Oracle Linux 10 – firewalld default zone blocks application port access – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Service is listening locally but remote clients cannot connect.

Environment & Reproduction

Often appears when interfaces bind to an unexpected zone.

systemctl status firewalld
firewall-cmd --get-active-zones
ss -tulpn | grep 8443

Root Cause Analysis

Missing permanent rules or wrong zone mapping blocks required traffic.

Quick Triage

Compare runtime and permanent firewall state.

firewall-cmd --list-all
firewall-cmd --runtime-to-permanent --check || true
journalctl -u firewalld -n 50

Step-by-Step Diagnosis

Identify interface zone and required service mapping.

nmcli -t -f DEVICE,CONNECTION device
firewall-cmd --zone=public --list-ports
firewall-cmd --zone=public --list-services

Solution – Primary Fix

Add permanent port rule and reload firewalld.

firewall-cmd --zone=public --add-port=8443/tcp --permanent
firewall-cmd --reload
firewall-cmd --zone=public --query-port=8443/tcp

Solution – Alternative Approaches

Create a custom service and map interface to dedicated zone.

firewall-cmd --permanent --new-service=myapp
firewall-cmd --permanent --service=myapp --add-port=8443/tcp
firewall-cmd --zone=internal --change-interface=eth0 --permanent
firewall-cmd --reload

Verification & Acceptance Criteria

Remote connections succeed and rule survives reboot.

nc -zv localhost 8443
firewall-cmd --list-all
systemctl reboot

Rollback Plan

Remove exposed rule if scope is broader than intended.

firewall-cmd --zone=public --remove-port=8443/tcp --permanent
firewall-cmd --reload

Prevention & Hardening

Standardize zone policy and review firewall changes in approval workflows.

firewall-cmd --get-default-zone
firewall-cmd --permanent --list-all-zones

Related Errors & Cross-Refs

Correlates with SELinux port labels and reverse proxy misbinding.

Related tutorial: View the step-by-step tutorial for oracle-linux-10.

View all oracle-linux-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Oracle Linux firewalld and network security documentation.