Remote connectivity test succeeds, and `firewall-cmd –list-all` persists expected rules after reboot.

Rollback Plan

Remove newly added rule and reload if it exposes unintended access surface.

Prevention & Hardening

Manage firewall policies as code and regularly audit zone assignments and exposed ports.

Related Errors & Cross-Refs

Connection timed out while service is active, and zone mismatch between interface and policy.

Related tutorial: View the step-by-step tutorial for rhel-8.

View all rhel-8 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

`firewalld(1)`, `firewall-cmd(1)`, and RHEL network security documentation.