CentOS Stream 9 – Common Problem 103 – Diagnosis and Fix

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Inbound traffic to a service is dropped despite the port being ‘open’.

Environment & Reproduction

Interface assigned to the default ‘public’ zone instead of the intended zone.

Root Cause Analysis

firewalld assigns interfaces by NetworkManager connection profile, not interface name.

Quick Triage

firewall-cmd –get-active-zones shows current assignments.

Step-by-Step Diagnosis

Inspect each connection: nmcli c show | grep zone.

Solution – Primary Fix

Set the zone on the NM connection: nmcli c modify connection.zone ; reload.

Solution – Alternative Approaches

Bind the service directly to a zone: firewall-cmd –zone= –add-service= –permanent.

Verification & Acceptance Criteria

firewall-cmd –list-all –zone= shows expected interface and ports.

Rollback Plan

Re-assign the interface back to its previous zone and reload firewalld.

Prevention & Hardening

Use distinct zones per VLAN and store rules in –permanent only.

Related Errors & Cross-Refs

Related: nftables backend issues and rich-rule ordering.

Related tutorial: View the step-by-step tutorial for centos-stream-9.

View all centos-stream-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

firewalld.org docs and Red Hat ‘Configuring firewalls’ guide.